I am crashing the kernel by doing something I believe I am allowed to do.
Using mmap to write to /dev/fb0 as the compatibility layer for Tiny DRM vot,v220hf01a-t (ili9225).
First it happens that because of the display resolution of 220*176 the buffer is (16 bit) 77440 bytes, which is not a multiple of the page size (4096), unlike most regular resolution displays.
When I touch the mmap'ed virtual address above base+73728 (4096*18) up to 77439:
auto file = open("/dev/fb0", O_RDWR); if (!file) throw; auto fbp = (char *)mmap(0, 220 * 176 * 2, PROT_READ | PROT_WRITE, MAP_SHARED, file, 0); if ((size_t)fbp <= 0) throw; fbp[220 * 176 * 2 - 2] = 0;
I get a crash:
[ 14.150463] Unable to handle kernel paging request at virtual address ffffffc00827c000 [ 14.158640] Mem abort info: [ 14.161626] ESR = 0x96000007 [ 14.164969] EC = 0x25: DABT (current EL), IL = 32 bits [ 14.170470] SET = 0, FnV = 0 [ 14.173735] EA = 0, S1PTW = 0 [ 14.177047] FSC = 0x07: level 3 translation fault [ 14.182095] Data abort info: [ 14.185083] ISV = 0, ISS = 0x00000007 [ 14.189035] CM = 0, WnR = 0 [ 14.192107] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000000d54000 [ 14.198997] [ffffffc00827c000] pgd=1000000001501003, p4d=1000000001501003, pud=1000000001501003, pmd=1000000001d5c003, pte=0000000000000000 [ 14.211992] Internal error: Oops: 96000007 [#1] PREEMPT SMP [ 14.217659] CPU: 0 PID: 50 Comm: kworker/0:2 Not tainted 5.18.3 #18 [ 14.224027] Hardware name: Raspberry Pi Compute Module 3 Plus Rev 1.0 (DT) [ 14.231005] Workqueue: events drm_fb_helper_damage_work [ 14.236333] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 14.243405] pc : __memcpy+0x15c/0x230 [ 14.247131] lr : drm_fb_helper_damage_work+0x25c/0x310 [ 14.252352] sp : ffffffc00822bd30 [ 14.255712] x29: ffffffc00822bd30 x28: 00000000000001b8 x27: ffffff80017e1d10 [ 14.262970] x26: ffffffc008267e80 x25: 00000000000000b0 x24: ffffff8002416800 [ 14.270228] x23: ffffff8001fd8080 x22: ffffff80017e1c00 x21: ffffff80017e1ccc [ 14.277487] x20: ffffffc00827be80 x19: ffffff80017e1cd0 x18: ffffffe5d80bac08 [ 14.284745] x17: 0000000000000013 x16: 000000fe72080e00 x15: 0000000000000000 [ 14.292003] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 14.299259] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 [ 14.306517] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 [ 14.313772] x5 : ffffffc008268038 x4 : ffffffc00827c038 x3 : ffffffc008267fc0 [ 14.321029] x2 : 0000000000000028 x1 : ffffffc00827bfc0 x0 : ffffffc008267e80 [ 14.328288] Call trace: [ 14.330766] __memcpy+0x15c/0x230 [ 14.334135] process_one_work+0x1dc/0x450 [ 14.338214] worker_thread+0x300/0x450 [ 14.342025] kthread+0x100/0x110 [ 14.345305] ret_from_fork+0x10/0x20 [ 14.348947] Code: a9422428 a9032c6a a9432c2a a984346c (a9c4342c) [ 14.355132] ---[ end trace 0000000000000000 ]---
By constraining the input with this small patch it works fine:
--- a/drivers/gpu/drm/drm_fb_helper.c +++ b/drivers/gpu/drm/drm_fb_helper.c @@ -684,11 +684,13 @@ static void drm_fb_helper_damage(struct fb_info *info, u32 x, u32 y, static void drm_fb_helper_memory_range_to_clip(struct fb_info *info, off_t off, size_t len, struct drm_rect *clip) { + struct drm_fb_helper *fb_helper = info->par; + off_t end = off + len; u32 x1 = 0; u32 y1 = off / info->fix.line_length; u32 x2 = info->var.xres; - u32 y2 = DIV_ROUND_UP(end, info->fix.line_length); + u32 y2 = min_t(u32, DIV_ROUND_UP(end, info->fix.line_length), fb_helper->fb->height);
if ((y2 - y1) == 1) { /*
I am sure this patch is not how it should be fixed, but I have no knowledge of the subsystem to fix it "at the right place".
Thanks, Nuno