Home Explore Help
Sign In
GfA
/
linux_kernel
5
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Browse Source

drm/dp/mst: Validate port in drm_dp_payload_send_msg()

With the joys of things running concurrently, there's always a chance
that the port we get passed in drm_dp_payload_send_msg() isn't actually
valid anymore. Because of this, we need to make sure we validate the
reference to the port before we use it otherwise we risk running into
various race conditions. For instance, on the Dell MST monitor I have
here for testing, hotplugging it enough times causes us to kernel panic:

[drm:intel_mst_enable_dp] 1
[drm:drm_dp_update_payload_part2] payload 0 1
[drm:intel_get_hpd_pins] hotplug event received, stat 0x00200000, dig 0x10101011, pins 0x00000020
[drm:intel_hpd_irq_handler] digital hpd port B - short
[drm:intel_dp_hpd_pulse] got hpd irq on port B - short
[drm:intel_dp_check_mst_status] got esi 00 10 00
[drm:drm_dp_update_payload_part2] payload 1 1
general protection fault: 0000 [#1] SMP
…
Call Trace:
 [<ffffffffa012b632>] drm_dp_update_payload_part2+0xc2/0x130 [drm_kms_helper]
 [<ffffffffa032ef08>] intel_mst_enable_dp+0xf8/0x180 [i915]
 [<ffffffffa0310dbd>] haswell_crtc_enable+0x3ed/0x8c0 [i915]
 [<ffffffffa030c84d>] intel_atomic_commit+0x5ad/0x1590 [i915]
 [<ffffffffa01db877>] ? drm_atomic_set_crtc_for_connector+0x57/0xe0 [drm]
 [<ffffffffa01dc4e7>] drm_atomic_commit+0x37/0x60 [drm]
 [<ffffffffa0130a3a>] drm_atomic_helper_set_config+0x7a/0xb0 [drm_kms_helper]
 [<ffffffffa01cc482>] drm_mode_set_config_internal+0x62/0x100 [drm]
 [<ffffffffa01d02ad>] drm_mode_setcrtc+0x3cd/0x4e0 [drm]
 [<ffffffffa01c18e3>] drm_ioctl+0x143/0x510 [drm]
 [<ffffffffa01cfee0>] ? drm_mode_setplane+0x1b0/0x1b0 [drm]
 [<ffffffff810f79a7>] ? hrtimer_start_range_ns+0x1b7/0x3a0
 [<ffffffff81212962>] do_vfs_ioctl+0x92/0x570
 [<ffffffff81590852>] ? __sys_recvmsg+0x42/0x80
 [<ffffffff81212eb9>] SyS_ioctl+0x79/0x90
 [<ffffffff816b4e32>] entry_SYSCALL_64_fastpath+0x1a/0xa4
RIP  [<ffffffffa012b026>] drm_dp_payload_send_msg+0x146/0x1f0 [drm_kms_helper]

Which occurs because of the hotplug event shown in the log, which ends
up causing DRM's dp helpers to drop the port we're updating the payload
on and panic.

CC: stable@vger.kernel.org
Signed-off-by: Lyude <cpaul@redhat.com>
Reviewed-by: David Airlie <airlied@linux.ie>
Signed-off-by: Dave Airlie <airlied@redhat.com>
cpaul@redhat.com 9 years ago
parent
3addc4e3a7
commit
deba0a2af9
1 changed files with 8 additions and 1 deletions
Unified View Show Diff Stats
  1. 8 1
      drivers/gpu/drm/drm_dp_mst_topology.c

+ 8 - 1
drivers/gpu/drm/drm_dp_mst_topology.c
View File 

@@ -1672,13 +1672,19 @@ static int drm_dp_payload_send_msg(struct drm_dp_mst_topology_mgr *mgr,
 
 	u8 sinks[DRM_DP_MAX_SDP_STREAMS];
 
 	u8 sinks[DRM_DP_MAX_SDP_STREAMS];
 
 	int i;
 
 	int i;
 
 
 
+	port = drm_dp_get_validated_port_ref(mgr, port);
 
+	if (!port)
 
+		return -EINVAL;
 
+
 
 	port_num = port->port_num;
 
 	port_num = port->port_num;
 
 	mstb = drm_dp_get_validated_mstb_ref(mgr, port->parent);
 
 	mstb = drm_dp_get_validated_mstb_ref(mgr, port->parent);
 
 	if (!mstb) {
 
 	if (!mstb) {
 
 		mstb = drm_dp_get_last_connected_port_and_mstb(mgr, port->parent, &port_num);
 
 		mstb = drm_dp_get_last_connected_port_and_mstb(mgr, port->parent, &port_num);
 
 
 
-		if (!mstb)
 
+		if (!mstb) {
 
+			drm_dp_put_port(port);
 
 			return -EINVAL;
 
 			return -EINVAL;
 
+		}
 
 	}
 
 	}
 
 
 
 	txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL);
 
 	txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL);
 
@@ -1707,6 +1713,7 @@ static int drm_dp_payload_send_msg(struct drm_dp_mst_topology_mgr *mgr,
 
 	kfree(txmsg);
 
 	kfree(txmsg);
 
 fail_put:
 
 fail_put:
 
 	drm_dp_put_mst_branch_device(mstb);
 
 	drm_dp_put_mst_branch_device(mstb);
 
+	drm_dp_put_port(port);
 
 	return ret;
 
 	return ret;
 
 }
 
 }