[Intel-gfx] [PATCH RESEND] drm/dp/mst: fix kernel oops when turning off secondary monitor

[Daniel Vetter]

On Tue, Feb 14, 2017 at 02:49:21PM +0200, Jani Nikula wrote:
> From: Pierre-Louis Bossart <pierre-louis.bossart at linux.intel.com>
> 
> 100% reproducible issue found on SKL SkullCanyon NUC with two external
> DP daisy-chained monitors in DP/MST mode. When turning off or changing
> the input of the second monitor the machine stops with a kernel
> oops. This issue happened with 4.8.8 as well as drm/drm-intel-nightly.
> 
> This issue is traced to an inconsistent control flow in
> drm_dp_update_payload_part1(): the 'port' pointer is set to NULL at the
> same time as 'req_payload.num_slots' is set to zero, but the pointer is
> dereferenced even when req_payload.num_slot is zero.
> 
> The problematic dereference was introduced in commit dfda0df34
> ("drm/mst: rework payload table allocation to conform better") and may
> impact all versions since v3.18
> 
> The fix suggested by Chris Wilson removes the kernel oops and was found to
> work well after 10mn of monkey-testing with the second monitor power and
> input buttons
> 
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98990
> Fixes: dfda0df34264 ("drm/mst: rework payload table allocation to conform better.")
> Cc: Dave Airlie <airlied at redhat.com>
> Cc: Chris Wilson <chris at chris-wilson.co.uk>
> Cc: Nathan D Ciobanu <nathan.d.ciobanu at linux.intel.com>
> Cc: Dhinakaran Pandiyan <dhinakaran.pandiyan at intel.com>
> Cc: Sean Paul <seanpaul at chromium.org>
> Cc: <stable at vger.kernel.org> # v3.18+
> Tested-by: Nathan D Ciobanu <nathan.d.ciobanu at linux.intel.com>
> Reviewed-by: Dhinakaran Pandiyan <dhinakaran.pandiyan at intel.com>
> Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart at linux.intel.com>
> Signed-off-by: Jani Nikula <jani.nikula at intel.com>

You haz drm-misc commit rights, pls use them :-)

Since it doesn't have deps, probably simplest to smash into drm-misc-fixes
and then send a pull req to Dave right away. If you want, you can roll
-fixes forward to -rc8 while at it.
-Daniel

> ---
>  drivers/gpu/drm/drm_dp_mst_topology.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
> index 122a1b04bebc..f2cc375907d0 100644
> --- a/drivers/gpu/drm/drm_dp_mst_topology.c
> +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
> @@ -1817,7 +1817,7 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr)
>  				mgr->payloads[i].vcpi = req_payload.vcpi;
>  			} else if (mgr->payloads[i].num_slots) {
>  				mgr->payloads[i].num_slots = 0;
> -				drm_dp_destroy_payload_step1(mgr, port, port->vcpi.vcpi, &mgr->payloads[i]);
> +				drm_dp_destroy_payload_step1(mgr, port, mgr->payloads[i].vcpi, &mgr->payloads[i]);
>  				req_payload.payload_state = mgr->payloads[i].payload_state;
>  				mgr->payloads[i].start_slot = 0;
>  			}
> -- 
> 2.1.4
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch