Since the encoders have been devm-allocated, they will be freed way
before drm_mode_config_cleanup() is called. To avoid use-after-free
conditions, we then must ensure that drm_encoder_cleanup() is called
before the encoders are freed.
v2: Use the new __drmm_simple_encoder_alloc() function
v3: Use the new drmm_plain_simple_encoder_alloc() macro
Fixes: c369cb27c267 ("drm/ingenic: Support multiple panels/bridges")
Cc: <stable(a)vger.kernel.org> # 5.8+
Signed-off-by: Paul Cercueil <paul(a)crapouillou.net>
---
Notes:
Use the V1 of this patch to fix v5.11 and older kernels. This V3 only
applies on the current drm-misc-next branch.
drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
index 7bb31fbee29d..b23011c1c5d9 100644
--- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
+++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
@@ -1014,20 +1014,17 @@ static int ingenic_drm_bind(struct device *dev, bool has_components)
bridge = devm_drm_panel_bridge_add_typed(dev, panel,
DRM_MODE_CONNECTOR_DPI);
- encoder = devm_kzalloc(dev, sizeof(*encoder), GFP_KERNEL);
- if (!encoder)
- return -ENOMEM;
+ encoder = drmm_plain_simple_encoder_alloc(drm, DRM_MODE_ENCODER_DPI);
+ if (IS_ERR(encoder)) {
+ ret = PTR_ERR(encoder);
+ dev_err(dev, "Failed to init encoder: %d\n", ret);
+ return ret;
+ }
encoder->possible_crtcs = 1;
drm_encoder_helper_add(encoder, &ingenic_drm_encoder_helper_funcs);
- ret = drm_simple_encoder_init(drm, encoder, DRM_MODE_ENCODER_DPI);
- if (ret) {
- dev_err(dev, "Failed to init encoder: %d\n", ret);
- return ret;
- }
-
ret = drm_bridge_attach(encoder, bridge, NULL, 0);
if (ret) {
dev_err(dev, "Unable to attach bridge\n");
--
2.29.2
If we don't call drm_connector_cleanup() manually in
panel_bridge_detach(), the connector will be cleaned up with the other
DRM objects in the call to drm_mode_config_cleanup(). However, since our
drm_connector is devm-allocated, by the time drm_mode_config_cleanup()
will be called, our connector will be long gone. Therefore, the
connector must be cleaned up when the bridge is detached to avoid
use-after-free conditions.
v2: Cleanup connector only if it was created
v3: Add FIXME
Fixes: 13dfc0540a57 ("drm/bridge: Refactor out the panel wrapper from the lvds-encoder bridge.")
Cc: <stable(a)vger.kernel.org> # 4.12+
Cc: Andrzej Hajda <a.hajda(a)samsung.com>
Cc: Neil Armstrong <narmstrong(a)baylibre.com>
Cc: Laurent Pinchart <Laurent.pinchart(a)ideasonboard.com>
Cc: Jonas Karlman <jonas(a)kwiboo.se>
Cc: Jernej Skrabec <jernej.skrabec(a)siol.net>
Signed-off-by: Paul Cercueil <paul(a)crapouillou.net>
---
drivers/gpu/drm/bridge/panel.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c
index 0ddc37551194..5959e8183cd0 100644
--- a/drivers/gpu/drm/bridge/panel.c
+++ b/drivers/gpu/drm/bridge/panel.c
@@ -87,6 +87,18 @@ static int panel_bridge_attach(struct drm_bridge *bridge,
static void panel_bridge_detach(struct drm_bridge *bridge)
{
+ struct panel_bridge *panel_bridge = drm_bridge_to_panel_bridge(bridge);
+ struct drm_connector *connector = &panel_bridge->connector;
+
+ /*
+ * Cleanup the connector if we know it was initialized.
+ *
+ * FIXME: This wouldn't be needed if the panel_bridge structure was
+ * allocated with drmm_kzalloc(). This might be tricky since the
+ * drm_device pointer can only be retrieved when the bridge is attached.
+ */
+ if (!!panel_bridge->connector.dev)
+ drm_connector_cleanup(connector);
}
static void panel_bridge_pre_enable(struct drm_bridge *bridge)
--
2.29.2
This is the start of the stable review cycle for the 4.14.227 release.
There are 43 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 24 Mar 2021 12:19:09 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.227-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.227-rc1
Thomas Gleixner <tglx(a)linutronix.de>
genirq: Disable interrupts for force threaded handlers
Shijie Luo <luoshijie1(a)huawei.com>
ext4: fix potential error in ext4_do_update_inode
zhangyi (F) <yi.zhang(a)huawei.com>
ext4: do not try to set xattr into ea_inode if value is empty
zhangyi (F) <yi.zhang(a)huawei.com>
ext4: find old entry again if failed to rename whiteout
Oleg Nesterov <oleg(a)redhat.com>
x86: Introduce TS_COMPAT_RESTART to fix get_nr_restart_syscall()
Oleg Nesterov <oleg(a)redhat.com>
x86: Move TS_COMPAT back to asm/thread_info.h
Oleg Nesterov <oleg(a)redhat.com>
kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()
Thomas Gleixner <tglx(a)linutronix.de>
x86/ioapic: Ignore IRQ2 again
Kan Liang <kan.liang(a)linux.intel.com>
perf/x86/intel: Fix a crash caused by zero PEBS status
Tyrel Datwyler <tyreld(a)linux.ibm.com>
PCI: rpadlpar: Fix potential drc_name corruption in store functions
Ye Xiang <xiang.ye(a)intel.com>
iio: hid-sensor-temperature: Fix issues of timestamp channel
Ye Xiang <xiang.ye(a)intel.com>
iio: hid-sensor-prox: Fix scale not correct issue
Ye Xiang <xiang.ye(a)intel.com>
iio: hid-sensor-humidity: Fix alignment issue of timestamp channel
Dinghao Liu <dinghao.liu(a)zju.edu.cn>
iio: gyro: mpu3050: Fix error handling in mpu3050_trigger_handler
Dan Carpenter <dan.carpenter(a)oracle.com>
iio: adis16400: Fix an error code in adis16400_initial_setup()
Jonathan Albrieux <jonathan.albrieux(a)gmail.com>
iio:adc:qcom-spmi-vadc: add default scale to LR_MUX2_BAT_ID channel
Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
iio:adc:stm32-adc: Add HAS_IOMEM dependency
Jim Lin <jilin(a)nvidia.com>
usb: gadget: configfs: Fix KASAN use-after-free
Macpaul Lin <macpaul.lin(a)mediatek.com>
USB: replace hardcode maximum usb string length by definition
Alan Stern <stern(a)rowland.harvard.edu>
usb-storage: Add quirk to defeat Kindle's automatic unload
Sagi Grimberg <sagi(a)grimberg.me>
nvme-rdma: fix possible hang when failing to set io queues
Dan Carpenter <dan.carpenter(a)oracle.com>
scsi: lpfc: Fix some error codes in debugfs
Pavel Skripkin <paskripkin(a)gmail.com>
net/qrtr: fix __netdev_alloc_skb call
Daniel Kobras <kobras(a)puzzle-itc.de>
sunrpc: fix refcount leak for rpc auth modules
Timo Rothenpieler <timo(a)rothenpieler.org>
svcrdma: disable timeouts on rdma backchannel
Joe Korty <joe.korty(a)concurrent-rt.com>
NFSD: Repair misuse of sv_lock in 5.10.16-rt30.
Sagi Grimberg <sagi(a)grimberg.me>
nvmet: don't check iosqes,iocqes for discovery controllers
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix race when cloning extent buffer during rewind of an old root
Arnaldo Carvalho de Melo <acme(a)redhat.com>
tools build feature: Check if pthread_barrier_t is available
Changbin Du <changbin.du(a)gmail.com>
perf: Make perf able to build with latest libbfd
Arnaldo Carvalho de Melo <acme(a)redhat.com>
tools build: Check if gettid() is available before providing helper
Arnaldo Carvalho de Melo <acme(a)redhat.com>
tools build feature: Check if eventfd() is available
Arnaldo Carvalho de Melo <acme(a)redhat.com>
tools build feature: Check if get_current_dir_name() is available
Jiri Olsa <jolsa(a)redhat.com>
perf tools: Use %define api.pure full instead of %pure-parser
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Revert "PM: runtime: Update device status before letting suppliers suspend"
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Prohibit alu ops for pointer types not defining ptr_limit
Florian Fainelli <f.fainelli(a)gmail.com>
net: dsa: b53: Support setting learning on port
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Add sanity check for upper ptr_limit
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Simplify alu_limit masking for pointer arithmetic
Piotr Krysiuk <piotras(a)gmail.com>
bpf: Fix off-by-one for area size in creating mask to left
Jan Kara <jack(a)suse.cz>
ext4: check journal inode extents more carefully
Jan Kara <jack(a)suse.cz>
ext4: don't allow overlapping system zones
Jan Kara <jack(a)suse.cz>
ext4: handle error of ext4_setup_system_zone() on remount
-------------
Diffstat:
Makefile | 4 +-
arch/x86/events/intel/ds.c | 2 +-
arch/x86/include/asm/processor.h | 9 ---
arch/x86/include/asm/thread_info.h | 23 +++++++-
arch/x86/kernel/apic/io_apic.c | 10 ++++
arch/x86/kernel/signal.c | 24 +-------
drivers/base/power/runtime.c | 62 +++++++++------------
drivers/iio/adc/Kconfig | 1 +
drivers/iio/adc/qcom-spmi-vadc.c | 2 +-
drivers/iio/gyro/mpu3050-core.c | 2 +
drivers/iio/humidity/hid-sensor-humidity.c | 12 ++--
drivers/iio/imu/adis16400_core.c | 3 +-
drivers/iio/light/hid-sensor-prox.c | 13 ++++-
drivers/iio/temperature/hid-sensor-temperature.c | 14 +++--
drivers/net/dsa/b53/b53_common.c | 20 +++++++
drivers/net/dsa/b53/b53_regs.h | 1 +
drivers/net/dsa/bcm_sf2.c | 5 ++
drivers/net/dsa/bcm_sf2_regs.h | 2 +
drivers/nvme/host/rdma.c | 7 ++-
drivers/nvme/target/core.c | 17 +++++-
drivers/pci/hotplug/rpadlpar_sysfs.c | 14 ++---
drivers/scsi/lpfc/lpfc_debugfs.c | 4 +-
drivers/usb/gadget/composite.c | 4 +-
drivers/usb/gadget/configfs.c | 16 ++++--
drivers/usb/gadget/usbstring.c | 4 +-
drivers/usb/storage/transport.c | 7 +++
drivers/usb/storage/unusual_devs.h | 12 ++++
fs/btrfs/ctree.c | 2 +
fs/ext4/block_validity.c | 71 +++++++++++-------------
fs/ext4/ext4.h | 6 +-
fs/ext4/extents.c | 16 ++----
fs/ext4/indirect.c | 6 +-
fs/ext4/inode.c | 13 ++---
fs/ext4/mballoc.c | 4 +-
fs/ext4/namei.c | 29 +++++++++-
fs/ext4/super.c | 5 +-
fs/ext4/xattr.c | 2 +-
fs/select.c | 10 ++--
include/linux/thread_info.h | 13 +++++
include/linux/usb_usual.h | 2 +
include/uapi/linux/usb/ch9.h | 3 +
kernel/bpf/verifier.c | 33 +++++++----
kernel/futex.c | 3 +-
kernel/irq/manage.c | 4 ++
kernel/time/alarmtimer.c | 2 +-
kernel/time/hrtimer.c | 2 +-
kernel/time/posix-cpu-timers.c | 2 +-
net/qrtr/qrtr.c | 2 +-
net/sunrpc/svc.c | 6 +-
net/sunrpc/svc_xprt.c | 4 +-
net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 6 +-
tools/build/Makefile.feature | 4 ++
tools/build/feature/Makefile | 16 ++++++
tools/build/feature/test-all.c | 20 +++++++
tools/build/feature/test-eventfd.c | 9 +++
tools/build/feature/test-get_current_dir_name.c | 10 ++++
tools/build/feature/test-gettid.c | 11 ++++
tools/build/feature/test-pthread-barrier.c | 12 ++++
tools/perf/Makefile.config | 16 ++++++
tools/perf/jvmti/jvmti_agent.c | 2 +
tools/perf/util/Build | 1 +
tools/perf/util/expr.y | 3 +-
tools/perf/util/get_current_dir_name.c | 18 ++++++
tools/perf/util/parse-events.y | 2 +-
tools/perf/util/srcline.c | 16 +++++-
tools/perf/util/util.h | 4 ++
66 files changed, 469 insertions(+), 215 deletions(-)