🇰🇷 한글 설명
Linux 커널의 Renesas RZ/G2L SoC MIPI DSI 드라이버에서 재부팅 시 패널 unprepare 콜백 실행 중에 이미 중지된 MIPI-DSI 인터페이스로 명령을 전송하려고 하여 커널 패닉이 발생합니다. rzg2l_mipi_dsi_stop() 호출 시점이 잘못되어 발생하는 문제로, 전원 차단 시퀀스를 수정하여 해결되었습니다.
💡 쉬운 설명
Linux가 종료될 때 이미 끝난 디스플레이 통신 채널로 명령을 보내려고 해서 시스템이 강제 종료됩니다. 통신 채널을 끄는 순서를 올바르게 수정하면 문제가 해결됩니다.
🇺🇸 원문 (English)
In the Linux kernel, the following vulnerability has been resolved:
drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels
Since commit 56de5e305d4b ("clk: renesas: r9a07g044: Add MSTOP for RZ/G2L")
we may get the following kernel panic, for some panels, when rebooting:
systemd-shutdown[1]: Rebooting.
Call trace:
...
do_serror+0x28/0x68
el1h_64_error_handler+0x34/0x50
el1h_64_error+0x6c/0x70
rzg2l_mipi_dsi_host_transfer+0x114/0x458 (P)
mipi_dsi_device_transfer+0x44/0x58
mipi_dsi_dcs_set_display_off_multi+0x9c/0xc4
ili9881c_unprepare+0x38/0x88
drm_panel_unprepare+0xbc/0x108
This happens for panels that need to send MIPI-DSI commands in their
unprepare() callback. Since the MIPI-DSI interface is stopped at that
point, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic.
Fix by moving rzg2l_mipi_dsi_stop() to new callback function
rzg2l_mipi_dsi_atomic_post_disable().
With this change we now have the correct power-down/stop sequence:
systemd-shutdown[1]: Rebooting.
rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_disable(): entry
ili9881c-dsi 10850000.dsi.0: ili9881c_unprepare(): entry
rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_post_disable(): entry
reboot: Restarting system
📍 영향받는 시스템
Linux kernel with Renesas RZ/G2L SoC and MIPI-DSI display panels (e.g., ili9881c) after commit 56de5e305d4b
⚔️ 공격 벡터
Local denial of service via kernel panic during system reboot or shutdown (requires local system access)
🛡️ 대응 방법
Apply kernel patch that moves rzg2l_mipi_dsi_stop() call to new rzg2l_mipi_dsi_atomic_post_disable() callback
🔧 검증 코드
If CONFIG_DRM_RZG2L is found, check kernel version and release notes to confirm if the patch is included; no output means system is not affected
grep -q CONFIG_DRM_RZG2L /boot/config-$(uname -r) 2>/dev/null && echo 'Potentially vulnerable' || echo 'Not affected (not RZ/G2L)'