[PATCH 1/2] drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
From: Thomas Zimmermann <hidden>
Date: 2026-01-20 08:19:05
Also in:
amd-gfx, dri-devel, nouveau, stable
Subsystem:
drm drivers, drm drivers and misc gpu patches, framebuffer console, framebuffer core, framebuffer layer, intel drm display for xe and i915 drivers, intel drm i915 driver (meteor lake, dg2 and older excluding poulsbo, moorestown and derivative), radeon and amdgpu drm drivers, the rest · Maintainers:
David Airlie, Simona Vetter, Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, Helge Deller, Jani Nikula, Rodrigo Vivi, Joonas Lahtinen, Tvrtko Ursulin, Alex Deucher, Christian König, Linus Torvalds
Possibly related (same subject, not in this thread)
- 2026-01-20 · Re: [PATCH 1/2] drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup · Thomas Zimmermann <tzimmermann@suse.de>
- 2026-01-20 · [PATCH 1/2] drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup · Thomas Zimmermann <hidden>
From: Thomas Zimmermann <tzimmermann@suse.de> Protect vga_switcheroo_client_fb_set() with console lock. Avoids OOB access in fbcon_remap_all(). Without holding the console lock the call races with switching outputs. VGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon function uses struct fb_info.node, which is set by register_framebuffer(). As the fb-helper code currently sets up VGA switcheroo before registering the framebuffer, the value of node is -1 and therefore not a legal value. For example, fbcon uses the value within set_con2fb_map() [1] as an index into an array. Moving vga_switcheroo_client_fb_set() after register_framebuffer() can result in VGA switching that does not switch fbcon correctly. Therefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(), which already holds the console lock. Fbdev calls fbcon_fb_registered() from within register_framebuffer(). Serializes the helper with VGA switcheroo's call to fbcon_remap_all(). Although vga_switcheroo_client_fb_set() takes an instance of struct fb_info as parameter, it really only needs the contained fbcon state. Moving the call to fbcon initialization is therefore cleaner than before. Only amdgpu, i915, nouveau and radeon support vga_switcheroo. For all other drivers, this change does nothing. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://elixir.bootlin.com/linux/v6.17/source/drivers/video/fbdev/core/fbcon.c#L2942 # [1] Fixes: 6a9ee8af344e ("vga_switcheroo: initial implementation (v15)") Acked-by: Javier Martinez Canillas <javierm@redhat.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Cc: dri-devel@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Cc: amd-gfx@lists.freedesktop.org Cc: linux-fbdev@vger.kernel.org Cc: <redacted> # v2.6.34+ Link: https://patch.msgid.link/20251105161549.98836-1-tzimmermann@suse.de (cherry picked from commit eb76d0f5553575599561010f24c277cc5b31d003) --- drivers/gpu/drm/drm_fb_helper.c | 6 ------ drivers/gpu/drm/i915/display/intel_fbdev.c | 2 -- drivers/gpu/drm/radeon/radeon_fbdev.c | 3 --- drivers/video/fbdev/core/fbcon.c | 9 +++++++++ 4 files changed, 9 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index b507c1c008a3e..3915a8b17bc4c 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c@@ -32,7 +32,6 @@ #include <linux/console.h> #include <linux/pci.h> #include <linux/sysrq.h> -#include <linux/vga_switcheroo.h> #include <drm/drm_atomic.h> #include <drm/drm_drv.h>
@@ -1668,7 +1667,6 @@ static int drm_fb_helper_find_sizes(struct drm_fb_helper *fb_helper, static int drm_fb_helper_single_fb_probe(struct drm_fb_helper *fb_helper) { struct drm_client_dev *client = &fb_helper->client; - struct drm_device *dev = fb_helper->dev; struct drm_fb_helper_surface_size sizes; int ret;
@@ -1687,10 +1685,6 @@ static int drm_fb_helper_single_fb_probe(struct drm_fb_helper *fb_helper) strcpy(fb_helper->fb->comm, "[fbcon]"); - /* Set the fb info for vgaswitcheroo clients. Does nothing otherwise. */ - if (dev_is_pci(dev->dev)) - vga_switcheroo_client_fb_set(to_pci_dev(dev->dev), fb_helper->info); - return 0; }
diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c
index 31d0d695d5671..8bad7e7909f7b 100644
--- a/drivers/gpu/drm/i915/display/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/display/intel_fbdev.c@@ -36,7 +36,6 @@ #include <linux/string.h> #include <linux/sysrq.h> #include <linux/tty.h> -#include <linux/vga_switcheroo.h> #include <drm/drm_crtc.h> #include <drm/drm_fb_helper.h>
@@ -337,7 +336,6 @@ static int intelfb_create(struct drm_fb_helper *helper, ifbdev->vma_flags = flags; intel_runtime_pm_put(&dev_priv->runtime_pm, wakeref); - vga_switcheroo_client_fb_set(pdev, info); return 0; out_unpin:
diff --git a/drivers/gpu/drm/radeon/radeon_fbdev.c b/drivers/gpu/drm/radeon/radeon_fbdev.c
index fb70de29545c6..730efabe05f6b 100644
--- a/drivers/gpu/drm/radeon/radeon_fbdev.c
+++ b/drivers/gpu/drm/radeon/radeon_fbdev.c@@ -303,7 +303,6 @@ static void radeon_fbdev_client_unregister(struct drm_client_dev *client) struct radeon_device *rdev = dev->dev_private; if (fb_helper->info) { - vga_switcheroo_client_fb_set(rdev->pdev, NULL); drm_helper_force_disable_all(dev); drm_fb_helper_unregister_info(fb_helper); } else {
@@ -342,8 +341,6 @@ static int radeon_fbdev_client_hotplug(struct drm_client_dev *client) if (ret) goto err_drm_fb_helper_fini; - vga_switcheroo_client_fb_set(rdev->pdev, fb_helper->info); - return 0; err_drm_fb_helper_fini:
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 79525ee90e3b2..57b21b6869231 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c@@ -64,6 +64,7 @@ #include <linux/console.h> #include <linux/string.h> #include <linux/kd.h> +#include <linux/pci.h> #include <linux/slab.h> #include <linux/fb.h> #include <linux/fbcon.h>
@@ -75,6 +76,7 @@ #include <linux/interrupt.h> #include <linux/crc32.h> /* For counting font checksums */ #include <linux/uaccess.h> +#include <linux/vga_switcheroo.h> #include <asm/irq.h> #include "fbcon.h"
@@ -2909,6 +2911,9 @@ void fbcon_fb_unregistered(struct fb_info *info) console_lock(); + if (info->device && dev_is_pci(info->device)) + vga_switcheroo_client_fb_set(to_pci_dev(info->device), info); + fbcon_registered_fb[info->node] = NULL; fbcon_num_registered_fb--;
@@ -3042,6 +3047,10 @@ static int do_fb_registered(struct fb_info *info) } } + /* Set the fb info for vga_switcheroo clients. Does nothing otherwise. */ + if (info->device && dev_is_pci(info->device)) + vga_switcheroo_client_fb_set(to_pci_dev(info->device), NULL); + return ret; }
--
2.52.0