Thomas Zimmermann
27a7e8b6c5
drm/sysfb: Do not deref unexisting CRTC state in atomic_disable
Do not access CRTC state in drm_sysfb_plane_helper_atomic_disable().
Use format from sysfb device for clearing scanout buffer. This is
the behavior from before commit 061963cd9e ("drm/sysfb: Blit to
CRTC destination format").
When being disabled, the plane has no associated CRTC. Trying to deref
the format pointer results in a segmentation fault. An example stack
track is shown below.
[ 58.948915] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000023: 0000 [#1] SMP KASAN PTI
[ 58.959971] KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
[...]
[ 58.979308] RIP: 0010:drm_sysfb_plane_helper_atomic_disable+0x1af/0x520
[...]
[ 59.084227] Call Trace:
[ 59.086682] <TASK>
[ 59.088793] ? __pfx_drm_sysfb_plane_helper_atomic_disable+0x10/0x10
[ 59.095155] ? crtc_disable+0xf2/0x5a0
[ 59.098920] drm_atomic_helper_commit_planes+0x848/0x1030
[ 59.104336] drm_atomic_helper_commit_tail+0x41/0xb0
[ 59.109316] commit_tail+0x204/0x330
[ 59.112903] drm_atomic_helper_commit+0x242/0x2e0
[ 59.117618] ? __pfx_drm_atomic_helper_commit+0x10/0x10
[ 59.122851] drm_atomic_commit+0x1e1/0x290
[ 59.126957] ? drm_atomic_add_affected_connectors+0x266/0x330
[ 59.132714] ? __pfx_drm_atomic_commit+0x10/0x10
[ 59.137343] ? __pfx___drm_printfn_info+0x10/0x10
[ 59.142058] ? drm_atomic_set_crtc_for_connector+0x436/0x630
[ 59.147729] atomic_remove_fb+0x631/0x920
[ 59.151751] ? save_trace+0xcf/0x180
[ 59.155343] ? __pfx_atomic_remove_fb+0x10/0x10
[ 59.159890] ? __pfx___drm_dev_dbg+0x10/0x10
[ 59.164173] drm_framebuffer_remove+0x19a/0x710
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 061963cd9e ("drm/sysfb: Blit to CRTC destination format")
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14874
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://lore.kernel.org/r/20250826145044.954396-1-tzimmermann@suse.de
2025-08-27 14:09:58 +02:00
..
2025-05-23 15:03:47 +02:00
2025-08-12 16:16:36 -04:00
2025-07-30 19:26:49 -07:00
2025-07-16 20:07:32 +03:00
2025-07-30 19:26:49 -07:00
2025-08-22 21:10:17 +03:00
2025-07-04 11:06:38 -07:00
2025-07-06 14:05:07 +03:00
2025-08-21 13:41:59 +03:00
2025-07-30 19:26:49 -07:00
2025-07-31 14:57:54 -07:00
2025-07-31 14:57:54 -07:00
2025-08-11 17:18:24 +02:00
2025-06-04 11:26:17 -07:00
2025-06-05 14:59:56 +02:00
2025-08-12 09:05:11 +01:00
2025-08-19 21:19:31 -07:00
2025-05-14 15:11:31 +08:00
2025-07-16 20:03:14 +03:00
2025-06-16 09:01:23 +02:00
2025-07-30 19:26:49 -07:00
2025-04-23 15:40:30 -05:00
2025-04-29 11:21:23 +02:00
2025-07-30 19:26:49 -07:00
2025-06-18 08:09:35 +10:00
2025-07-30 19:26:49 -07:00
2025-08-23 17:20:18 +03:00
2025-07-22 13:01:28 +02:00
2025-08-20 09:33:06 +02:00
2025-08-11 14:37:45 +02:00
2025-08-14 07:51:34 +10:00
2025-08-22 23:00:07 +02:00
2025-08-20 09:33:06 +02:00
2025-08-19 21:19:31 -07:00
2025-07-16 20:05:58 +03:00
2025-08-06 15:26:16 +03:00
2025-08-14 06:57:34 +01:00
2025-08-22 23:13:11 +02:00
2025-08-11 14:37:45 +02:00
2025-07-16 12:12:39 +02:00
2025-06-12 14:04:56 +02:00
2025-03-10 16:25:01 -04:00
2025-07-09 11:24:45 +02:00
2025-05-21 13:40:09 +02:00
2025-06-02 09:59:10 +02:00
2025-08-27 14:09:58 +02:00
2025-07-30 19:26:49 -07:00
2025-07-16 20:03:14 +03:00
2025-08-13 11:11:02 +03:00
2025-08-11 18:49:55 +02:00
2025-07-31 14:57:54 -07:00
2025-07-07 15:23:41 +02:00
2025-08-11 14:37:45 +02:00
2025-07-16 20:03:14 +03:00
2025-07-07 15:24:14 +02:00
2025-08-20 13:36:45 +03:00
2025-07-31 16:29:59 +02:00
2025-08-11 14:37:45 +02:00
2025-08-20 09:33:06 +02:00
2025-07-16 20:05:58 +03:00
2025-07-30 19:26:49 -07:00
2025-07-22 13:01:28 +02:00
2025-06-16 09:01:23 +02:00
2025-08-22 14:31:21 -03:00
2025-06-16 09:01:23 +02:00
2025-06-16 09:01:23 +02:00
2025-04-30 23:35:00 +02:00
2025-06-16 09:02:25 +02:00
2025-08-19 07:02:30 +10:00
2025-07-30 19:26:49 -07:00
2025-07-10 13:07:26 +02:00
2025-06-16 09:02:29 +02:00
2025-06-16 09:02:29 +02:00
2025-06-16 09:02:29 +02:00
2025-08-26 09:54:18 +02:00
2025-06-23 21:44:55 +03:00
2025-03-27 14:02:57 +02:00
2025-06-16 09:01:23 +02:00
2025-06-16 09:01:23 +02:00
2025-07-04 15:59:06 +02:00
2025-04-16 20:40:51 +03:00
2025-04-07 14:35:48 +02:00
2025-07-04 15:58:22 +02:00
2025-06-27 09:58:05 +10:00
2025-06-16 09:01:23 +02:00
2025-06-16 09:01:23 +02:00
2025-06-16 09:02:29 +02:00
2025-06-16 09:02:29 +02:00
2025-06-16 09:02:29 +02:00
2025-06-16 09:02:29 +02:00
2025-07-04 15:59:06 +02:00
2025-06-16 09:01:23 +02:00
2025-08-26 09:54:18 +02:00
2025-06-27 15:59:23 +02:00
2025-07-16 20:01:13 +03:00
2025-07-30 19:26:49 -07:00
2025-06-16 09:02:35 +02:00
2025-07-17 12:26:19 +02:00
2025-07-30 19:26:49 -07:00
2025-07-30 19:26:49 -07:00
2025-06-16 09:02:35 +02:00
2025-06-16 09:02:35 +02:00
2025-08-11 14:37:45 +02:00
2025-08-19 21:19:36 -07:00
2025-08-19 21:19:35 -07:00
2025-08-11 14:37:45 +02:00
2025-07-18 08:59:24 +02:00
2025-06-16 09:01:23 +02:00
2025-06-27 15:59:23 +02:00
2025-08-14 15:42:26 -07:00
2025-06-16 09:01:23 +02:00
2025-07-16 20:12:35 +03:00
2025-06-16 09:01:23 +02:00
2025-08-21 16:21:08 +02:00
2025-06-26 18:00:10 +02:00
2025-06-16 09:02:39 +02:00
2025-06-16 09:02:39 +02:00
2025-08-25 09:17:49 -07:00
2025-08-03 13:49:10 -07:00
2025-06-16 09:01:23 +02:00
2025-06-16 09:00:09 +02:00
2025-06-16 09:01:23 +02:00
2025-06-16 09:01:23 +02:00
2025-08-11 14:37:45 +02:00
2025-06-16 09:01:23 +02:00
2025-06-16 09:01:23 +02:00
2025-07-22 13:01:28 +02:00
2025-06-16 09:01:23 +02:00
2025-06-16 09:01:23 +02:00
2025-06-16 09:01:23 +02:00
2025-06-16 09:01:23 +02:00
2025-06-17 10:44:15 +02:00
2025-06-16 09:01:23 +02:00
2025-06-08 09:07:37 +02:00
2025-06-16 09:01:23 +02:00
2025-07-30 19:26:49 -07:00
2025-06-04 11:26:17 -07:00
2025-06-18 10:46:03 +02:00
2025-06-26 18:00:07 +02:00