lkml.org 
[lkml]   [2022]   [Sep]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [Freedreno] [PATCH v2 01/10] drm/msm: fix use-after-free on probe deferral
    From

    On 9/13/2022 1:53 AM, Johan Hovold wrote:
    > The bridge counter was never reset when tearing down the DRM device so
    > that stale pointers to deallocated structures would be accessed on the
    > next tear down (e.g. after a second late bind deferral).
    >
    > Given enough bridges and a few probe deferrals this could currently also
    > lead to data beyond the bridge array being corrupted.
    >
    > Fixes: d28ea556267c ("drm/msm: properly add and remove internal bridges")
    > Fixes: a3376e3ec81c ("drm/msm: convert to drm_bridge")
    > Cc: stable@vger.kernel.org # 3.12
    > Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    > Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
    Tested-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
    Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>

    > ---
    > drivers/gpu/drm/msm/msm_drv.c | 1 +
    > 1 file changed, 1 insertion(+)
    >
    > diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
    > index 391d86b54ded..d254fe2507ec 100644
    > --- a/drivers/gpu/drm/msm/msm_drv.c
    > +++ b/drivers/gpu/drm/msm/msm_drv.c
    > @@ -241,6 +241,7 @@ static int msm_drm_uninit(struct device *dev)
    >
    > for (i = 0; i < priv->num_bridges; i++)
    > drm_bridge_remove(priv->bridges[i]);
    > + priv->num_bridges = 0;
    >
    > pm_runtime_get_sync(dev);
    > msm_irq_uninstall(ddev);

    \
     
     \ /
      Last update: 2022-09-22 21:50    [W:3.811 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site