| Message ID | 20220505214051.155-1-quic_jesszhan@quicinc.com |
|---|---|
| State | Accepted |
| Commit | d59be579fa932c46b908f37509f319cbd4ca9a68 |
| Headers | show |
| Series | [v3,1/2] drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected | expand |
On Thu, May 5, 2022 at 2:41 PM Jessica Zhang <quic_jesszhan@quicinc.com> wrote: > > There is a possibility for mdp5_get_global_state to return > -EDEADLK when acquiring the modeset lock, but currently global_state in > mdp5_mixer_release doesn't check for if an error is returned. > > To avoid a NULL dereference error, let's have mdp5_mixer_release > check if an error is returned and propagate that error. > > Reported-by: Tomeu Vizoso <tomeu.vizoso@collabora.com> > Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com> Fixes: 7907a0d77cb4 ("drm/msm/mdp5: Use the new private_obj state") Reviewed-by: Rob Clark <robdclark@gmail.com> > --- > drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 10 ++++++++-- > drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +++++++++++---- > drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 ++-- > 3 files changed, 21 insertions(+), 8 deletions(-) > > diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c > index b966cd69f99d..fe2922c8d21b 100644 > --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c > +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c > @@ -612,9 +612,15 @@ static int mdp5_crtc_setup_pipeline(struct drm_crtc *crtc, > if (ret) > return ret; > > - mdp5_mixer_release(new_crtc_state->state, old_mixer); > + ret = mdp5_mixer_release(new_crtc_state->state, old_mixer); > + if (ret) > + return ret; > + > if (old_r_mixer) { > - mdp5_mixer_release(new_crtc_state->state, old_r_mixer); > + ret = mdp5_mixer_release(new_crtc_state->state, old_r_mixer); > + if (ret) > + return ret; > + > if (!need_right_mixer) > pipeline->r_mixer = NULL; > } > diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c > index 954db683ae44..2536def2a000 100644 > --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c > +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c > @@ -116,21 +116,28 @@ int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc, > return 0; > } > > -void mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer) > +int mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer) > { > struct mdp5_global_state *global_state = mdp5_get_global_state(s); > - struct mdp5_hw_mixer_state *new_state = &global_state->hwmixer; > + struct mdp5_hw_mixer_state *new_state; > > if (!mixer) > - return; > + return 0; > + > + if (IS_ERR(global_state)) > + return PTR_ERR(global_state); > + > + new_state = &global_state->hwmixer; > > if (WARN_ON(!new_state->hwmixer_to_crtc[mixer->idx])) > - return; > + return -EINVAL; > > DBG("%s: release from crtc %s", mixer->name, > new_state->hwmixer_to_crtc[mixer->idx]->name); > > new_state->hwmixer_to_crtc[mixer->idx] = NULL; > + > + return 0; > } > > void mdp5_mixer_destroy(struct mdp5_hw_mixer *mixer) > diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h > index 43c9ba43ce18..545ee223b9d7 100644 > --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h > +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h > @@ -30,7 +30,7 @@ void mdp5_mixer_destroy(struct mdp5_hw_mixer *lm); > int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc, > uint32_t caps, struct mdp5_hw_mixer **mixer, > struct mdp5_hw_mixer **r_mixer); > -void mdp5_mixer_release(struct drm_atomic_state *s, > - struct mdp5_hw_mixer *mixer); > +int mdp5_mixer_release(struct drm_atomic_state *s, > + struct mdp5_hw_mixer *mixer); > > #endif /* __MDP5_LM_H__ */ > -- > 2.35.1 >
On 06/05/2022 00:40, Jessica Zhang wrote: > mdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring > the modeset lock, but currently mdp5_pipe_release doesn't check for if > an error is returned. Because of this, there is a possibility of > mdp5_pipe_release hitting a NULL dereference error. > > To avoid this, let's have mdp5_pipe_release check if > mdp5_get_global_state returns an error and propogate that error. > > Changes since v1: > - Separated declaration and initialization of *new_state to avoid > compiler warning > - Fixed some spelling mistakes in commit message > > Changes since v2: > - Return 0 in case where hwpipe is NULL as this is considered normal > behavior > - Added 2nd patch in series to fix a similar NULL dereference issue in > mdp5_mixer_release > > Reported-by: Tomeu Vizoso <tomeu.vizoso@collabora.com> > Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> > --- > drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +++++++++++---- > drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- > drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- > 3 files changed, 28 insertions(+), 9 deletions(-) > > diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c > index ba6695963aa6..a4f5cb90f3e8 100644 > --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c > +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c > @@ -119,18 +119,23 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, > return 0; > } > > -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) > +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) > { > struct msm_drm_private *priv = s->dev->dev_private; > struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); > struct mdp5_global_state *state = mdp5_get_global_state(s); > - struct mdp5_hw_pipe_state *new_state = &state->hwpipe; > + struct mdp5_hw_pipe_state *new_state; > > if (!hwpipe) > - return; > + return 0; > + > + if (IS_ERR(state)) > + return PTR_ERR(state); > + > + new_state = &state->hwpipe; > > if (WARN_ON(!new_state->hwpipe_to_plane[hwpipe->idx])) > - return; > + return -EINVAL; > > DBG("%s: release from plane %s", hwpipe->name, > new_state->hwpipe_to_plane[hwpipe->idx]->name); > @@ -141,6 +146,8 @@ void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) > } > > new_state->hwpipe_to_plane[hwpipe->idx] = NULL; > + > + return 0; > } > > void mdp5_pipe_destroy(struct mdp5_hw_pipe *hwpipe) > diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h > index 9b26d0761bd4..cca67938cab2 100644 > --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h > +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h > @@ -37,7 +37,7 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, > uint32_t caps, uint32_t blkcfg, > struct mdp5_hw_pipe **hwpipe, > struct mdp5_hw_pipe **r_hwpipe); > -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); > +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); > > struct mdp5_hw_pipe *mdp5_pipe_init(enum mdp5_pipe pipe, > uint32_t reg_offset, uint32_t caps); > diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c > index 228b22830970..979458482841 100644 > --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c > +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c > @@ -311,12 +311,24 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state, > mdp5_state->r_hwpipe = NULL; > > > - mdp5_pipe_release(state->state, old_hwpipe); > - mdp5_pipe_release(state->state, old_right_hwpipe); > + ret = mdp5_pipe_release(state->state, old_hwpipe); > + if (ret) > + return ret; > + > + ret = mdp5_pipe_release(state->state, old_right_hwpipe); > + if (ret) > + return ret; > + > } > } else { > - mdp5_pipe_release(state->state, mdp5_state->hwpipe); > - mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); > + ret = mdp5_pipe_release(state->state, mdp5_state->hwpipe); > + if (ret) > + return ret; > + > + ret = mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); > + if (ret) > + return ret; > + > mdp5_state->hwpipe = mdp5_state->r_hwpipe = NULL; > } >
On 06/05/2022 01:01, Rob Clark wrote: > On Thu, May 5, 2022 at 2:41 PM Jessica Zhang <quic_jesszhan@quicinc.com> wrote: >> >> mdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring >> the modeset lock, but currently mdp5_pipe_release doesn't check for if >> an error is returned. Because of this, there is a possibility of >> mdp5_pipe_release hitting a NULL dereference error. >> >> To avoid this, let's have mdp5_pipe_release check if >> mdp5_get_global_state returns an error and propogate that error. >> >> Changes since v1: >> - Separated declaration and initialization of *new_state to avoid >> compiler warning >> - Fixed some spelling mistakes in commit message >> >> Changes since v2: >> - Return 0 in case where hwpipe is NULL as this is considered normal >> behavior >> - Added 2nd patch in series to fix a similar NULL dereference issue in >> mdp5_mixer_release >> >> Reported-by: Tomeu Vizoso <tomeu.vizoso@collabora.com> >> Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com> > > Fixes: 7907a0d77cb4 ("drm/msm/mdp5: Use the new private_obj state") > Reviewed-by: Rob Clark <robdclark@gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> > >> --- >> drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +++++++++++---- >> drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- >> drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- >> 3 files changed, 28 insertions(+), 9 deletions(-) >> >> diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c >> index ba6695963aa6..a4f5cb90f3e8 100644 >> --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c >> +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c >> @@ -119,18 +119,23 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, >> return 0; >> } >> >> -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) >> +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) >> { >> struct msm_drm_private *priv = s->dev->dev_private; >> struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); >> struct mdp5_global_state *state = mdp5_get_global_state(s); >> - struct mdp5_hw_pipe_state *new_state = &state->hwpipe; >> + struct mdp5_hw_pipe_state *new_state; >> >> if (!hwpipe) >> - return; >> + return 0; >> + >> + if (IS_ERR(state)) >> + return PTR_ERR(state); >> + >> + new_state = &state->hwpipe; >> >> if (WARN_ON(!new_state->hwpipe_to_plane[hwpipe->idx])) >> - return; >> + return -EINVAL; >> >> DBG("%s: release from plane %s", hwpipe->name, >> new_state->hwpipe_to_plane[hwpipe->idx]->name); >> @@ -141,6 +146,8 @@ void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) >> } >> >> new_state->hwpipe_to_plane[hwpipe->idx] = NULL; >> + >> + return 0; >> } >> >> void mdp5_pipe_destroy(struct mdp5_hw_pipe *hwpipe) >> diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h >> index 9b26d0761bd4..cca67938cab2 100644 >> --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h >> +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h >> @@ -37,7 +37,7 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, >> uint32_t caps, uint32_t blkcfg, >> struct mdp5_hw_pipe **hwpipe, >> struct mdp5_hw_pipe **r_hwpipe); >> -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); >> +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); >> >> struct mdp5_hw_pipe *mdp5_pipe_init(enum mdp5_pipe pipe, >> uint32_t reg_offset, uint32_t caps); >> diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c >> index 228b22830970..979458482841 100644 >> --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c >> +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c >> @@ -311,12 +311,24 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state, >> mdp5_state->r_hwpipe = NULL; >> >> >> - mdp5_pipe_release(state->state, old_hwpipe); >> - mdp5_pipe_release(state->state, old_right_hwpipe); >> + ret = mdp5_pipe_release(state->state, old_hwpipe); >> + if (ret) >> + return ret; >> + >> + ret = mdp5_pipe_release(state->state, old_right_hwpipe); >> + if (ret) >> + return ret; >> + >> } >> } else { >> - mdp5_pipe_release(state->state, mdp5_state->hwpipe); >> - mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); >> + ret = mdp5_pipe_release(state->state, mdp5_state->hwpipe); >> + if (ret) >> + return ret; >> + >> + ret = mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); >> + if (ret) >> + return ret; >> + >> mdp5_state->hwpipe = mdp5_state->r_hwpipe = NULL; >> } >> >> -- >> 2.35.1 >>
On 06/05/2022 00:40, Jessica Zhang wrote: > There is a possibility for mdp5_get_global_state to return > -EDEADLK when acquiring the modeset lock, but currently global_state in > mdp5_mixer_release doesn't check for if an error is returned. > > To avoid a NULL dereference error, let's have mdp5_mixer_release > check if an error is returned and propagate that error. > > Reported-by: Tomeu Vizoso <tomeu.vizoso@collabora.com> > Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> > --- > drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 10 ++++++++-- > drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +++++++++++---- > drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 ++-- > 3 files changed, 21 insertions(+), 8 deletions(-) > > diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c > index b966cd69f99d..fe2922c8d21b 100644 > --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c > +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c > @@ -612,9 +612,15 @@ static int mdp5_crtc_setup_pipeline(struct drm_crtc *crtc, > if (ret) > return ret; > > - mdp5_mixer_release(new_crtc_state->state, old_mixer); > + ret = mdp5_mixer_release(new_crtc_state->state, old_mixer); > + if (ret) > + return ret; > + > if (old_r_mixer) { > - mdp5_mixer_release(new_crtc_state->state, old_r_mixer); > + ret = mdp5_mixer_release(new_crtc_state->state, old_r_mixer); > + if (ret) > + return ret; > + > if (!need_right_mixer) > pipeline->r_mixer = NULL; > } > diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c > index 954db683ae44..2536def2a000 100644 > --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c > +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c > @@ -116,21 +116,28 @@ int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc, > return 0; > } > > -void mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer) > +int mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer) > { > struct mdp5_global_state *global_state = mdp5_get_global_state(s); > - struct mdp5_hw_mixer_state *new_state = &global_state->hwmixer; > + struct mdp5_hw_mixer_state *new_state; > > if (!mixer) > - return; > + return 0; > + > + if (IS_ERR(global_state)) > + return PTR_ERR(global_state); > + > + new_state = &global_state->hwmixer; > > if (WARN_ON(!new_state->hwmixer_to_crtc[mixer->idx])) > - return; > + return -EINVAL; > > DBG("%s: release from crtc %s", mixer->name, > new_state->hwmixer_to_crtc[mixer->idx]->name); > > new_state->hwmixer_to_crtc[mixer->idx] = NULL; > + > + return 0; > } > > void mdp5_mixer_destroy(struct mdp5_hw_mixer *mixer) > diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h > index 43c9ba43ce18..545ee223b9d7 100644 > --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h > +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h > @@ -30,7 +30,7 @@ void mdp5_mixer_destroy(struct mdp5_hw_mixer *lm); > int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc, > uint32_t caps, struct mdp5_hw_mixer **mixer, > struct mdp5_hw_mixer **r_mixer); > -void mdp5_mixer_release(struct drm_atomic_state *s, > - struct mdp5_hw_mixer *mixer); > +int mdp5_mixer_release(struct drm_atomic_state *s, > + struct mdp5_hw_mixer *mixer); > > #endif /* __MDP5_LM_H__ */
diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c index ba6695963aa6..a4f5cb90f3e8 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c @@ -119,18 +119,23 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, return 0; } -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) { struct msm_drm_private *priv = s->dev->dev_private; struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); struct mdp5_global_state *state = mdp5_get_global_state(s); - struct mdp5_hw_pipe_state *new_state = &state->hwpipe; + struct mdp5_hw_pipe_state *new_state; if (!hwpipe) - return; + return 0; + + if (IS_ERR(state)) + return PTR_ERR(state); + + new_state = &state->hwpipe; if (WARN_ON(!new_state->hwpipe_to_plane[hwpipe->idx])) - return; + return -EINVAL; DBG("%s: release from plane %s", hwpipe->name, new_state->hwpipe_to_plane[hwpipe->idx]->name); @@ -141,6 +146,8 @@ void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) } new_state->hwpipe_to_plane[hwpipe->idx] = NULL; + + return 0; } void mdp5_pipe_destroy(struct mdp5_hw_pipe *hwpipe) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h index 9b26d0761bd4..cca67938cab2 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h @@ -37,7 +37,7 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, uint32_t caps, uint32_t blkcfg, struct mdp5_hw_pipe **hwpipe, struct mdp5_hw_pipe **r_hwpipe); -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); struct mdp5_hw_pipe *mdp5_pipe_init(enum mdp5_pipe pipe, uint32_t reg_offset, uint32_t caps); diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c index 228b22830970..979458482841 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c @@ -311,12 +311,24 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state, mdp5_state->r_hwpipe = NULL; - mdp5_pipe_release(state->state, old_hwpipe); - mdp5_pipe_release(state->state, old_right_hwpipe); + ret = mdp5_pipe_release(state->state, old_hwpipe); + if (ret) + return ret; + + ret = mdp5_pipe_release(state->state, old_right_hwpipe); + if (ret) + return ret; + } } else { - mdp5_pipe_release(state->state, mdp5_state->hwpipe); - mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); + ret = mdp5_pipe_release(state->state, mdp5_state->hwpipe); + if (ret) + return ret; + + ret = mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); + if (ret) + return ret; + mdp5_state->hwpipe = mdp5_state->r_hwpipe = NULL; }
mdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring the modeset lock, but currently mdp5_pipe_release doesn't check for if an error is returned. Because of this, there is a possibility of mdp5_pipe_release hitting a NULL dereference error. To avoid this, let's have mdp5_pipe_release check if mdp5_get_global_state returns an error and propogate that error. Changes since v1: - Separated declaration and initialization of *new_state to avoid compiler warning - Fixed some spelling mistakes in commit message Changes since v2: - Return 0 in case where hwpipe is NULL as this is considered normal behavior - Added 2nd patch in series to fix a similar NULL dereference issue in mdp5_mixer_release Reported-by: Tomeu Vizoso <tomeu.vizoso@collabora.com> Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com> --- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 28 insertions(+), 9 deletions(-)