Received: by 2002:ac0:946b:0:0:0:0:0 with SMTP id j40csp2687801imj; Mon, 11 Feb 2019 07:03:12 -0800 (PST) X-Google-Smtp-Source: AHgI3IZUBkyCxouMaMwDdF15viYlO1LJcsygzYstab8Zi8NYMSA0JxuGrXRXj0e+vkmajAkjPz/c X-Received: by 2002:a62:6204:: with SMTP id w4mr37345354pfb.5.1549897392014; Mon, 11 Feb 2019 07:03:12 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1549897392; cv=none; d=google.com; s=arc-20160816; b=bAw9b9+4BsAqfQOLsFNOqp4FrAgyg4H6x5E+JxVl2EGz4oNhWD35d8Zv2l/60ckLkk OUGPSV5mggksUmAbdyXdaRFVYHRj0FFOJWS7nxfXfHPV9T+Usw4uFdyXk/9Xam5lmOOz z1NNDxKTOzRJU2lzHrd2SZ1tEfVsiH+Oo8T6DQj8v6nJg5md1VqDSN67fyiJ5msHswCu 5CQabMQmv+ABKB2vtlcYDNUhc65W6panG/ced0JQLtDhFG6v3affQS8hN3Yyq5VaLkhW DxdsYvKQOeatbaoiswxVEj9MxWur17B+lMKBvdzQXrugvbVcZs6I13wWE5cLvApSSZ1i LS5A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=GvPWqS4MkgNrYQSpd7w8Lk1AlNOVjs7x/UaKRxgIGSM=; b=BgF3at5JanZTIE/bsBM8i/qdVvVtDF824xiBstqhMHMXG8XWlEQYq1oeX8LV6I+znv JQeeARtrH69QsBlkR6Ea2e+vL5tD499e1NQXXoXyJzcl5PpEGrtlRaw/48LVDBFRdb7z K0Lwmy5x2uu9QncR25k2Fd8+nrlEL/oWgCs/c/w0oPTzxxOvyEuHKTUGd1ByvY7OMJEl PgSfkBcnsQhDfgpUQlwQMS2jF82XEHn119ehepXahAKYd3oK+3WLAF6Xkn+DkxaCnQYe ZjWMf6/tFE9jJtUIUB4fPf7cgSMaUIY4WqHQoOsg74dMa8shyVRF8k/Sq5WrxUkMpTYD wy5Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=YbjeWo5K; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id v3si2014198pgr.191.2019.02.11.07.02.42; Mon, 11 Feb 2019 07:03:12 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=YbjeWo5K; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389966AbfBKPAN (ORCPT + 99 others); Mon, 11 Feb 2019 10:00:13 -0500 Received: from mail.kernel.org ([198.145.29.99]:48106 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389950AbfBKPAM (ORCPT ); Mon, 11 Feb 2019 10:00:12 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 44F9A222A4; Mon, 11 Feb 2019 15:00:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1549897211; bh=MxuTlWmylV7Bc9gIN9k6K1jTLFWBjfG1JypuYV5dpOE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YbjeWo5KzvcxI8pMa7BLmvxVUZ1yqmC1reXDOxeEwxGbq2cniDM2e1jtVa3GtZc0N faXqstvxxIAm/sXvHnU/7WlThROgkI4zVxsaxQ+dW9URuPgF6tUObKVt5ueB9TahaC Gpu8niPi4jhGOmg4wxCB+cZn95Mwx000UGyVrUiQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= , Mikulas Patocka , Daniel Vetter , Bartlomiej Zolnierkiewicz , Sasha Levin Subject: [PATCH 4.14 128/205] fbdev: fbcon: Fix unregister crash when more than one framebuffer Date: Mon, 11 Feb 2019 15:18:46 +0100 Message-Id: <20190211141836.818920524@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190211141827.214852402@linuxfoundation.org> References: <20190211141827.214852402@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit 2122b40580dd9d0620398739c773d07a7b7939d0 ] When unregistering fbdev using unregister_framebuffer(), any bound console will unbind automatically. This is working fine if this is the only framebuffer, resulting in a switch to the dummy console. However if there is a fb0 and I unregister fb1 having a bound console, I eventually get a crash. The fastest way for me to trigger the crash is to do a reboot, resulting in this splat: [ 76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442 __queue_work+0x2d4/0x41c [ 76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight bcm2835_rng rng_core [last unloaded: tinydrm] [ 76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4 [ 76.478933] Hardware name: BCM2835 [ 76.478949] Backtrace: [ 76.478995] [] (dump_backtrace) from [] (show_stack+0x20/0x24) [ 76.479022] r6:00000000 r5:c0bc73be r4:00000000 r3:6fb5bf81 [ 76.479060] [] (show_stack) from [] (dump_stack+0x20/0x28) [ 76.479102] [] (dump_stack) from [] (__warn+0xec/0x12c) [ 76.479134] [] (__warn) from [] (warn_slowpath_null+0x4c/0x58) [ 76.479165] r9:c0eb6944 r8:00000001 r7:c0e927f8 r6:c0bc73be r5:000005a2 r4:c0139e84 [ 76.479197] [] (warn_slowpath_null) from [] (__queue_work+0x2d4/0x41c) [ 76.479222] r6:d7666a00 r5:c0e918ee r4:dbc4e700 [ 76.479251] [] (__queue_work) from [] (queue_work_on+0x60/0x88) [ 76.479281] r10:c0496bf8 r9:00000100 r8:c0e92ae0 r7:00000001 r6:d9403700 r5:d7666a00 [ 76.479298] r4:20000113 [ 76.479348] [] (queue_work_on) from [] (cursor_timer_handler+0x30/0x54) [ 76.479374] r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc [ 76.479413] [] (cursor_timer_handler) from [] (call_timer_fn+0x100/0x230) [ 76.479435] r4:c0e9192f r3:d758a340 [ 76.479465] [] (call_timer_fn) from [] (expire_timers+0x10c/0x12c) [ 76.479495] r10:40000000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280 r5:c0496bf8 [ 76.479513] r4:d8a8fabc [ 76.479541] [] (expire_timers) from [] (run_timer_softirq+0xa8/0x184) [ 76.479570] r9:00000001 r8:c0e19280 r7:00000000 r6:c0e08088 r5:c0e1a3e0 r4:c0e19280 [ 76.479603] [] (run_timer_softirq) from [] (__do_softirq+0x1ac/0x3fc) [ 76.479632] r10:c0e91680 r9:d8afc020 r8:0000000a r7:00000100 r6:00000001 r5:00000002 [ 76.479650] r4:c0eb65ec [ 76.479686] [] (__do_softirq) from [] (irq_exit+0xe8/0x168) [ 76.479716] r10:d8d1a9b0 r9:d8afc000 r8:00000001 r7:d949c000 r6:00000000 r5:c0e8b3f0 [ 76.479734] r4:00000000 [ 76.479764] [] (irq_exit) from [] (__handle_domain_irq+0x94/0xb0) [ 76.479793] [] (__handle_domain_irq) from [] (bcm2835_handle_irq+0x3c/0x48) [ 76.479823] r8:d8afdebc r7:d8afddfc r6:ffffffff r5:c0e089f8 r4:d8afddc8 r3:d8afddc8 [ 76.479851] [] (bcm2835_handle_irq) from [] (__irq_svc+0x70/0x98) The problem is in the console rebinding in fbcon_fb_unbind(). It uses the virtual console index as the new framebuffer index to bind the console(s) to. The correct way is to use the con2fb_map lookup table to find the framebuffer index. Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from unregister_framebuffer") Signed-off-by: Noralf Trønnes Reviewed-by: Mikulas Patocka Acked-by: Daniel Vetter Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Sasha Levin --- drivers/video/fbdev/core/fbcon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 04612f938bab..85787119bfbf 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -3041,7 +3041,7 @@ static int fbcon_fb_unbind(int idx) for (i = first_fb_vc; i <= last_fb_vc; i++) { if (con2fb_map[i] != idx && con2fb_map[i] != -1) { - new_idx = i; + new_idx = con2fb_map[i]; break; } } -- 2.19.1