Skip to content

Draft: v4l2_poll debug#55

Closed
weichenli-intel wants to merge 1 commit intoprojectceladon:mainfrom
weichenli-intel:metadata_0407
Closed

Draft: v4l2_poll debug#55
weichenli-intel wants to merge 1 commit intoprojectceladon:mainfrom
weichenli-intel:metadata_0407

Conversation

@weichenli-intel
Copy link

@weichenli-intel weichenli-intel commented May 19, 2025

No description provided.

@sysopenci
Copy link

sysopenci commented May 19, 2025

Expected syntax:
Commit message one-line summary

  Extra paragraphs can be added here.

  Longer description that explains the problem / solution
  or whatever that needs to be said

  It can contain
    multiple lines
    multiple paragraphs
    blank lines
    references

  But each paragraph must be followed by a blank line

  However, you need to keep the 'Tracked-On', 'Change-Id',
  'Signed-off-by', ..., fields in the **lastest** paragraph of
  the commit message.

  Change-Id: I9e58f79c7faf7f0edb9792e8b5322ab161331141
  Tracked-On: https://jira.server.ext/browse/PROJECTA-123
  Signed-off-by: Developer Name <developer.name@intel.com>

@sysopenci
Copy link

sysopenci commented May 20, 2025

Expected syntax:
Commit message one-line summary

  Extra paragraphs can be added here.

  Longer description that explains the problem / solution
  or whatever that needs to be said

  It can contain
    multiple lines
    multiple paragraphs
    blank lines
    references

  But each paragraph must be followed by a blank line

  However, you need to keep the 'Tracked-On', 'Change-Id',
  'Signed-off-by', ..., fields in the **lastest** paragraph of
  the commit message.

  Change-Id: I9e58f79c7faf7f0edb9792e8b5322ab161331141
  Tracked-On: https://jira.server.ext/browse/PROJECTA-123
  Signed-off-by: Developer Name <developer.name@intel.com>

@sysopenci
Copy link

sysopenci commented May 20, 2025

Expected syntax:
Commit message one-line summary

  Extra paragraphs can be added here.

  Longer description that explains the problem / solution
  or whatever that needs to be said

  It can contain
    multiple lines
    multiple paragraphs
    blank lines
    references

  But each paragraph must be followed by a blank line

  However, you need to keep the 'Tracked-On', 'Change-Id',
  'Signed-off-by', ..., fields in the **lastest** paragraph of
  the commit message.

  Change-Id: I9e58f79c7faf7f0edb9792e8b5322ab161331141
  Tracked-On: https://jira.server.ext/browse/PROJECTA-123
  Signed-off-by: Developer Name <developer.name@intel.com>

@sysopenci
Copy link

sysopenci commented May 21, 2025

Expected syntax:
Commit message one-line summary

  Extra paragraphs can be added here.

  Longer description that explains the problem / solution
  or whatever that needs to be said

  It can contain
    multiple lines
    multiple paragraphs
    blank lines
    references

  But each paragraph must be followed by a blank line

  However, you need to keep the 'Tracked-On', 'Change-Id',
  'Signed-off-by', ..., fields in the **lastest** paragraph of
  the commit message.

  Change-Id: I9e58f79c7faf7f0edb9792e8b5322ab161331141
  Tracked-On: https://jira.server.ext/browse/PROJECTA-123
  Signed-off-by: Developer Name <developer.name@intel.com>

jingdlu pushed a commit to jingdlu/linux-intel-lts2023 that referenced this pull request May 29, 2025
@gjiangcanonical @gregkh
drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm…
7083b93 
…_bind returns err

[ Upstream commit 36684e9d88a2e2401ae26715a2e217cb4295cea7 ]

The pointer need to be set to NULL, otherwise KASAN complains about
use-after-free. Because in mtk_drm_bind, all private's drm are set
as follows.

private->all_drm_private[i]->drm = drm;

And drm will be released by drm_dev_put in case mtk_drm_kms_init returns
failure. However, the shutdown path still accesses the previous allocated
memory in drm_atomic_helper_shutdown.

[   84.874820] watchdog: watchdog0: watchdog did not stop!
[   86.512054] ==================================================================
[   86.513162] BUG: KASAN: use-after-free in drm_atomic_helper_shutdown+0x33c/0x378
[   86.514258] Read of size 8 at addr ffff0000d46fc068 by task shutdown/1
[   86.515213]
[   86.515455] CPU: 1 UID: 0 PID: 1 Comm: shutdown Not tainted 6.13.0-rc1-mtk+gfa1a78e5d24b-dirty projectceladon#55
[   86.516752] Hardware name: Unknown Product/Unknown Product, BIOS 2022.10 10/01/2022
[   86.517960] Call trace:
[   86.518333]  show_stack+0x20/0x38 (C)
[   86.518891]  dump_stack_lvl+0x90/0xd0
[   86.519443]  print_report+0xf8/0x5b0
[   86.519985]  kasan_report+0xb4/0x100
[   86.520526]  __asan_report_load8_noabort+0x20/0x30
[   86.521240]  drm_atomic_helper_shutdown+0x33c/0x378
[   86.521966]  mtk_drm_shutdown+0x54/0x80
[   86.522546]  platform_shutdown+0x64/0x90
[   86.523137]  device_shutdown+0x260/0x5b8
[   86.523728]  kernel_restart+0x78/0xf0
[   86.524282]  __do_sys_reboot+0x258/0x2f0
[   86.524871]  __arm64_sys_reboot+0x90/0xd8
[   86.525473]  invoke_syscall+0x74/0x268
[   86.526041]  el0_svc_common.constprop.0+0xb0/0x240
[   86.526751]  do_el0_svc+0x4c/0x70
[   86.527251]  el0_svc+0x4c/0xc0
[   86.527719]  el0t_64_sync_handler+0x144/0x168
[   86.528367]  el0t_64_sync+0x198/0x1a0
[   86.528920]
[   86.529157] The buggy address belongs to the physical page:
[   86.529972] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000d46fd4d0 pfn:0x1146fc
[   86.531319] flags: 0xbfffc0000000000(node=0|zone=2|lastcpupid=0xffff)
[   86.532267] raw: 0bfffc0000000000 0000000000000000 dead000000000122 0000000000000000
[   86.533390] raw: ffff0000d46fd4d0 0000000000000000 00000000ffffffff 0000000000000000
[   86.534511] page dumped because: kasan: bad access detected
[   86.535323]
[   86.535559] Memory state around the buggy address:
[   86.536265]  ffff0000d46fbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   86.537314]  ffff0000d46fbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   86.538363] >ffff0000d46fc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   86.544733]                                                           ^
[   86.551057]  ffff0000d46fc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   86.557510]  ffff0000d46fc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   86.563928] ==================================================================
[   86.571093] Disabling lock debugging due to kernel taint
[   86.577642] Unable to handle kernel paging request at virtual address e0e9c0920000000b
[   86.581834] KASAN: maybe wild-memory-access in range [0x0752049000000058-0x075204900000005f]
...

Fixes: 1ef7ed4 ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support")
Signed-off-by: Guoqing Jiang <guoqing.jiang@canonical.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patchwork.kernel.org/project/dri-devel/patch/20241223023227.1258112-1-guoqing.jiang@canonical.com/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Engineering Build Not Started Invalid commit message Pending Developer Approval Pending PR Review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@weichenli-intel @sysopenci