From patchwork Mon Sep 17 11:00:54 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Tomi Valkeinen X-Patchwork-Id: 146851 Delivered-To: patch@linaro.org Received: by 2002:a2e:1648:0:0:0:0:0 with SMTP id 8-v6csp3622411ljw; Mon, 17 Sep 2018 04:01:06 -0700 (PDT) X-Google-Smtp-Source: ANB0VdZwYkBp1U+UEXSXKh1SccIiIWm3ZJIJqrVsrz79SMPDJ41ioQomoBJWWn3LVUvn5lT7jyuV X-Received: by 2002:a63:ce43:: with SMTP id r3-v6mr23445762pgi.439.1537182066178; Mon, 17 Sep 2018 04:01:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1537182066; cv=none; d=google.com; s=arc-20160816; b=y01rWW1yR4gbiN42i3NgJaoUxhGkU3B/Dt8ULDqsdVgAYmQUodGRxEaOCWOZfsEMcR gPYKAJ+LP49BDuhb93WPUZw3MiReKr5i8aPqduOsLR7iKaoCsa/4NZzGN1YJJoY7B9Cs 4uEwrtkNRcaXnrfJqK1XQulXICixBXY3D7nnYcWuKLoXrbf0cd2zgAd+h5LTxQt1YuN9 NAeLyOjwoFun2QG4etA26TZ73GZTM4dWm6PwDfvV+50BTdynZnZKkW+Wap63osRT6UOG 9+3HOg1MwYrn4nUfgbFfzH719xgGZMrzI9DLr3vILyBWm9E/jmRidf4/QXpNE5JyUjf4 0g3Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=vo9j192iwo9y8FIyvlIIGkAca1BTQqCUH+BL51JicAE=; b=JHD+vfobbrf6/GISRb+PjqCO+Maz751waZfPbXwXWWEPBhKWW5gxeljycacGgjC4td 5e76biSlw/pyEBECDUfrh79nrtc1zUk3qlNL9vlJi4T7YYYOd30zaNh2zDIw2lIF2CB2 2ZyWm0h6lE2gbV1irn9/fKszCZ1TWjzib/dUwUsJGpokmNzkAzqNueZurOyqWUj1rcU7 BDfNRLjUl0Hd0yWrbhUPMR0N1Au/qI9HXHmIkfAR8+X9ETzjrbx7nrS1vvBAyE5i+uiz xZUczoPVx05RRtKoffyx4FbNEBYmE2cye5Pf7KgXqncoQ/dTBEpCz38PgS08wLkwft/Z lgWA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ti.com header.s=ti-com-17Q1 header.b=gk9VHKbV; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=ti.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d1-v6si15349180pgj.353.2018.09.17.04.01.05; Mon, 17 Sep 2018 04:01:06 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@ti.com header.s=ti-com-17Q1 header.b=gk9VHKbV; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=ti.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726676AbeIQQ1y (ORCPT + 13 others); Mon, 17 Sep 2018 12:27:54 -0400 Received: from lelv0142.ext.ti.com ([198.47.23.249]:34632 "EHLO lelv0142.ext.ti.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725757AbeIQQ1y (ORCPT ); Mon, 17 Sep 2018 12:27:54 -0400 Received: from dlelxv90.itg.ti.com ([172.17.2.17]) by lelv0142.ext.ti.com (8.15.2/8.15.2) with ESMTP id w8HB10ER120680; Mon, 17 Sep 2018 06:01:00 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; s=ti-com-17Q1; t=1537182060; bh=vo9j192iwo9y8FIyvlIIGkAca1BTQqCUH+BL51JicAE=; h=From:To:CC:Subject:Date; b=gk9VHKbVR1teMxf0vCLrINcxuyR8R9/zkCbwgMJ40umRXsNPt/hca0z3SQYwM8MP+ uzKXuYiuSbS5CdOyVspbeGIi68cxF9/zPXy68BE2sP33fphsqQnjTX9MrozpaR+QFs si4Yx5+5k0LCmjqfPktN+k9g0zbLXgcpoeZjd49s= Received: from DLEE101.ent.ti.com (dlee101.ent.ti.com [157.170.170.31]) by dlelxv90.itg.ti.com (8.14.3/8.13.8) with ESMTP id w8HB10KM020031; Mon, 17 Sep 2018 06:01:00 -0500 Received: from DLEE114.ent.ti.com (157.170.170.25) by DLEE101.ent.ti.com (157.170.170.31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Mon, 17 Sep 2018 06:01:00 -0500 Received: from dlep33.itg.ti.com (157.170.170.75) by DLEE114.ent.ti.com (157.170.170.25) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_RSA_WITH_AES_256_CBC_SHA) id 15.1.1466.3 via Frontend Transport; Mon, 17 Sep 2018 06:01:00 -0500 Received: from deskari.ti.com (ileax41-snat.itg.ti.com [10.172.224.153]) by dlep33.itg.ti.com (8.14.3/8.13.8) with ESMTP id w8HB0wMv007231; Mon, 17 Sep 2018 06:00:58 -0500 From: Tomi Valkeinen To: , Daniel Vetter , Dave Airlie CC: Tomi Valkeinen , Subject: [PATCH] drm: fix use of freed memory in drm_mode_setcrtc Date: Mon, 17 Sep 2018 14:00:54 +0300 Message-ID: <20180917110054.4053-1-tomi.valkeinen@ti.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-EXCLAIMER-MD-CONFIG: e1e8a2fd-e40a-4ac6-ac9b-f7e9cc9ee180 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org drm_mode_setcrtc() retries modesetting in case one of the functions it calls returns -EDEADLK. connector_set, mode and fb are freed before retrying, but they are not set to NULL. This can cause drm_mode_setcrtc() to use those variables. For example: On the first try __drm_mode_set_config_internal() returns -EDEADLK. connector_set, mode and fb are freed. Next retry starts, and drm_modeset_lock_all_ctx() returns -EDEADLK, and we jump to 'out'. The code will happily try to release all three again. This leads to crashes of different kinds, depending on the sequence the EDEADLKs happen. Fix this by setting the three variables to NULL at the start of the retry loop. Signed-off-by: Tomi Valkeinen Cc: stable@vger.kernel.org --- drivers/gpu/drm/drm_crtc.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) -- Texas Instruments Finland Oy, Porkkalankatu 22, 00180 Helsinki. Y-tunnus/Business ID: 0615521-4. Kotipaikka/Domicile: Helsinki Reviewed-by: Ville Syrjälä Reviewed-by: Daniel Vetter diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index 2f6c877299e4..2ad14593fb23 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -570,9 +570,9 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, struct drm_mode_crtc *crtc_req = data; struct drm_crtc *crtc; struct drm_plane *plane; - struct drm_connector **connector_set = NULL, *connector; - struct drm_framebuffer *fb = NULL; - struct drm_display_mode *mode = NULL; + struct drm_connector **connector_set, *connector; + struct drm_framebuffer *fb; + struct drm_display_mode *mode; struct drm_mode_set set; uint32_t __user *set_connectors_ptr; struct drm_modeset_acquire_ctx ctx; @@ -601,6 +601,10 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, mutex_lock(&crtc->dev->mode_config.mutex); drm_modeset_acquire_init(&ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE); retry: + connector_set = NULL; + fb = NULL; + mode = NULL; + ret = drm_modeset_lock_all_ctx(crtc->dev, &ctx); if (ret) goto out;