Attachment 128349 Details for Bug 98990 – patch v2 based on Chris Wilson's suggestion

[patch] patch v2 based on Chris Wilson's suggestion

v2-0001-drm-dp-mst-fix-kernel-oops-when-turning-off-secon.patch (text/plain), 2.06 KB, created by Pierre Bossart on 2016-12-05 21:50:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Pierre Bossart

Created: 2016-12-05 21:50:54 UTC

Size: 2.06 KB

patch

obsolete

>From 00fb1727c108c9dc8e6abf7096bcbc527905e5b0 Mon Sep 17 00:00:00 2001
>From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
>Date: Sun, 4 Dec 2016 19:01:36 -0600
>Subject: [PATCH v2] drm/dp/mst: fix kernel oops when turning off secondary
> monitor
>
>100% reproducible issue found on SKL SkullCanyon NUC with two external
>DP daisy-chained monitors in DP/MST mode. When turning off or changing
>the input of the second monitor the machine stops with a kernel
>oops. This issue happened with 4.8.8 as well as drm/drm-intel-nightly.
>
>This issue is traced to an inconsistent control flow in
>drm_dp_update_payload_part1(): the 'port' pointer is set to NULL at
>the same time as 'req_payload.num_slots' is set to zero, but the pointer
>is dereferenced even when req_payload.num_slot is zero.
>
>The problematic dereference was introduced in commit dfda0df34
>("drm/mst: rework payload table allocation to conform better")
>and may impact all versions since v3.18
>
>The fix suggested by Chris Wilson removes the kernel oops and was found to
>work well after 10mn of monkey-testing with the second monitor power and
>input buttons
>
>Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98990
>Cc: Dave Airlie <airlied@redhat.com>
>Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
>---
> drivers/gpu/drm/drm_dp_mst_topology.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
>index aa64448..f59771d 100644
>--- a/drivers/gpu/drm/drm_dp_mst_topology.c
>+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
>@@ -1817,7 +1817,7 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr)
> 				mgr->payloads[i].vcpi = req_payload.vcpi;
> 			} else if (mgr->payloads[i].num_slots) {
> 				mgr->payloads[i].num_slots = 0;
>-				drm_dp_destroy_payload_step1(mgr, port, port->vcpi.vcpi, &mgr->payloads[i]);
>+				drm_dp_destroy_payload_step1(mgr, port, mgr->payloads[i].vcpi, &mgr->payloads[i]);
> 				req_payload.payload_state = mgr->payloads[i].payload_state;
> 				mgr->payloads[i].start_slot = 0;
> 			}
>-- 
>2.7.4
>

Actions: View | Splinter Review

Attachments on bug 98990: 128335 | 128336 | 128339 | 128349

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.