Public bug reported:
[Impact]
On KV260, kernel 6.8.0-1041-xilinx (6.8.0-1041.42) triggers a NULL
pointer dereference during framebuffer console takeover. The system
reaches the serial login prompt, but login hangs and SSH remains
unavailable. Console/TTY tasks subsequently become blocked in
console_lock and tty_open.
The issue was detected during boot testing. Kernel 6.8.0-1040-xilinx
(6.8.0-1040.41) works correctly on the same board.
Relevant kernel log:
fbcon: Taking over console
Unable to handle kernel read from unreadable memory at virtual address
0000000000000000
Internal error: Oops: 0000000096000004 [#1] SMP
CPU: 0 PID: 520 Comm: kworker/0:0 Not tainted 6.8.0-1041-xilinx #42
Hardware name: ZynqMP KV260 revB (DT)
Workqueue: events fbcon_register_existing_fbs
pc : fbcon_open+0x28/0x190
lr : fbcon_startup+0x74/0x2c0
Call trace:
fbcon_open+0x28/0x190
fbcon_startup+0x74/0x2c0
do_register_con_driver
do_take_over_console
do_fbcon_takeover
do_fb_registered
fbcon_register_existing_fbs
process_one_work
worker_thread
kthread
[Fix]
Adapt xlnx_fbdev_create() to the allocation model introduced by commit
238b6bfbb648, "drm/fb-helper: Allocate and release fb_info in single
place", pulled in from the parent kernel during the 1041 crank.
The DRM helper now allocates fb_info before calling the driver's
framebuffer probe. The Xilinx callback still allocates a second object,
while the helper registers the original object with a NULL fbops
pointer. This causes fbcon_open() to fault when accessing
info->fbops->owner.
The Xilinx callback needs to reuse the fb_info and colour map already
allocated by the helper. The duplicate allocation and corresponding
cleanup must be removed.
[Test Plan]
1. On KV260 running Ubuntu 24.04, boot the unmodified 6.8.0-1041-xilinx kernel
with fbdev emulation enabled.
2. Confirm the fbcon_open() Oops and failure to complete serial or SSH login.
3. Install and boot the candidate kernel containing the fix, without
framebuffer-disabling parameters.
4. Confirm that the following command reports Y:
sudo cat /sys/module/drm_kms_helper/parameters/fbdev_emulation
5. Confirm that serial login and SSH work, and inspect the kernel log for
framebuffer registration failures, Oopses or blocked console tasks.
6. Repeat the boot and login checks on KD240 to check for regressions.
Expected result: normal boot and usable serial and SSH login with fbdev
emulation enabled, without the framebuffer console Oops.
[Where problems could occur]
The change affects framebuffer initialization and error-path cleanup in
the Xilinx fbdev callback. Mistakes in object ownership could cause
framebuffer registration failures, memory leaks, double frees or another
console failure.
The scope is limited though, as it only could affect Xilinx devices.
[Other Info]
Testing completed so far:
- Unmodified 1040 kernel on KV260: works correctly.
- Unmodified 1041 kernel on KV260: reproduces the failure.
- Locally rebuilt 1041 kernel with the Xilinx callback adapted to the new
allocation model: boots and works correctly on KV260 without additional kernel
parameters, with fbdev enabled.
- Unmodified 1041 kernel with drm_kms_helper.fbdev_emulation=0 on KV260: tested
as a workaround, normal serial login and SSH access were restored.
SSH failures were also observed on KR260 during boot testing, but the detailed
crash analysis and fix testing described here were performed on KV260.
** Affects: linux-xilinx (Ubuntu)
Importance: Undecided
Status: New
** Affects: linux-xilinx (Ubuntu Noble)
Importance: High
Assignee: Krystian Kaniewski (kkaniewski)
Status: Confirmed
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => High
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Krystian Kaniewski (kkaniewski)
** Changed in: linux (Ubuntu Noble)
Status: New => Confirmed
** Also affects: linux-xilinx (Ubuntu)
Importance: Undecided
Status: New
** No longer affects: linux (Ubuntu)
** No longer affects: linux (Ubuntu Noble)
** Changed in: linux-xilinx (Ubuntu Noble)
Importance: Undecided => High
** Changed in: linux-xilinx (Ubuntu Noble)
Assignee: (unassigned) => Krystian Kaniewski (kkaniewski)
** Changed in: linux-xilinx (Ubuntu Noble)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171424
Title:
[Noble] KV260: NULL pointer dereference in fbcon_open with
6.8.0-1041-xilinx blocks serial login and SSH
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-xilinx/+bug/2171424/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
