[PATCH] drm: Fix boot panic when register_chrdev fails

[Logan Gunthorpe]

This is a bug found by the 0day kernel test robot. When drm is
compiled into the kernel, and register_chrdev fails (due, in this, case
to overfilling the chardev dynamic major numbers), a kernel panic
occurs on boot:

  BUG: unable to handle kernel NULL pointer dereference at
      00000000000000a8
  IP: down_write+0x2a/0x53
  Call Trace:
   start_creating+0x67/0x12e
   debugfs_create_dir+0x12/0x189
   drm_debugfs_init+0x7c/0x1b7
   ? ___might_sleep+0x172/0x192
   ? __might_sleep+0x6b/0xef
   drm_minor_register+0x6b/0x141
   drm_dev_register+0xcd/0x315
   ? pci_enable_device_flags+0x117/0x177
   drm_get_pci_dev+0x106/0x27a
   cirrus_pci_probe+0xfb/0x125
   pci_device_probe+0x11d/0x185
   ...

This is because when register_chrdev fails, it removes drm_debugfs_root.
However, seeing drm is not a module, nothing prevents other code from
calling drm_minor_register after drm_core_init failed and thus using an
invalid drm_debugfs_root.

This commit fixes this issue by setting drm_debugfs_root to NULL after
removal and checking that it's not NULL before using it.

Signed-off-by: Logan Gunthorpe <logang@xxxxxxxxxxxx>
Cc: Daniel Vetter <daniel.vetter@xxxxxxxxx>
Cc: Jani Nikula <jani.nikula@xxxxxxxxxxxxxxx>
Cc: Sean Paul <seanpaul@xxxxxxxxxxxx>
Cc: David Airlie <airlied@xxxxxxxx>
Link: https://lkml.org/lkml/2017/6/4/107
---
 drivers/gpu/drm/drm_drv.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 37b8ad3e30d8..904420304b75 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -214,6 +214,9 @@ static int drm_minor_register(struct drm_device *dev, unsigned int type)
 
 	DRM_DEBUG("\n");
 
+	if (!drm_debugfs_root)
+		return -ENODEV;
+
 	minor = *drm_minor_get_slot(dev, type);
 	if (!minor)
 		return 0;
@@ -935,6 +938,7 @@ static void drm_core_exit(void)
 {
 	unregister_chrdev(DRM_MAJOR, "drm");
 	debugfs_remove(drm_debugfs_root);
+	drm_debugfs_root = NULL;
 	drm_sysfs_destroy();
 	idr_destroy(&drm_minors_idr);
 	drm_connector_ida_destroy();
-- 
2.11.0