Re: [PATCH] fbdev: fbcon: Fix unregister crash when more than one framebuffer
On Mon, 10 Dec 2018, Noralf Trønnes wrote:
> When unregistering fbdev using unregister_framebuffer(), any bound
> console will unbind automatically. This is working fine if this is the
> only framebuffer, resulting in a switch to the dummy console. However if
> there is a fb0 and I unregister fb1 having a bound console, I eventually
> get a crash. The fastest way for me to trigger the crash is to do a
> reboot, resulting in this splat:
>
> [ 76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442
> __queue_work+0x2d4/0x41c
> [ 76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight
> bcm2835_rng rng_core [last unloaded: tinydrm]
> [ 76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4
> [ 76.478933] Hardware name: BCM2835
> [ 76.478949] Backtrace:
> [ 76.478995] [] (dump_backtrace) from []
> (show_stack+0x20/0x24)
> [ 76.479022] r6: r5:c0bc73be r4: r3:6fb5bf81
> [ 76.479060] [] (show_stack) from []
> (dump_stack+0x20/0x28)
> [ 76.479102] [] (dump_stack) from [] (__warn+0xec/0x12c)
> [ 76.479134] [] (__warn) from []
> (warn_slowpath_null+0x4c/0x58)
> [ 76.479165] r9:c0eb6944 r8:0001 r7:c0e927f8 r6:c0bc73be r5:05a2
> r4:c0139e84
> [ 76.479197] [] (warn_slowpath_null) from []
> (__queue_work+0x2d4/0x41c)
> [ 76.479222] r6:d7666a00 r5:c0e918ee r4:dbc4e700
> [ 76.479251] [] (__queue_work) from []
> (queue_work_on+0x60/0x88)
> [ 76.479281] r10:c0496bf8 r9:0100 r8:c0e92ae0 r7:0001 r6:d9403700
> r5:d7666a00
> [ 76.479298] r4:2113
> [ 76.479348] [] (queue_work_on) from []
> (cursor_timer_handler+0x30/0x54)
> [ 76.479374] r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc
> [ 76.479413] [] (cursor_timer_handler) from []
> (call_timer_fn+0x100/0x230)
> [ 76.479435] r4:c0e9192f r3:d758a340
> [ 76.479465] [] (call_timer_fn) from []
> (expire_timers+0x10c/0x12c)
> [ 76.479495] r10:4000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280
> r5:c0496bf8
> [ 76.479513] r4:d8a8fabc
> [ 76.479541] [] (expire_timers) from []
> (run_timer_softirq+0xa8/0x184)
> [ 76.479570] r9:0001 r8:c0e19280 r7: r6:c0e08088 r5:c0e1a3e0
> r4:c0e19280
> [ 76.479603] [] (run_timer_softirq) from []
> (__do_softirq+0x1ac/0x3fc)
> [ 76.479632] r10:c0e91680 r9:d8afc020 r8:000a r7:0100 r6:0001
> r5:0002
> [ 76.479650] r4:c0eb65ec
> [ 76.479686] [] (__do_softirq) from []
> (irq_exit+0xe8/0x168)
> [ 76.479716] r10:d8d1a9b0 r9:d8afc000 r8:0001 r7:d949c000 r6:
> r5:c0e8b3f0
> [ 76.479734] r4:
> [ 76.479764] [] (irq_exit) from []
> (__handle_domain_irq+0x94/0xb0)
> [ 76.479793] [] (__handle_domain_irq) from []
> (bcm2835_handle_irq+0x3c/0x48)
> [ 76.479823] r8:d8afdebc r7:d8afddfc r6: r5:c0e089f8 r4:d8afddc8
> r3:d8afddc8
> [ 76.479851] [] (bcm2835_handle_irq) from []
> (__irq_svc+0x70/0x98)
>
> The problem is in the console rebinding in fbcon_fb_unbind(). It uses the
> virtual console index as the new framebuffer index to bind the console(s)
> to. The correct way is to use the con2fb_map lookup table to find the
> framebuffer index.
>
> Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from
> unregister_framebuffer")
> Signed-off-by: Noralf Trønnes
> Reviewed-by: Mikulas Patocka
> ---
>
> Mikulas,
> If you have forgotten about this, here's where you gave your r-b:
> https://lists.freedesktop.org/archives/dri-devel/2018-July/182728.html
>
> drivers/video/fbdev/core/fbcon.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/video/fbdev/core/fbcon.c
> b/drivers/video/fbdev/core/fbcon.c
> index 8958ccc8b1ac..8976190b6c1f 100644
> --- a/drivers/video/fbdev/core/fbcon.c
> +++ b/drivers/video/fbdev/core/fbcon.c
> @@ -3064,7 +3064,7 @@ static int fbcon_fb_unbind(int idx)
> for (i = first_fb_vc; i <= last_fb_vc; i++) {
> if (con2fb_map[i] != idx &&
> con2fb_map[i] != -1) {
> - new_idx = i;
> + new_idx = con2fb_map[i];
> break;
> }
> }
> --
> 2.19.2
Acked-by: Mikulas Patocka
Mikulas___
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
Re: [PATCH] fbdev: fbcon: Fix unregister crash when more than one framebuffer
On 12/12/2018 03:20 PM, Noralf Trønnes wrote:
>
> Den 12.12.2018 12.05, skrev Daniel Vetter:
>> On Mon, Dec 10, 2018 at 08:02:55PM +0100, Noralf Trønnes wrote:
>>> When unregistering fbdev using unregister_framebuffer(), any bound
>>> console will unbind automatically. This is working fine if this is the
>>> only framebuffer, resulting in a switch to the dummy console. However if
>>> there is a fb0 and I unregister fb1 having a bound console, I eventually
>>> get a crash. The fastest way for me to trigger the crash is to do a
>>> reboot, resulting in this splat:
>>>
>>> [ 76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442
>>> __queue_work+0x2d4/0x41c
>>> [ 76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight
>>> backlight bcm2835_rng rng_core [last unloaded: tinydrm]
>>> [ 76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+
>>> #4
>>> [ 76.478933] Hardware name: BCM2835
>>> [ 76.478949] Backtrace:
>>> [ 76.478995] [] (dump_backtrace) from []
>>> (show_stack+0x20/0x24)
>>> [ 76.479022] r6: r5:c0bc73be r4: r3:6fb5bf81
>>> [ 76.479060] [] (show_stack) from []
>>> (dump_stack+0x20/0x28)
>>> [ 76.479102] [] (dump_stack) from []
>>> (__warn+0xec/0x12c)
>>> [ 76.479134] [] (__warn) from []
>>> (warn_slowpath_null+0x4c/0x58)
>>> [ 76.479165] r9:c0eb6944 r8:0001 r7:c0e927f8 r6:c0bc73be r5:05a2
>>> r4:c0139e84
>>> [ 76.479197] [] (warn_slowpath_null) from []
>>> (__queue_work+0x2d4/0x41c)
>>> [ 76.479222] r6:d7666a00 r5:c0e918ee r4:dbc4e700
>>> [ 76.479251] [] (__queue_work) from []
>>> (queue_work_on+0x60/0x88)
>>> [ 76.479281] r10:c0496bf8 r9:0100 r8:c0e92ae0 r7:0001
>>> r6:d9403700 r5:d7666a00
>>> [ 76.479298] r4:2113
>>> [ 76.479348] [] (queue_work_on) from []
>>> (cursor_timer_handler+0x30/0x54)
>>> [ 76.479374] r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc
>>> [ 76.479413] [] (cursor_timer_handler) from []
>>> (call_timer_fn+0x100/0x230)
>>> [ 76.479435] r4:c0e9192f r3:d758a340
>>> [ 76.479465] [] (call_timer_fn) from []
>>> (expire_timers+0x10c/0x12c)
>>> [ 76.479495] r10:4000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc
>>> r6:c0e19280 r5:c0496bf8
>>> [ 76.479513] r4:d8a8fabc
>>> [ 76.479541] [] (expire_timers) from []
>>> (run_timer_softirq+0xa8/0x184)
>>> [ 76.479570] r9:0001 r8:c0e19280 r7: r6:c0e08088 r5:c0e1a3e0
>>> r4:c0e19280
>>> [ 76.479603] [] (run_timer_softirq) from []
>>> (__do_softirq+0x1ac/0x3fc)
>>> [ 76.479632] r10:c0e91680 r9:d8afc020 r8:000a r7:0100
>>> r6:0001 r5:0002
>>> [ 76.479650] r4:c0eb65ec
>>> [ 76.479686] [] (__do_softirq) from []
>>> (irq_exit+0xe8/0x168)
>>> [ 76.479716] r10:d8d1a9b0 r9:d8afc000 r8:0001 r7:d949c000
>>> r6: r5:c0e8b3f0
>>> [ 76.479734] r4:
>>> [ 76.479764] [] (irq_exit) from []
>>> (__handle_domain_irq+0x94/0xb0)
>>> [ 76.479793] [] (__handle_domain_irq) from []
>>> (bcm2835_handle_irq+0x3c/0x48)
>>> [ 76.479823] r8:d8afdebc r7:d8afddfc r6: r5:c0e089f8 r4:d8afddc8
>>> r3:d8afddc8
>>> [ 76.479851] [] (bcm2835_handle_irq) from []
>>> (__irq_svc+0x70/0x98)
>>>
>>> The problem is in the console rebinding in fbcon_fb_unbind(). It uses the
>>> virtual console index as the new framebuffer index to bind the console(s)
>>> to. The correct way is to use the con2fb_map lookup table to find the
>>> framebuffer index.
>>>
>>> Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from
>>> unregister_framebuffer")
>>> Signed-off-by: Noralf Trønnes
>>> Reviewed-by: Mikulas Patocka
>>> ---
>>>
>>> Mikulas,
>>> If you have forgotten about this, here's where you gave your r-b:
>>> https://lists.freedesktop.org/archives/dri-devel/2018-July/182728.html
>> Iirc Bart is out still, and this seems like a good fix that fell through
>> cracks, so a could idea to push this through drm-misc-fixes I think. Or at
>> least drm-misc-next-fixes so it hits the next merge window.
>>
>> Acked-by: Daniel Vetter
>>
>> if you do that.
>
>
> I looked closer at the offending commit and it's 11 years old... so I
> guess it's not urgent. Probably not that many who has fbcon on a
> secondary display and then unloads the driver.
>
> I got a reply from Bart that he'll be back the 20th. I'll leave the
> urgency decision to him.
Patch queued for 4.21, thanks.
Best regards,
--
Bartlomiej Zolnierkiewicz
Samsung R Institute Poland
Samsung Electronics
___
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
Re: [PATCH] fbdev: fbcon: Fix unregister crash when more than one framebuffer
Den 12.12.2018 12.05, skrev Daniel Vetter:
On Mon, Dec 10, 2018 at 08:02:55PM +0100, Noralf Trønnes wrote:
When unregistering fbdev using unregister_framebuffer(), any bound
console will unbind automatically. This is working fine if this is the
only framebuffer, resulting in a switch to the dummy console. However if
there is a fb0 and I unregister fb1 having a bound console, I eventually
get a crash. The fastest way for me to trigger the crash is to do a
reboot, resulting in this splat:
[ 76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442
__queue_work+0x2d4/0x41c
[ 76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight
bcm2835_rng rng_core [last unloaded: tinydrm]
[ 76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4
[ 76.478933] Hardware name: BCM2835
[ 76.478949] Backtrace:
[ 76.478995] [] (dump_backtrace) from []
(show_stack+0x20/0x24)
[ 76.479022] r6: r5:c0bc73be r4: r3:6fb5bf81
[ 76.479060] [] (show_stack) from []
(dump_stack+0x20/0x28)
[ 76.479102] [] (dump_stack) from [] (__warn+0xec/0x12c)
[ 76.479134] [] (__warn) from []
(warn_slowpath_null+0x4c/0x58)
[ 76.479165] r9:c0eb6944 r8:0001 r7:c0e927f8 r6:c0bc73be r5:05a2
r4:c0139e84
[ 76.479197] [] (warn_slowpath_null) from []
(__queue_work+0x2d4/0x41c)
[ 76.479222] r6:d7666a00 r5:c0e918ee r4:dbc4e700
[ 76.479251] [] (__queue_work) from []
(queue_work_on+0x60/0x88)
[ 76.479281] r10:c0496bf8 r9:0100 r8:c0e92ae0 r7:0001 r6:d9403700
r5:d7666a00
[ 76.479298] r4:2113
[ 76.479348] [] (queue_work_on) from []
(cursor_timer_handler+0x30/0x54)
[ 76.479374] r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc
[ 76.479413] [] (cursor_timer_handler) from []
(call_timer_fn+0x100/0x230)
[ 76.479435] r4:c0e9192f r3:d758a340
[ 76.479465] [] (call_timer_fn) from []
(expire_timers+0x10c/0x12c)
[ 76.479495] r10:4000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280
r5:c0496bf8
[ 76.479513] r4:d8a8fabc
[ 76.479541] [] (expire_timers) from []
(run_timer_softirq+0xa8/0x184)
[ 76.479570] r9:0001 r8:c0e19280 r7: r6:c0e08088 r5:c0e1a3e0
r4:c0e19280
[ 76.479603] [] (run_timer_softirq) from []
(__do_softirq+0x1ac/0x3fc)
[ 76.479632] r10:c0e91680 r9:d8afc020 r8:000a r7:0100 r6:0001
r5:0002
[ 76.479650] r4:c0eb65ec
[ 76.479686] [] (__do_softirq) from []
(irq_exit+0xe8/0x168)
[ 76.479716] r10:d8d1a9b0 r9:d8afc000 r8:0001 r7:d949c000 r6:
r5:c0e8b3f0
[ 76.479734] r4:
[ 76.479764] [] (irq_exit) from []
(__handle_domain_irq+0x94/0xb0)
[ 76.479793] [] (__handle_domain_irq) from []
(bcm2835_handle_irq+0x3c/0x48)
[ 76.479823] r8:d8afdebc r7:d8afddfc r6: r5:c0e089f8 r4:d8afddc8
r3:d8afddc8
[ 76.479851] [] (bcm2835_handle_irq) from []
(__irq_svc+0x70/0x98)
The problem is in the console rebinding in fbcon_fb_unbind(). It uses the
virtual console index as the new framebuffer index to bind the console(s)
to. The correct way is to use the con2fb_map lookup table to find the
framebuffer index.
Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from
unregister_framebuffer")
Signed-off-by: Noralf Trønnes
Reviewed-by: Mikulas Patocka
---
Mikulas,
If you have forgotten about this, here's where you gave your r-b:
https://lists.freedesktop.org/archives/dri-devel/2018-July/182728.html
Iirc Bart is out still, and this seems like a good fix that fell through
cracks, so a could idea to push this through drm-misc-fixes I think. Or at
least drm-misc-next-fixes so it hits the next merge window.
Acked-by: Daniel Vetter
if you do that.
I looked closer at the offending commit and it's 11 years old... so I
guess it's not urgent. Probably not that many who has fbcon on a
secondary display and then unloads the driver.
I got a reply from Bart that he'll be back the 20th. I'll leave the
urgency decision to him.
Noralf.
-Daniel
drivers/video/fbdev/core/fbcon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 8958ccc8b1ac..8976190b6c1f 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -3064,7 +3064,7 @@ static int fbcon_fb_unbind(int idx)
for (i = first_fb_vc; i <= last_fb_vc; i++) {
if (con2fb_map[i] != idx &&
con2fb_map[i] != -1) {
- new_idx = i;
+ new_idx = con2fb_map[i];
break;
}
}
--
2.19.2
___
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
___
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
Re: [PATCH] fbdev: fbcon: Fix unregister crash when more than one framebuffer
On Mon, Dec 10, 2018 at 08:02:55PM +0100, Noralf Trønnes wrote:
> When unregistering fbdev using unregister_framebuffer(), any bound
> console will unbind automatically. This is working fine if this is the
> only framebuffer, resulting in a switch to the dummy console. However if
> there is a fb0 and I unregister fb1 having a bound console, I eventually
> get a crash. The fastest way for me to trigger the crash is to do a
> reboot, resulting in this splat:
>
> [ 76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442
> __queue_work+0x2d4/0x41c
> [ 76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight
> bcm2835_rng rng_core [last unloaded: tinydrm]
> [ 76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4
> [ 76.478933] Hardware name: BCM2835
> [ 76.478949] Backtrace:
> [ 76.478995] [] (dump_backtrace) from []
> (show_stack+0x20/0x24)
> [ 76.479022] r6: r5:c0bc73be r4: r3:6fb5bf81
> [ 76.479060] [] (show_stack) from []
> (dump_stack+0x20/0x28)
> [ 76.479102] [] (dump_stack) from [] (__warn+0xec/0x12c)
> [ 76.479134] [] (__warn) from []
> (warn_slowpath_null+0x4c/0x58)
> [ 76.479165] r9:c0eb6944 r8:0001 r7:c0e927f8 r6:c0bc73be r5:05a2
> r4:c0139e84
> [ 76.479197] [] (warn_slowpath_null) from []
> (__queue_work+0x2d4/0x41c)
> [ 76.479222] r6:d7666a00 r5:c0e918ee r4:dbc4e700
> [ 76.479251] [] (__queue_work) from []
> (queue_work_on+0x60/0x88)
> [ 76.479281] r10:c0496bf8 r9:0100 r8:c0e92ae0 r7:0001 r6:d9403700
> r5:d7666a00
> [ 76.479298] r4:2113
> [ 76.479348] [] (queue_work_on) from []
> (cursor_timer_handler+0x30/0x54)
> [ 76.479374] r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc
> [ 76.479413] [] (cursor_timer_handler) from []
> (call_timer_fn+0x100/0x230)
> [ 76.479435] r4:c0e9192f r3:d758a340
> [ 76.479465] [] (call_timer_fn) from []
> (expire_timers+0x10c/0x12c)
> [ 76.479495] r10:4000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280
> r5:c0496bf8
> [ 76.479513] r4:d8a8fabc
> [ 76.479541] [] (expire_timers) from []
> (run_timer_softirq+0xa8/0x184)
> [ 76.479570] r9:0001 r8:c0e19280 r7: r6:c0e08088 r5:c0e1a3e0
> r4:c0e19280
> [ 76.479603] [] (run_timer_softirq) from []
> (__do_softirq+0x1ac/0x3fc)
> [ 76.479632] r10:c0e91680 r9:d8afc020 r8:000a r7:0100 r6:0001
> r5:0002
> [ 76.479650] r4:c0eb65ec
> [ 76.479686] [] (__do_softirq) from []
> (irq_exit+0xe8/0x168)
> [ 76.479716] r10:d8d1a9b0 r9:d8afc000 r8:0001 r7:d949c000 r6:
> r5:c0e8b3f0
> [ 76.479734] r4:
> [ 76.479764] [] (irq_exit) from []
> (__handle_domain_irq+0x94/0xb0)
> [ 76.479793] [] (__handle_domain_irq) from []
> (bcm2835_handle_irq+0x3c/0x48)
> [ 76.479823] r8:d8afdebc r7:d8afddfc r6: r5:c0e089f8 r4:d8afddc8
> r3:d8afddc8
> [ 76.479851] [] (bcm2835_handle_irq) from []
> (__irq_svc+0x70/0x98)
>
> The problem is in the console rebinding in fbcon_fb_unbind(). It uses the
> virtual console index as the new framebuffer index to bind the console(s)
> to. The correct way is to use the con2fb_map lookup table to find the
> framebuffer index.
>
> Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from
> unregister_framebuffer")
> Signed-off-by: Noralf Trønnes
> Reviewed-by: Mikulas Patocka
> ---
>
> Mikulas,
> If you have forgotten about this, here's where you gave your r-b:
> https://lists.freedesktop.org/archives/dri-devel/2018-July/182728.html
Iirc Bart is out still, and this seems like a good fix that fell through
cracks, so a could idea to push this through drm-misc-fixes I think. Or at
least drm-misc-next-fixes so it hits the next merge window.
Acked-by: Daniel Vetter
if you do that.
-Daniel
>
> drivers/video/fbdev/core/fbcon.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/video/fbdev/core/fbcon.c
> b/drivers/video/fbdev/core/fbcon.c
> index 8958ccc8b1ac..8976190b6c1f 100644
> --- a/drivers/video/fbdev/core/fbcon.c
> +++ b/drivers/video/fbdev/core/fbcon.c
> @@ -3064,7 +3064,7 @@ static int fbcon_fb_unbind(int idx)
> for (i = first_fb_vc; i <= last_fb_vc; i++) {
> if (con2fb_map[i] != idx &&
> con2fb_map[i] != -1) {
> - new_idx = i;
> + new_idx = con2fb_map[i];
> break;
> }
> }
> --
> 2.19.2
>
> ___
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
___
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
[PATCH] fbdev: fbcon: Fix unregister crash when more than one framebuffer
When unregistering fbdev using unregister_framebuffer(), any bound
console will unbind automatically. This is working fine if this is the
only framebuffer, resulting in a switch to the dummy console. However if
there is a fb0 and I unregister fb1 having a bound console, I eventually
get a crash. The fastest way for me to trigger the crash is to do a
reboot, resulting in this splat:
[ 76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442
__queue_work+0x2d4/0x41c
[ 76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight
bcm2835_rng rng_core [last unloaded: tinydrm]
[ 76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4
[ 76.478933] Hardware name: BCM2835
[ 76.478949] Backtrace:
[ 76.478995] [] (dump_backtrace) from []
(show_stack+0x20/0x24)
[ 76.479022] r6: r5:c0bc73be r4: r3:6fb5bf81
[ 76.479060] [] (show_stack) from []
(dump_stack+0x20/0x28)
[ 76.479102] [] (dump_stack) from [] (__warn+0xec/0x12c)
[ 76.479134] [] (__warn) from []
(warn_slowpath_null+0x4c/0x58)
[ 76.479165] r9:c0eb6944 r8:0001 r7:c0e927f8 r6:c0bc73be r5:05a2
r4:c0139e84
[ 76.479197] [] (warn_slowpath_null) from []
(__queue_work+0x2d4/0x41c)
[ 76.479222] r6:d7666a00 r5:c0e918ee r4:dbc4e700
[ 76.479251] [] (__queue_work) from []
(queue_work_on+0x60/0x88)
[ 76.479281] r10:c0496bf8 r9:0100 r8:c0e92ae0 r7:0001 r6:d9403700
r5:d7666a00
[ 76.479298] r4:2113
[ 76.479348] [] (queue_work_on) from []
(cursor_timer_handler+0x30/0x54)
[ 76.479374] r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc
[ 76.479413] [] (cursor_timer_handler) from []
(call_timer_fn+0x100/0x230)
[ 76.479435] r4:c0e9192f r3:d758a340
[ 76.479465] [] (call_timer_fn) from []
(expire_timers+0x10c/0x12c)
[ 76.479495] r10:4000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280
r5:c0496bf8
[ 76.479513] r4:d8a8fabc
[ 76.479541] [] (expire_timers) from []
(run_timer_softirq+0xa8/0x184)
[ 76.479570] r9:0001 r8:c0e19280 r7: r6:c0e08088 r5:c0e1a3e0
r4:c0e19280
[ 76.479603] [] (run_timer_softirq) from []
(__do_softirq+0x1ac/0x3fc)
[ 76.479632] r10:c0e91680 r9:d8afc020 r8:000a r7:0100 r6:0001
r5:0002
[ 76.479650] r4:c0eb65ec
[ 76.479686] [] (__do_softirq) from []
(irq_exit+0xe8/0x168)
[ 76.479716] r10:d8d1a9b0 r9:d8afc000 r8:0001 r7:d949c000 r6:
r5:c0e8b3f0
[ 76.479734] r4:
[ 76.479764] [] (irq_exit) from []
(__handle_domain_irq+0x94/0xb0)
[ 76.479793] [] (__handle_domain_irq) from []
(bcm2835_handle_irq+0x3c/0x48)
[ 76.479823] r8:d8afdebc r7:d8afddfc r6: r5:c0e089f8 r4:d8afddc8
r3:d8afddc8
[ 76.479851] [] (bcm2835_handle_irq) from []
(__irq_svc+0x70/0x98)
The problem is in the console rebinding in fbcon_fb_unbind(). It uses the
virtual console index as the new framebuffer index to bind the console(s)
to. The correct way is to use the con2fb_map lookup table to find the
framebuffer index.
Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from
unregister_framebuffer")
Signed-off-by: Noralf Trønnes
Reviewed-by: Mikulas Patocka
---
Mikulas,
If you have forgotten about this, here's where you gave your r-b:
https://lists.freedesktop.org/archives/dri-devel/2018-July/182728.html
drivers/video/fbdev/core/fbcon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 8958ccc8b1ac..8976190b6c1f 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -3064,7 +3064,7 @@ static int fbcon_fb_unbind(int idx)
for (i = first_fb_vc; i <= last_fb_vc; i++) {
if (con2fb_map[i] != idx &&
con2fb_map[i] != -1) {
- new_idx = i;
+ new_idx = con2fb_map[i];
break;
}
}
--
2.19.2
___
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
