lkml.org 
[lkml]   [2018]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 159/160] drm/dp_mst: Check if primary mstb is null
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>

    commit 23d8003907d094f77cf959228e2248d6db819fa7 upstream.

    Unfortunately drm_dp_get_mst_branch_device which is called from both
    drm_dp_mst_handle_down_rep and drm_dp_mst_handle_up_rep seem to rely
    on that mgr->mst_primary is not NULL, which seem to be wrong as it can be
    cleared with simultaneous mode set, if probing fails or in other case.
    mgr->lock mutex doesn't protect against that as it might just get
    assigned to NULL right before, not simultaneously.

    There are currently bugs 107738, 108616 bugs which crash in
    drm_dp_get_mst_branch_device, caused by this issue.

    v2: Refactored the code, as it was nicely noticed.
    Fixed Bugzilla bug numbers(second was 108616, but not 108816)
    and added links.

    [changed title and added stable cc]
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    Signed-off-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
    Cc: stable@vger.kernel.org
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108616
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107738
    Link: https://patchwork.freedesktop.org/patch/msgid/20181109090012.24438-1-stanislav.lisovskiy@intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/gpu/drm/drm_dp_mst_topology.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/drivers/gpu/drm/drm_dp_mst_topology.c
    +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
    @@ -1225,6 +1225,9 @@ static struct drm_dp_mst_branch *drm_dp_
    mutex_lock(&mgr->lock);
    mstb = mgr->mst_primary;

    + if (!mstb)
    + goto out;
    +
    for (i = 0; i < lct - 1; i++) {
    int shift = (i % 2) ? 0 : 4;
    int port_num = (rad[i / 2] >> shift) & 0xf;

    \
     
     \ /
      Last update: 2018-11-19 18:17    [W:2.083 / U:0.172 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site