[PATCH] drm: Check if primary mst is null

* [PATCH] drm: Check if primary mst is null
@ 2018-11-07 16:11 Stanislav Lisovskiy
  2018-11-07 17:10 ` ✗ Fi.CI.CHECKPATCH: warning for " Patchwork
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: Stanislav Lisovskiy @ 2018-11-07 16:11 UTC (permalink / raw)
  To: dri-devel; +Cc: stanislav.lisovskiy, intel-gfx, ville.syrjala, martin.peres

Unfortunately drm_dp_get_mst_branch_device which is called from both
drm_dp_mst_handle_down_rep and drm_dp_mst_handle_up_rep seem to rely
on that mgr->mst_primary is not NULL, which seem to be wrong as it can be
cleared with simultaneous mode set, if probing fails or in other case.
mgr->lock mutex doesn't protect against that as it might just get assigned to NULL
right before, not simultaneously.
There are currently bugs 107738, 108816 bugs which crash in
drm_dp_get_mst_branch_device, caused by this issue.

Signed-off-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
---
 drivers/gpu/drm/drm_dp_mst_topology.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 5ff1d79b86c4..fb90ed4cdc3a 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1273,6 +1273,12 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
 	/* find the port by iterating down */
 
 	mutex_lock(&mgr->lock);
+
+	if (!mgr->mst_primary) {
+		mstb = NULL;
+		goto out;
+	}
+
 	mstb = mgr->mst_primary;
 
 	for (i = 0; i < lct - 1; i++) {
-- 
2.17.1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply related	[flat|nested] 6+ messages in thread