Jani Nikula f212bf9abe drm/i915/bios: filter out invalid DDC pins from VBT child devices ... The VBT contains the DDC pin to use for specific ports. Alas, sometimes the field appears to contain bogus data, and while we check for it later on in intel_gmbus_get_adapter() we fail to check the returned NULL on errors. Oops results. The simplest approach seems to be to catch and ignore the bogus DDC pins already at the VBT parsing phase, reverting to fixed per port default pins. This doesn't guarantee display working, but at least it prevents the oops. And we continue to be fuzzed by VBT. One affected machine is Dell Latitude 5590 where a BIOS upgrade added invalid DDC pins. Typical backtrace: [ 35.461411] WARN_ON(!intel_gmbus_is_valid_pin(dev_priv, pin)) [ 35.461432] WARNING: CPU: 6 PID: 411 at drivers/gpu/drm/i915/intel_i2c.c:844 intel_gmbus_get_adapter+0x32/0x37 [i915] [ 35.461437] Modules linked in: i915 ahci libahci dm_snapshot dm_bufio dm_raid raid456 async_raid6_recov async_pq raid6_pq async_xor xor async_memcpy async_tx [ 35.461445] CPU: 6 PID: 411 Comm: kworker/u16:2 Not tainted 4.16.0-rc7.x64-g1cda370ffded #1 [ 35.461447] Hardware name: Dell Inc. Latitude 5590/0MM81M, BIOS 1.1.9 03/13/2018 [ 35.461450] Workqueue: events_unbound async_run_entry_fn [ 35.461465] RIP: 0010:intel_gmbus_get_adapter+0x32/0x37 [i915] [ 35.461467] RSP: 0018:ffff9b4e43d47c40 EFLAGS: 00010286 [ 35.461469] RAX: 0000000000000000 RBX: ffff98f90639f800 RCX: ffffffffae051960 [ 35.461471] RDX: 0000000000000001 RSI: 0000000000000092 RDI: 0000000000000246 [ 35.461472] RBP: ffff98f905410000 R08: 0000004d062a83f6 R09: 00000000000003bd [ 35.461474] R10: 0000000000000031 R11: ffffffffad4eda58 R12: ffff98f905410000 [ 35.461475] R13: ffff98f9064c1000 R14: ffff9b4e43d47cf0 R15: ffff98f905410000 [ 35.461477] FS: 0000000000000000(0000) GS:ffff98f92e580000(0000) knlGS:0000000000000000 [ 35.461479] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.461481] CR2: 00007f5682359008 CR3: 00000001b700c005 CR4: 00000000003606e0 [ 35.461483] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.461484] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.461486] Call Trace: [ 35.461501] intel_hdmi_set_edid+0x37/0x27f [i915] [ 35.461515] intel_hdmi_detect+0x7c/0x97 [i915] [ 35.461518] drm_helper_probe_single_connector_modes+0xe1/0x6c0 [ 35.461521] drm_setup_crtcs+0x129/0xa6a [ 35.461523] ? __switch_to_asm+0x34/0x70 [ 35.461525] ? __switch_to_asm+0x34/0x70 [ 35.461527] ? __switch_to_asm+0x40/0x70 [ 35.461528] ? __switch_to_asm+0x34/0x70 [ 35.461529] ? __switch_to_asm+0x40/0x70 [ 35.461531] ? __switch_to_asm+0x34/0x70 [ 35.461532] ? __switch_to_asm+0x40/0x70 [ 35.461534] ? __switch_to_asm+0x34/0x70 [ 35.461536] __drm_fb_helper_initial_config_and_unlock+0x34/0x46f [ 35.461538] ? __switch_to_asm+0x40/0x70 [ 35.461541] ? _cond_resched+0x10/0x33 [ 35.461557] intel_fbdev_initial_config+0xf/0x1c [i915] [ 35.461560] async_run_entry_fn+0x2e/0xf5 [ 35.461563] process_one_work+0x15b/0x364 [ 35.461565] worker_thread+0x2c/0x3a0 [ 35.461567] ? process_one_work+0x364/0x364 [ 35.461568] kthread+0x10c/0x122 [ 35.461570] ? _kthread_create_on_node+0x5d/0x5d [ 35.461572] ret_from_fork+0x35/0x40 [ 35.461574] Code: 74 16 89 f6 48 8d 04 b6 48 c1 e0 05 48 29 f0 48 8d 84 c7 e8 11 00 00 c3 48 c7 c6 b0 19 1e c0 48 c7 c7 64 8a 1c c0 e8 47 88 ed ec <0f> 0b 31 c0 c3 8b 87 a4 04 00 00 80 e4 fc 09 c6 89 b7 a4 04 00 [ 35.461604] WARNING: CPU: 6 PID: 411 at drivers/gpu/drm/i915/intel_i2c.c:844 intel_gmbus_get_adapter+0x32/0x37 [i915] [ 35.461606] ---[ end trace 4fe1e63e2dd93373 ]--- [ 35.461609] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 [ 35.461613] IP: i2c_transfer+0x4/0x86 [ 35.461614] PGD 0 P4D 0 [ 35.461616] Oops: 0000 [#1] SMP PTI [ 35.461618] Modules linked in: i915 ahci libahci dm_snapshot dm_bufio dm_raid raid456 async_raid6_recov async_pq raid6_pq async_xor xor async_memcpy async_tx [ 35.461624] CPU: 6 PID: 411 Comm: kworker/u16:2 Tainted: G W 4.16.0-rc7.x64-g1cda370ffded #1 [ 35.461625] Hardware name: Dell Inc. Latitude 5590/0MM81M, BIOS 1.1.9 03/13/2018 [ 35.461628] Workqueue: events_unbound async_run_entry_fn [ 35.461630] RIP: 0010:i2c_transfer+0x4/0x86 [ 35.461631] RSP: 0018:ffff9b4e43d47b30 EFLAGS: 00010246 [ 35.461633] RAX: ffff9b4e43d47b6e RBX: 0000000000000005 RCX: 0000000000000001 [ 35.461635] RDX: 0000000000000002 RSI: ffff9b4e43d47b80 RDI: 0000000000000000 [ 35.461636] RBP: ffff9b4e43d47bd8 R08: 0000004d062a83f6 R09: 00000000000003bd [ 35.461638] R10: 0000000000000031 R11: ffffffffad4eda58 R12: 0000000000000002 [ 35.461639] R13: 0000000000000001 R14: ffff9b4e43d47b6f R15: ffff9b4e43d47c07 [ 35.461641] FS: 0000000000000000(0000) GS:ffff98f92e580000(0000) knlGS:0000000000000000 [ 35.461643] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.461645] CR2: 0000000000000010 CR3: 00000001b700c005 CR4: 00000000003606e0 [ 35.461646] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.461647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.461649] Call Trace: [ 35.461652] drm_do_probe_ddc_edid+0xb3/0x128 [ 35.461654] drm_get_edid+0xe5/0x38d [ 35.461669] intel_hdmi_set_edid+0x45/0x27f [i915] [ 35.461684] intel_hdmi_detect+0x7c/0x97 [i915] [ 35.461687] drm_helper_probe_single_connector_modes+0xe1/0x6c0 [ 35.461689] drm_setup_crtcs+0x129/0xa6a [ 35.461691] ? __switch_to_asm+0x34/0x70 [ 35.461693] ? __switch_to_asm+0x34/0x70 [ 35.461694] ? __switch_to_asm+0x40/0x70 [ 35.461696] ? __switch_to_asm+0x34/0x70 [ 35.461697] ? __switch_to_asm+0x40/0x70 [ 35.461698] ? __switch_to_asm+0x34/0x70 [ 35.461700] ? __switch_to_asm+0x40/0x70 [ 35.461701] ? __switch_to_asm+0x34/0x70 [ 35.461703] __drm_fb_helper_initial_config_and_unlock+0x34/0x46f [ 35.461705] ? __switch_to_asm+0x40/0x70 [ 35.461707] ? _cond_resched+0x10/0x33 [ 35.461724] intel_fbdev_initial_config+0xf/0x1c [i915] [ 35.461727] async_run_entry_fn+0x2e/0xf5 [ 35.461729] process_one_work+0x15b/0x364 [ 35.461731] worker_thread+0x2c/0x3a0 [ 35.461733] ? process_one_work+0x364/0x364 [ 35.461734] kthread+0x10c/0x122 [ 35.461736] ? _kthread_create_on_node+0x5d/0x5d [ 35.461738] ret_from_fork+0x35/0x40 [ 35.461739] Code: 5c fa e1 ad 48 89 df e8 ea fb ff ff e9 2a ff ff ff 0f 1f 44 00 00 31 c0 e9 43 fd ff ff 31 c0 45 31 e4 e9 c5 fd ff ff 41 54 55 53 <48> 8b 47 10 48 83 78 10 00 74 70 41 89 d4 48 89 f5 48 89 fb 65 [ 35.461756] RIP: i2c_transfer+0x4/0x86 RSP: ffff9b4e43d47b30 [ 35.461757] CR2: 0000000000000010 [ 35.461759] ---[ end trace 4fe1e63e2dd93374 ]--- Based on a patch by Fei Li. v2: s/reverting/sticking/ (Chris) Cc: stable@vger.kernel.org Cc: Fei Li <fei.li@intel.com> Co-developed-by: Fei Li <fei.li@intel.com> Reported-by: Pavel Nakonechnyi <zorg1331@gmail.com> Reported-and-tested-by: Seweryn Kokot <sewkokot@gmail.com> Reported-and-tested-by: Laszlo Valko <valko@linux.karinthy.hu> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105549 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105961 Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20180411131519.9091-1-jani.nikula@intel.com		2018-04-12 11:22:07 +03:00
..
amd	Merge tag 'drm-amdkfd-next-2018-03-27' of git://people.freedesktop.org/~gabbayo/linux into drm-next	2018-03-28 14:49:19 +10:00
arc
arm	drm: mali-dp: Add YUV->RGB conversion support for video layers	2018-03-14 11:41:01 +00:00
armada	drm: Don't pass clip to drm_atomic_helper_check_plane_state()	2018-03-05 20:48:25 +02:00
ast	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
atmel-hlcdc
bochs	drm/ttm: add bo as parameter to the ttm_tt_create callback	2018-03-14 14:38:27 -05:00
bridge	drm/bridge: dw-hdmi: Remove unused hdmi_enable_overflow_interrupts()	2018-03-15 09:45:11 +01:00
cirrus	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
etnaviv	drm/etnaviv: bump HW job limit to 4	2018-03-22 11:08:48 +01:00
exynos	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
fsl-dcu
gma500
hisilicon	drm/ttm: add bo as parameter to the ttm_tt_create callback	2018-03-14 14:38:27 -05:00
i2c
i810
i915	drm/i915/bios: filter out invalid DDC pins from VBT child devices	2018-04-12 11:22:07 +03:00
imx	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
lib
mediatek	drm: Don't pass clip to drm_atomic_helper_check_plane_state()	2018-03-05 20:48:25 +02:00
meson	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
mga
mgag200	drm/ttm: add bo as parameter to the ttm_tt_create callback	2018-03-14 14:38:27 -05:00
msm	Merge tag 'drm-msm-next-2018-03-20' of git://people.freedesktop.org/~robclark/linux into drm-next	2018-03-21 14:06:00 +10:00
mxsfb	drm/mxsfb: Do not use deprecated drm_driver.{enable|disable)_vblank	2018-02-22 17:58:59 +01:00
nouveau	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
omapdrm	drm/omap: fix compile error when DPI is disabled	2018-03-14 10:39:50 +02:00
panel	drm/panel: rm68200: Add backlight dependency	2018-03-14 11:51:24 +01:00
pl111	drm/pl111: Use max memory bandwidth for resolution	2018-03-07 23:14:24 +01:00
qxl	Merge airlied/drm-next into drm-misc-next	2018-03-21 09:40:55 -04:00
r128
radeon	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
rcar-du	drm-misc-next for 4.17:	2018-03-14 10:59:16 +10:00
rockchip	drm/rockchip: cdn-dp: remove the DP phy switch	2018-03-16 11:51:11 +01:00
savage
scheduler	treewide/trivial: Remove ';;$' typo noise	2018-02-22 10:59:33 +01:00
selftests
shmobile
sis
sti
stm	drm/stm: check pitch and size calculations even if !CONFIG_MMU	2018-02-23 09:37:12 +01:00
sun4i	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
tdfx
tegra	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
tilcdc	drm/tilcdc: tilcdc_panel: Rename device from "panel" to "tilcdc-panel"	2018-02-28 11:48:25 +02:00
tinydrm	tinydrm: add backlight dependency	2018-02-28 15:08:56 -05:00
ttm	drm/ttm: Export the ttm_k[un]map_atomic_prot API.	2018-03-22 11:10:06 +01:00
tve200	drm/tve200: Do not use deprecated drm_driver.{enable|disable)_vblank	2018-02-22 17:58:59 +01:00
udl	drm: udl: Properly check framebuffer mmap offsets	2018-03-22 07:59:01 +01:00
vc4	drm/vc4_validate: Remove VLA usage	2018-03-16 15:51:52 -07:00
vgem
via
virtio	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
vmwgfx	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
zte	drm: Don't pass clip to drm_atomic_helper_check_plane_state()	2018-03-05 20:48:25 +02:00
ati_pcigart.c
drm_agpsupport.c
drm_atomic.c	drm: Verify gamma/degamma LUT size	2018-03-16 15:44:01 +02:00
drm_atomic_helper.c	drm: Remove now pointelss blob->data casts	2018-03-16 15:44:01 +02:00
drm_auth.c
drm_blend.c
drm_bridge.c
drm_bufs.c	drm: dma_bufs: Fixed checkpatch issues	2018-03-19 09:31:20 -04:00
drm_cache.c
drm_color_mgmt.c	drm/atomic: Include color encoding/range in plane state dump	2018-03-02 14:41:21 +02:00
drm_connector.c
drm_context.c
drm_crtc.c	drm: Check that the plane supports the request format+modifier combo	2018-02-26 16:29:47 +02:00
drm_crtc_helper.c
drm_crtc_helper_internal.h
drm_crtc_internal.h	drm/atomic: Include color encoding/range in plane state dump	2018-03-02 14:41:21 +02:00
drm_debugfs.c
drm_debugfs_crc.c
drm_dma.c
drm_dp_aux_dev.c
drm_dp_dual_mode_helper.c
drm_dp_helper.c
drm_dp_mst_topology.c
drm_drv.c	drm: NULL pointer dereference [null-pointer-deref] (CWE 476) problem	2018-03-06 08:14:16 +01:00
drm_dumb_buffers.c
drm_edid.c	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
drm_edid_load.c
drm_encoder.c
drm_encoder_slave.c
drm_fb_cma_helper.c
drm_fb_helper.c	drm: Remove now pointelss blob->data casts	2018-03-16 15:44:01 +02:00
drm_file.c
drm_flip_work.c
drm_fourcc.c
drm_framebuffer.c	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
drm_gem.c
drm_gem_cma_helper.c
drm_gem_framebuffer_helper.c
drm_global.c
drm_hashtab.c
drm_info.c
drm_internal.h
drm_ioc32.c
drm_ioctl.c
drm_irq.c
drm_kms_helper_common.c
drm_lease.c
drm_legacy.h
drm_lock.c
drm_memory.c	drm: fix drm_get_max_iomem type mismatch	2018-02-22 11:18:58 -05:00
drm_mipi_dsi.c
drm_mm.c	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
drm_mode_config.c
drm_mode_object.c
drm_modes.c	drm: Fix uabi regression by allowing garbage mode->type from userspace	2018-03-23 13:51:12 +02:00
drm_modeset_helper.c
drm_modeset_lock.c	drm/atomic: Call ww_acquire_done after drm_modeset_lock_all	2018-03-05 10:35:32 +01:00
drm_of.c	drm: of: simplify component probe code	2018-03-06 14:05:00 +05:30
drm_panel.c
drm_panel_orientation_quirks.c	drm: Include the header with the prototype for drm_get_panel_orientation_quirk()	2018-02-26 17:39:59 +02:00
drm_pci.c
drm_plane.c	Merge airlied/drm-next into drm-misc-next	2018-03-21 09:40:55 -04:00
drm_plane_helper.c	drm: Don't pass clip to drm_atomic_helper_check_plane_state()	2018-03-05 20:48:25 +02:00
drm_prime.c	drm/prime: make the pages array optional for drm_prime_sg_to_page_addr_arrays	2018-03-06 12:24:52 -05:00
drm_print.c	drm: Reduce object size of DRM_DEV_<LEVEL> uses	2018-03-19 15:15:42 +01:00
drm_probe_helper.c	Linux 4.16-rc7	2018-03-28 14:30:41 +10:00
drm_property.c	Revert "drm: Use a flexible array member for blob property data"	2018-03-16 15:44:01 +02:00
drm_rect.c
drm_scatter.c
drm_scdc_helper.c
drm_simple_kms_helper.c	drm: Don't pass clip to drm_atomic_helper_check_plane_state()	2018-03-05 20:48:25 +02:00
drm_syncobj.c
drm_sysfs.c
drm_trace.h
drm_trace_points.c
drm_vblank.c	Merge tag 'drm-intel-next-2018-03-08' of git://anongit.freedesktop.org/drm/drm-intel into drm-next	2018-03-14 14:53:01 +10:00
drm_vm.c
drm_vma_manager.c
Kconfig
Makefile