From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 206D2C433FE for ; Sun, 9 Oct 2022 23:52:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=mGlxedB2hs0w15bAnP0uPKU2IQ+h122AjOQQNEz+9yo=; b=J9dnE7CxMb24Pf c1PtKpOMb+BjIt1SF8hoc38972ZFhQxbRmSerpYHAlwcUptyizfjnpY+9v98ia2WPQbKGYqhOlo7v rI3Gc1W4wdKT3JEdbtxJ3XjcyS1QIj5/wRSeDeOnM5TBjJTdSqVkx1QwCmyInGIDhKgc3AGdnYY7J mJXhTlacUsf8s/2GEPS0FnUdDjFX1M2/rFxsJOn2zl0+JbS3qEvqHLRfKaA6YSA1f26vUPq0inXV3 2MNFsOlWfEl4Fl/i4P4GOMHDuKr/3EPgXytowMPucVP9xuQfQi5E8kB0S7cpzh88ZRb3r7dVwbD7Q r5s+BHIfEIUT6GA9WJcQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1ohg5B-00GS9A-Mm; Sun, 09 Oct 2022 23:51:45 +0000 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1ohg58-00GS8G-F8; Sun, 09 Oct 2022 23:51:44 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B623060D3D; Sun, 9 Oct 2022 23:51:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B5C8C43147; Sun, 9 Oct 2022 23:51:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1665359501; bh=5aAshN+FiXLo+cw/dQPsDHOuHlVtKNPBBkoCEdY0WK8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PRnFc19TCmMo/xZm6LhwwjqxKj8d6jLglGmw52i46lOKPtQb/cDiE3iPGi+371SRn cEHI/cAsFCAjH2vN9erjixXvPrDJ618mBQ9ZEMNCev4azjPKL2fS85qBmNeEMhsQiI U7gXBwiE/N2GhnLMEGJDLOQpxfnjrQbKZsUfh1R900U6nfFnYjv99o+kclDEFyUxNf 5vcLlWLUi534+MvAlhqQ9QCwM8iuoVqOEQtzoMHlQobWsY+fRuu32MKvA40M43Iedo KsENwfwsgF0+AuJr5QDrgib1DCbYCsv+4kXuazC7fv6ata4klrYe82p0+4R6hK7u3U /NnR6MaCzfKxw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: =?UTF-8?q?Adri=C3=A1n=20Larumbe?= , Neil Armstrong , Sasha Levin , airlied@gmail.com, daniel@ffwll.ch, khilman@baylibre.com, dri-devel@lists.freedesktop.org, linux-amlogic@lists.infradead.org, linux-arm-kernel@lists.infradead.org Subject: [PATCH AUTOSEL 6.0 35/44] drm/meson: reorder driver deinit sequence to fix use-after-free bug Date: Sun, 9 Oct 2022 19:49:23 -0400 Message-Id: <20221009234932.1230196-35-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221009234932.1230196-1-sashal@kernel.org> References: <20221009234932.1230196-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20221009_165142_617946_8EFC154A X-CRM114-Status: GOOD ( 14.82 ) X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org RnJvbTogQWRyacOhbiBMYXJ1bWJlIDxhZHJpYW4ubGFydW1iZUBjb2xsYWJvcmEuY29tPgoKWyBV cHN0cmVhbSBjb21taXQgMzFjNTE5OTgxZWIxNDFjN2VjMzliZmQ1YmUyNWQzNWYwMmVkYjg2OCBd CgpVbmxvYWRpbmcgdGhlIGRyaXZlciB0cmlnZ2VycyB0aGUgZm9sbG93aW5nIEtBU0FOIHdhcm5p bmc6CgpbICArMC4wMDYyNzVdID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KWyAgKzAuMDAwMDI5XSBCVUc6IEtBU0FOOiB1c2UtYWZ0 ZXItZnJlZSBpbiBfX2xpc3RfZGVsX2VudHJ5X3ZhbGlkKzB4ZTAvMHgxYTAKWyAgKzAuMDAwMDI2 XSBSZWFkIG9mIHNpemUgOCBhdCBhZGRyIGZmZmYwMDAwMjBjMzk1ZTAgYnkgdGFzayBybW1vZC8y Njk1CgpbICArMC4wMDAwMTldIENQVTogNSBQSUQ6IDI2OTUgQ29tbTogcm1tb2QgVGFpbnRlZDog RyAgICAgICAgIEMgTyAgICAgIDUuMTkuMC1yYzYtbHJtYmthc2FuKyAjMQpbICArMC4wMDAwMTNd IEhhcmR3YXJlIG5hbWU6IEhhcmRrZXJuZWwgT0RST0lELU4yUGx1cyAoRFQpClsgICswLjAwMDAw OF0gQ2FsbCB0cmFjZToKWyAgKzAuMDAwMDA3XSAgZHVtcF9iYWNrdHJhY2UrMHgxZWMvMHgyODAK WyAgKzAuMDAwMDEzXSAgc2hvd19zdGFjaysweDI0LzB4ODAKWyAgKzAuMDAwMDA4XSAgZHVtcF9z dGFja19sdmwrMHg5OC8weGQ0ClsgICswLjAwMDAxMV0gIHByaW50X2FkZHJlc3NfZGVzY3JpcHRp b24uY29uc3Rwcm9wLjArMHg4MC8weDUyMApbICArMC4wMDAwMTFdICBwcmludF9yZXBvcnQrMHgx MjgvMHgyNjAKWyAgKzAuMDAwMDA3XSAga2FzYW5fcmVwb3J0KzB4YjgvMHhmYwpbICArMC4wMDAw MDhdICBfX2FzYW5fcmVwb3J0X2xvYWQ4X25vYWJvcnQrMHgzYy8weDUwClsgICswLjAwMDAxMF0g IF9fbGlzdF9kZWxfZW50cnlfdmFsaWQrMHhlMC8weDFhMApbICArMC4wMDAwMDldICBkcm1fYXRv bWljX3ByaXZhdGVfb2JqX2ZpbmkrMHgzMC8weDIwMCBbZHJtXQpbICArMC4wMDAxNzJdICBkcm1f YnJpZGdlX2RldGFjaCsweDk0LzB4MjYwIFtkcm1dClsgICswLjAwMDE0NV0gIGRybV9lbmNvZGVy X2NsZWFudXArMHhhNC8weDI5MCBbZHJtXQpbICArMC4wMDAxNDRdICBkcm1fbW9kZV9jb25maWdf Y2xlYW51cCsweDExOC8weDc0MCBbZHJtXQpbICArMC4wMDAxNDNdICBkcm1fbW9kZV9jb25maWdf aW5pdF9yZWxlYXNlKzB4MWMvMHgyYyBbZHJtXQpbICArMC4wMDAxNDRdICBkcm1fbWFuYWdlZF9y ZWxlYXNlKzB4MTcwLzB4NDE0IFtkcm1dClsgICswLjAwMDE0Ml0gIGRybV9kZXZfcHV0LnBhcnQu MCsweGMwLzB4MTI0IFtkcm1dClsgICswLjAwMDE0M10gIGRybV9kZXZfcHV0KzB4MjAvMHgzMCBb ZHJtXQpbICArMC4wMDAxNDJdICBtZXNvbl9kcnZfdW5iaW5kKzB4MWQ4LzB4MmFjIFttZXNvbl9k cm1dClsgICswLjAwMDAyOF0gIHRha2VfZG93bl9hZ2dyZWdhdGVfZGV2aWNlKzB4YjAvMHgxNjAK WyAgKzAuMDAwMDE2XSAgY29tcG9uZW50X2RlbCsweDE4Yy8weDM2MApbICArMC4wMDAwMDldICBt ZXNvbl9kd19oZG1pX3JlbW92ZSsweDI4LzB4NDAgW21lc29uX2R3X2hkbWldClsgICswLjAwMDAx NV0gIHBsYXRmb3JtX3JlbW92ZSsweDY0LzB4YjAKWyAgKzAuMDAwMDA5XSAgZGV2aWNlX3JlbW92 ZSsweGI4LzB4MTU0ClsgICswLjAwMDAwOV0gIGRldmljZV9yZWxlYXNlX2RyaXZlcl9pbnRlcm5h bCsweDM5OC8weDViMApbICArMC4wMDAwMDldICBkcml2ZXJfZGV0YWNoKzB4YWMvMHgxYjAKWyAg KzAuMDAwMDA5XSAgYnVzX3JlbW92ZV9kcml2ZXIrMHgxNTgvMHgyOWMKWyAgKzAuMDAwMDA5XSAg ZHJpdmVyX3VucmVnaXN0ZXIrMHg3MC8weGIwClsgICswLjAwMDAwOF0gIHBsYXRmb3JtX2RyaXZl cl91bnJlZ2lzdGVyKzB4MjAvMHgyYwpbICArMC4wMDAwMDhdICBtZXNvbl9kd19oZG1pX3BsYXRm b3JtX2RyaXZlcl9leGl0KzB4MWMvMHgzMCBbbWVzb25fZHdfaGRtaV0KWyAgKzAuMDAwMDEyXSAg X19kb19zeXNfZGVsZXRlX21vZHVsZSsweDI4OC8weDQwMApbICArMC4wMDAwMTFdICBfX2FybTY0 X3N5c19kZWxldGVfbW9kdWxlKzB4NWMvMHg4MApbICArMC4wMDAwMDldICBpbnZva2Vfc3lzY2Fs bCsweDc0LzB4MjYwClsgICswLjAwMDAwOV0gIGVsMF9zdmNfY29tbW9uLmNvbnN0cHJvcC4wKzB4 Y2MvMHgyNjAKWyAgKzAuMDAwMDA5XSAgZG9fZWwwX3N2YysweDUwLzB4NzAKWyAgKzAuMDAwMDA3 XSAgZWwwX3N2YysweDY4LzB4MWEwClsgICswLjAwMDAxMl0gIGVsMHRfNjRfc3luY19oYW5kbGVy KzB4MTFjLzB4MTUwClsgICswLjAwMDAwOF0gIGVsMHRfNjRfc3luYysweDE4Yy8weDE5MAoKWyAg KzAuMDAwMDE4XSBBbGxvY2F0ZWQgYnkgdGFzayAwOgpbICArMC4wMDAwMDddIChzdGFjayBpcyBu b3QgYXZhaWxhYmxlKQoKWyAgKzAuMDAwMDExXSBGcmVlZCBieSB0YXNrIDI2OTU6ClsgICswLjAw MDAwOF0gIGthc2FuX3NhdmVfc3RhY2srMHgyYy8weDVjClsgICswLjAwMDAxMV0gIGthc2FuX3Nl dF90cmFjaysweDJjLzB4NDAKWyAgKzAuMDAwMDA4XSAga2FzYW5fc2V0X2ZyZWVfaW5mbysweDI4 LzB4NTAKWyAgKzAuMDAwMDA5XSAgX19fX2thc2FuX3NsYWJfZnJlZSsweDEyOC8weDFkNApbICAr MC4wMDAwMDhdICBfX2thc2FuX3NsYWJfZnJlZSsweDE4LzB4MjQKWyAgKzAuMDAwMDA3XSAgc2xh Yl9mcmVlX2ZyZWVsaXN0X2hvb2srMHgxMDgvMHgyMzAKWyAgKzAuMDAwMDExXSAga2ZyZWUrMHgx MTAvMHgzNWMKWyAgKzAuMDAwMDA4XSAgcmVsZWFzZV9ub2RlcysweGYwLzB4MTZjClsgICswLjAw MDAwOV0gIGRldnJlc19yZWxlYXNlX2dyb3VwKzB4MTgwLzB4MjcwClsgICswLjAwMDAwOF0gIGNv bXBvbmVudF91bmJpbmQrMHgxMjgvMHgxZTAKWyAgKzAuMDAwMDEwXSAgY29tcG9uZW50X3VuYmlu ZF9hbGwrMHgxYjgvMHgyNjQKWyAgKzAuMDAwMDA5XSAgbWVzb25fZHJ2X3VuYmluZCsweDFhMC8w eDJhYyBbbWVzb25fZHJtXQpbICArMC4wMDAwMjVdICB0YWtlX2Rvd25fYWdncmVnYXRlX2Rldmlj ZSsweGIwLzB4MTYwClsgICswLjAwMDAwOV0gIGNvbXBvbmVudF9kZWwrMHgxOGMvMHgzNjAKWyAg KzAuMDAwMDA5XSAgbWVzb25fZHdfaGRtaV9yZW1vdmUrMHgyOC8weDQwIFttZXNvbl9kd19oZG1p XQpbICArMC4wMDAwMTJdICBwbGF0Zm9ybV9yZW1vdmUrMHg2NC8weGIwClsgICswLjAwMDAwOF0g IGRldmljZV9yZW1vdmUrMHhiOC8weDE1NApbICArMC4wMDAwMDldICBkZXZpY2VfcmVsZWFzZV9k cml2ZXJfaW50ZXJuYWwrMHgzOTgvMHg1YjAKWyAgKzAuMDAwMDA5XSAgZHJpdmVyX2RldGFjaCsw eGFjLzB4MWIwClsgICswLjAwMDAwOV0gIGJ1c19yZW1vdmVfZHJpdmVyKzB4MTU4LzB4MjljClsg ICswLjAwMDAwOF0gIGRyaXZlcl91bnJlZ2lzdGVyKzB4NzAvMHhiMApbICArMC4wMDAwMDhdICBw bGF0Zm9ybV9kcml2ZXJfdW5yZWdpc3RlcisweDIwLzB4MmMKWyAgKzAuMDAwMDA4XSAgbWVzb25f ZHdfaGRtaV9wbGF0Zm9ybV9kcml2ZXJfZXhpdCsweDFjLzB4MzAgW21lc29uX2R3X2hkbWldClsg ICswLjAwMDAxMV0gIF9fZG9fc3lzX2RlbGV0ZV9tb2R1bGUrMHgyODgvMHg0MDAKWyAgKzAuMDAw MDEwXSAgX19hcm02NF9zeXNfZGVsZXRlX21vZHVsZSsweDVjLzB4ODAKWyAgKzAuMDAwMDA4XSAg aW52b2tlX3N5c2NhbGwrMHg3NC8weDI2MApbICArMC4wMDAwMDhdICBlbDBfc3ZjX2NvbW1vbi5j b25zdHByb3AuMCsweGNjLzB4MjYwClsgICswLjAwMDAwOF0gIGRvX2VsMF9zdmMrMHg1MC8weDcw ClsgICswLjAwMDAwN10gIGVsMF9zdmMrMHg2OC8weDFhMApbICArMC4wMDAwMDldICBlbDB0XzY0 X3N5bmNfaGFuZGxlcisweDExYy8weDE1MApbICArMC4wMDAwMDldICBlbDB0XzY0X3N5bmMrMHgx OGMvMHgxOTAKClsgICswLjAwMDAxNF0gVGhlIGJ1Z2d5IGFkZHJlc3MgYmVsb25ncyB0byB0aGUg b2JqZWN0IGF0IGZmZmYwMDAwMjBjMzkwMDAKICAgICAgICAgICAgICAgd2hpY2ggYmVsb25ncyB0 byB0aGUgY2FjaGUga21hbGxvYy00ayBvZiBzaXplIDQwOTYKWyAgKzAuMDAwMDA4XSBUaGUgYnVn Z3kgYWRkcmVzcyBpcyBsb2NhdGVkIDE1MDQgYnl0ZXMgaW5zaWRlIG9mCiAgICAgICAgICAgICAg IDQwOTYtYnl0ZSByZWdpb24gW2ZmZmYwMDAwMjBjMzkwMDAsIGZmZmYwMDAwMjBjM2EwMDApCgpb ICArMC4wMDAwMTZdIFRoZSBidWdneSBhZGRyZXNzIGJlbG9uZ3MgdG8gdGhlIHBoeXNpY2FsIHBh Z2U6ClsgICswLjAwMDAwOV0gcGFnZTpmZmZmZmMwMDAwODMwZTAwIHJlZmNvdW50OjEgbWFwY291 bnQ6MCBtYXBwaW5nOjAwMDAwMDAwMDAwMDAwMDAgaW5kZXg6MHgwIHBmbjoweDIwYzM4ClsgICsw LjAwMDAxM10gaGVhZDpmZmZmZmMwMDAwODMwZTAwIG9yZGVyOjMgY29tcG91bmRfbWFwY291bnQ6 MCBjb21wb3VuZF9waW5jb3VudDowClsgICswLjAwMDAwOF0gZmxhZ3M6IDB4ZmZmZjAwMDAwMDEw MjAwKHNsYWJ8aGVhZHxub2RlPTB8em9uZT0wfGxhc3RjcHVwaWQ9MHhmZmZmKQpbICArMC4wMDAw MTldIHJhdzogMGZmZmYwMDAwMDAxMDIwMCBmZmZmZmMwMDAwZmQ0ODA4IGZmZmZmYzAwMDAxMjYy MDggZmZmZjAwMDAwMDAwMmU4MApbICArMC4wMDAwMDldIHJhdzogMDAwMDAwMDAwMDAwMDAwMCAw MDAwMDAwMDAwMDIwMDAyIDAwMDAwMDAxZmZmZmZmZmYgMDAwMDAwMDAwMDAwMDAwMApbICArMC4w MDAwMDhdIHBhZ2UgZHVtcGVkIGJlY2F1c2U6IGthc2FuOiBiYWQgYWNjZXNzIGRldGVjdGVkCgpb ICArMC4wMDAwMTFdIE1lbW9yeSBzdGF0ZSBhcm91bmQgdGhlIGJ1Z2d5IGFkZHJlc3M6ClsgICsw LjAwMDAwOF0gIGZmZmYwMDAwMjBjMzk0ODA6IGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZi IGZiIGZiIGZiIGZiIGZiIGZiClsgICswLjAwMDAwN10gIGZmZmYwMDAwMjBjMzk1MDA6IGZiIGZi IGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiClsgICswLjAwMDAwN10g PmZmZmYwMDAwMjBjMzk1ODA6IGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZi IGZiIGZiIGZiClsgICswLjAwMDAwN10gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIF4KWyAgKzAuMDAwMDA3XSAgZmZmZjAwMDAyMGMzOTYwMDog ZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIKWyAgKzAuMDAw MDA3XSAgZmZmZjAwMDAyMGMzOTY4MDogZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIg ZmIgZmIgZmIgZmIgZmIKWyAgKzAuMDAwMDA2XSA9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KClRoZSByZWFzb24gdGhpcyBp cyBoYXBwZW5pbmcgaXMgdW5sb2FkaW5nIG1lc29uLWR3LWhkbWkgd2lsbCBjYXVzZSB0aGUKY29t cG9uZW50IEFQSSB0byB0YWtlIGRvd24gdGhlIGFnZ3JlZ2F0ZSBkZXZpY2UsIHdoaWNoIGluIHR1 cm4gd2lsbCBjYXVzZQphbGwgZGV2cmVzLW1hbmFnZWQgbWVtb3J5IHRvIGJlIGZyZWVkLCBpbmNs dWRpbmcgdGhlIHN0cnVjdCBkd19oZG1pCmFsbG9jYXRlZCBpbiBkd19oZG1pX3Byb2JlLiBUaGlz IHN0cnVjdCBlbWJlZHMgYSBzdHJ1Y3QgZHJtX2JyaWRnZSB0aGF0IGlzCmFkZGVkIGF0IHRoZSBl bmQgb2YgdGhlIGZ1bmN0aW9uLCBhbmQgd2hpY2ggaXMgbGF0ZXIgb24gcGlja2VkIHVwIGluCm1l c29uX2VuY29kZXJfaGRtaV9pbml0LgoKSG93ZXZlciwgd2hlbiBhdHRhY2hpbmcgdGhlIGJyaWRn ZSB0byB0aGUgZW5jb2RlciBjcmVhdGVkIGluCm1lc29uX2VuY29kZXJfaGRtaV9pbml0LCBpdCdz IGxpbmtlZCB0byB0aGUgZW5jb2RlcidzIGJyaWRnZSBjaGFpbiwgZnJvbQp3aGVyZSBpdCBuZXZl ciBsZWF2ZXMsIGV2ZW4gYWZ0ZXIgZGV2cmVzX3JlbGVhc2VfZ3JvdXAgaXMgY2FsbGVkIHdoZW4g dGhlCmRyaXZlcidzIGNvbXBvbmVudHMgYXJlIHVuYm91bmQgYW5kIHRoZSBlbWJlZGRpbmcgc3Ry dWN0dXJlIGZyZWVkLgoKVGhlbiwgd2hlbiBjYWxsaW5nIGRybV9kZXZfcHV0IGluIHRoZSBhZ2dy ZWdhdGUgZHJpdmVyJ3MgdW5iaW5kIGZ1bmN0aW9uLApkcm1fYnJpZGdlX2RldGFjaCBpcyBjYWxs ZWQgZm9yIGV2ZXJ5IHNpbmdsZSBicmlkZ2UgbGlua2VkIHRvIHRoZSBlbmNvZGVyLAppbmNsdWRp bmcgdGhlIG9uZSB3aG9zZSBtZW1vcnkgaGFkIGFscmVhZHkgYmVlbiBkZWFsbG9jYXRlZC4KCkZp eCBieSBjYWxsaW5nIGNvbXBvbmVudF91bmJpbmRfYWxsIGFmdGVyIGRybV9kZXZfcHV0LgoKU2ln bmVkLW9mZi1ieTogQWRyacOhbiBMYXJ1bWJlIDxhZHJpYW4ubGFydW1iZUBjb2xsYWJvcmEuY29t PgpSZXZpZXdlZC1ieTogTmVpbCBBcm1zdHJvbmcgPG5laWwuYXJtc3Ryb25nQGxpbmFyby5vcmc+ ClNpZ25lZC1vZmYtYnk6IE5laWwgQXJtc3Ryb25nIDxuZWlsLmFybXN0cm9uZ0BsaW5hcm8ub3Jn PgpMaW5rOiBodHRwczovL3BhdGNod29yay5mcmVlZGVza3RvcC5vcmcvcGF0Y2gvbXNnaWQvMjAy MjA5MTkwMTA5NDAuNDE5ODkzLTItYWRyaWFuLmxhcnVtYmVAY29sbGFib3JhLmNvbQpTaWduZWQt b2ZmLWJ5OiBTYXNoYSBMZXZpbiA8c2FzaGFsQGtlcm5lbC5vcmc+Ci0tLQogZHJpdmVycy9ncHUv ZHJtL21lc29uL21lc29uX2Rydi5jIHwgMiArLQogMSBmaWxlIGNoYW5nZWQsIDEgaW5zZXJ0aW9u KCspLCAxIGRlbGV0aW9uKC0pCgpkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL21lc29uL21l c29uX2Rydi5jIGIvZHJpdmVycy9ncHUvZHJtL21lc29uL21lc29uX2Rydi5jCmluZGV4IGJkNGNh MTFkM2ZmNS4uN2RmMTQ5ZDQyNzI4IDEwMDY0NAotLS0gYS9kcml2ZXJzL2dwdS9kcm0vbWVzb24v bWVzb25fZHJ2LmMKKysrIGIvZHJpdmVycy9ncHUvZHJtL21lc29uL21lc29uX2Rydi5jCkBAIC0z ODgsOSArMzg4LDkgQEAgc3RhdGljIHZvaWQgbWVzb25fZHJ2X3VuYmluZChzdHJ1Y3QgZGV2aWNl ICpkZXYpCiAJZHJtX2Rldl91bnJlZ2lzdGVyKGRybSk7CiAJZHJtX2ttc19oZWxwZXJfcG9sbF9m aW5pKGRybSk7CiAJZHJtX2F0b21pY19oZWxwZXJfc2h1dGRvd24oZHJtKTsKLQljb21wb25lbnRf dW5iaW5kX2FsbChkZXYsIGRybSk7CiAJZnJlZV9pcnEocHJpdi0+dnN5bmNfaXJxLCBkcm0pOwog CWRybV9kZXZfcHV0KGRybSk7CisJY29tcG9uZW50X3VuYmluZF9hbGwoZGV2LCBkcm0pOwogCiAJ aWYgKHByaXYtPmFmYmNkLm9wcykKIAkJcHJpdi0+YWZiY2Qub3BzLT5leGl0KHByaXYpOwotLSAK Mi4zNS4xCgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K bGludXgtYW1sb2dpYyBtYWlsaW5nIGxpc3QKbGludXgtYW1sb2dpY0BsaXN0cy5pbmZyYWRlYWQu b3JnCmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8vbGludXgtYW1s b2dpYwo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3918AC43217 for ; Mon, 10 Oct 2022 00:15:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231940AbiJJAP0 (ORCPT ); Sun, 9 Oct 2022 20:15:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52790 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231607AbiJJANt (ORCPT ); Sun, 9 Oct 2022 20:13:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9E1A721B5; Sun, 9 Oct 2022 16:51:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 227F760DBB; Sun, 9 Oct 2022 23:51:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B5C8C43147; Sun, 9 Oct 2022 23:51:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1665359501; bh=5aAshN+FiXLo+cw/dQPsDHOuHlVtKNPBBkoCEdY0WK8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PRnFc19TCmMo/xZm6LhwwjqxKj8d6jLglGmw52i46lOKPtQb/cDiE3iPGi+371SRn cEHI/cAsFCAjH2vN9erjixXvPrDJ618mBQ9ZEMNCev4azjPKL2fS85qBmNeEMhsQiI U7gXBwiE/N2GhnLMEGJDLOQpxfnjrQbKZsUfh1R900U6nfFnYjv99o+kclDEFyUxNf 5vcLlWLUi534+MvAlhqQ9QCwM8iuoVqOEQtzoMHlQobWsY+fRuu32MKvA40M43Iedo KsENwfwsgF0+AuJr5QDrgib1DCbYCsv+4kXuazC7fv6ata4klrYe82p0+4R6hK7u3U /NnR6MaCzfKxw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: =?UTF-8?q?Adri=C3=A1n=20Larumbe?= , Neil Armstrong , Sasha Levin , airlied@gmail.com, daniel@ffwll.ch, khilman@baylibre.com, dri-devel@lists.freedesktop.org, linux-amlogic@lists.infradead.org, linux-arm-kernel@lists.infradead.org Subject: [PATCH AUTOSEL 6.0 35/44] drm/meson: reorder driver deinit sequence to fix use-after-free bug Date: Sun, 9 Oct 2022 19:49:23 -0400 Message-Id: <20221009234932.1230196-35-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221009234932.1230196-1-sashal@kernel.org> References: <20221009234932.1230196-1-sashal@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Adrián Larumbe [ Upstream commit 31c519981eb141c7ec39bfd5be25d35f02edb868 ] Unloading the driver triggers the following KASAN warning: [ +0.006275] ============================================================= [ +0.000029] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0x1a0 [ +0.000026] Read of size 8 at addr ffff000020c395e0 by task rmmod/2695 [ +0.000019] CPU: 5 PID: 2695 Comm: rmmod Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1 [ +0.000013] Hardware name: Hardkernel ODROID-N2Plus (DT) [ +0.000008] Call trace: [ +0.000007] dump_backtrace+0x1ec/0x280 [ +0.000013] show_stack+0x24/0x80 [ +0.000008] dump_stack_lvl+0x98/0xd4 [ +0.000011] print_address_description.constprop.0+0x80/0x520 [ +0.000011] print_report+0x128/0x260 [ +0.000007] kasan_report+0xb8/0xfc [ +0.000008] __asan_report_load8_noabort+0x3c/0x50 [ +0.000010] __list_del_entry_valid+0xe0/0x1a0 [ +0.000009] drm_atomic_private_obj_fini+0x30/0x200 [drm] [ +0.000172] drm_bridge_detach+0x94/0x260 [drm] [ +0.000145] drm_encoder_cleanup+0xa4/0x290 [drm] [ +0.000144] drm_mode_config_cleanup+0x118/0x740 [drm] [ +0.000143] drm_mode_config_init_release+0x1c/0x2c [drm] [ +0.000144] drm_managed_release+0x170/0x414 [drm] [ +0.000142] drm_dev_put.part.0+0xc0/0x124 [drm] [ +0.000143] drm_dev_put+0x20/0x30 [drm] [ +0.000142] meson_drv_unbind+0x1d8/0x2ac [meson_drm] [ +0.000028] take_down_aggregate_device+0xb0/0x160 [ +0.000016] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000015] platform_remove+0x64/0xb0 [ +0.000009] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000009] driver_unregister+0x70/0xb0 [ +0.000008] platform_driver_unregister+0x20/0x2c [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000012] __do_sys_delete_module+0x288/0x400 [ +0.000011] __arm64_sys_delete_module+0x5c/0x80 [ +0.000009] invoke_syscall+0x74/0x260 [ +0.000009] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000009] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000012] el0t_64_sync_handler+0x11c/0x150 [ +0.000008] el0t_64_sync+0x18c/0x190 [ +0.000018] Allocated by task 0: [ +0.000007] (stack is not available) [ +0.000011] Freed by task 2695: [ +0.000008] kasan_save_stack+0x2c/0x5c [ +0.000011] kasan_set_track+0x2c/0x40 [ +0.000008] kasan_set_free_info+0x28/0x50 [ +0.000009] ____kasan_slab_free+0x128/0x1d4 [ +0.000008] __kasan_slab_free+0x18/0x24 [ +0.000007] slab_free_freelist_hook+0x108/0x230 [ +0.000011] kfree+0x110/0x35c [ +0.000008] release_nodes+0xf0/0x16c [ +0.000009] devres_release_group+0x180/0x270 [ +0.000008] component_unbind+0x128/0x1e0 [ +0.000010] component_unbind_all+0x1b8/0x264 [ +0.000009] meson_drv_unbind+0x1a0/0x2ac [meson_drm] [ +0.000025] take_down_aggregate_device+0xb0/0x160 [ +0.000009] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000012] platform_remove+0x64/0xb0 [ +0.000008] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000008] driver_unregister+0x70/0xb0 [ +0.000008] platform_driver_unregister+0x20/0x2c [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000011] __do_sys_delete_module+0x288/0x400 [ +0.000010] __arm64_sys_delete_module+0x5c/0x80 [ +0.000008] invoke_syscall+0x74/0x260 [ +0.000008] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000008] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000009] el0t_64_sync_handler+0x11c/0x150 [ +0.000009] el0t_64_sync+0x18c/0x190 [ +0.000014] The buggy address belongs to the object at ffff000020c39000 which belongs to the cache kmalloc-4k of size 4096 [ +0.000008] The buggy address is located 1504 bytes inside of 4096-byte region [ffff000020c39000, ffff000020c3a000) [ +0.000016] The buggy address belongs to the physical page: [ +0.000009] page:fffffc0000830e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20c38 [ +0.000013] head:fffffc0000830e00 order:3 compound_mapcount:0 compound_pincount:0 [ +0.000008] flags: 0xffff00000010200(slab|head|node=0|zone=0|lastcpupid=0xffff) [ +0.000019] raw: 0ffff00000010200 fffffc0000fd4808 fffffc0000126208 ffff000000002e80 [ +0.000009] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ +0.000008] page dumped because: kasan: bad access detected [ +0.000011] Memory state around the buggy address: [ +0.000008] ffff000020c39480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ffff000020c39500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] >ffff000020c39580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ^ [ +0.000007] ffff000020c39600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ffff000020c39680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000006] ================================================================== The reason this is happening is unloading meson-dw-hdmi will cause the component API to take down the aggregate device, which in turn will cause all devres-managed memory to be freed, including the struct dw_hdmi allocated in dw_hdmi_probe. This struct embeds a struct drm_bridge that is added at the end of the function, and which is later on picked up in meson_encoder_hdmi_init. However, when attaching the bridge to the encoder created in meson_encoder_hdmi_init, it's linked to the encoder's bridge chain, from where it never leaves, even after devres_release_group is called when the driver's components are unbound and the embedding structure freed. Then, when calling drm_dev_put in the aggregate driver's unbind function, drm_bridge_detach is called for every single bridge linked to the encoder, including the one whose memory had already been deallocated. Fix by calling component_unbind_all after drm_dev_put. Signed-off-by: Adrián Larumbe Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220919010940.419893-2-adrian.larumbe@collabora.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/meson/meson_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c index bd4ca11d3ff5..7df149d42728 100644 --- a/drivers/gpu/drm/meson/meson_drv.c +++ b/drivers/gpu/drm/meson/meson_drv.c @@ -388,9 +388,9 @@ static void meson_drv_unbind(struct device *dev) drm_dev_unregister(drm); drm_kms_helper_poll_fini(drm); drm_atomic_helper_shutdown(drm); - component_unbind_all(dev, drm); free_irq(priv->vsync_irq, drm); drm_dev_put(drm); + component_unbind_all(dev, drm); if (priv->afbcd.ops) priv->afbcd.ops->exit(priv); -- 2.35.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4ACBBC433FE for ; Sun, 9 Oct 2022 23:52:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=qQFetVY91QzTP7utaNxQCSgOzKFglcHwMk28P2Gp61E=; b=AzQ4LqcmRtctXM cR/Wa7sSP9BOMNCNqyMJ8NDVJ+DQnC554AYRcaHv8HKCTQt2Ugz0tQ6Hs+Fz4KqZ78zGm1XeS0UN3 Hg1YjjOev7igZ3lZUjMLtUogf3lz4n4wtRN8BDlf4JZ/WtibLEE8ncy80Fydyx+CjyHj+oBq/r8L8 KSDE1evE+xhstiMLjzL5wh1VtZryet45jUQ80t/d/1upzhym+JNqJuEDRRw8u31pI8sa2QErI8cqX zbmbOiXs+ghU9i7sr5EZYAvFqqc8fKQ8LvWnWxk606joNoQ5KSEqJyOZp/ih8Zf6ZqhjwMKL79BMd JuhfZtUCY5Qpi5d7qKeA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1ohg5C-00GS9J-F5; Sun, 09 Oct 2022 23:51:46 +0000 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1ohg58-00GS8G-F8; Sun, 09 Oct 2022 23:51:44 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B623060D3D; Sun, 9 Oct 2022 23:51:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B5C8C43147; Sun, 9 Oct 2022 23:51:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1665359501; bh=5aAshN+FiXLo+cw/dQPsDHOuHlVtKNPBBkoCEdY0WK8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PRnFc19TCmMo/xZm6LhwwjqxKj8d6jLglGmw52i46lOKPtQb/cDiE3iPGi+371SRn cEHI/cAsFCAjH2vN9erjixXvPrDJ618mBQ9ZEMNCev4azjPKL2fS85qBmNeEMhsQiI U7gXBwiE/N2GhnLMEGJDLOQpxfnjrQbKZsUfh1R900U6nfFnYjv99o+kclDEFyUxNf 5vcLlWLUi534+MvAlhqQ9QCwM8iuoVqOEQtzoMHlQobWsY+fRuu32MKvA40M43Iedo KsENwfwsgF0+AuJr5QDrgib1DCbYCsv+4kXuazC7fv6ata4klrYe82p0+4R6hK7u3U /NnR6MaCzfKxw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: =?UTF-8?q?Adri=C3=A1n=20Larumbe?= , Neil Armstrong , Sasha Levin , airlied@gmail.com, daniel@ffwll.ch, khilman@baylibre.com, dri-devel@lists.freedesktop.org, linux-amlogic@lists.infradead.org, linux-arm-kernel@lists.infradead.org Subject: [PATCH AUTOSEL 6.0 35/44] drm/meson: reorder driver deinit sequence to fix use-after-free bug Date: Sun, 9 Oct 2022 19:49:23 -0400 Message-Id: <20221009234932.1230196-35-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221009234932.1230196-1-sashal@kernel.org> References: <20221009234932.1230196-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20221009_165142_617946_8EFC154A X-CRM114-Status: GOOD ( 14.82 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org RnJvbTogQWRyacOhbiBMYXJ1bWJlIDxhZHJpYW4ubGFydW1iZUBjb2xsYWJvcmEuY29tPgoKWyBV cHN0cmVhbSBjb21taXQgMzFjNTE5OTgxZWIxNDFjN2VjMzliZmQ1YmUyNWQzNWYwMmVkYjg2OCBd CgpVbmxvYWRpbmcgdGhlIGRyaXZlciB0cmlnZ2VycyB0aGUgZm9sbG93aW5nIEtBU0FOIHdhcm5p bmc6CgpbICArMC4wMDYyNzVdID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KWyAgKzAuMDAwMDI5XSBCVUc6IEtBU0FOOiB1c2UtYWZ0 ZXItZnJlZSBpbiBfX2xpc3RfZGVsX2VudHJ5X3ZhbGlkKzB4ZTAvMHgxYTAKWyAgKzAuMDAwMDI2 XSBSZWFkIG9mIHNpemUgOCBhdCBhZGRyIGZmZmYwMDAwMjBjMzk1ZTAgYnkgdGFzayBybW1vZC8y Njk1CgpbICArMC4wMDAwMTldIENQVTogNSBQSUQ6IDI2OTUgQ29tbTogcm1tb2QgVGFpbnRlZDog RyAgICAgICAgIEMgTyAgICAgIDUuMTkuMC1yYzYtbHJtYmthc2FuKyAjMQpbICArMC4wMDAwMTNd IEhhcmR3YXJlIG5hbWU6IEhhcmRrZXJuZWwgT0RST0lELU4yUGx1cyAoRFQpClsgICswLjAwMDAw OF0gQ2FsbCB0cmFjZToKWyAgKzAuMDAwMDA3XSAgZHVtcF9iYWNrdHJhY2UrMHgxZWMvMHgyODAK WyAgKzAuMDAwMDEzXSAgc2hvd19zdGFjaysweDI0LzB4ODAKWyAgKzAuMDAwMDA4XSAgZHVtcF9z dGFja19sdmwrMHg5OC8weGQ0ClsgICswLjAwMDAxMV0gIHByaW50X2FkZHJlc3NfZGVzY3JpcHRp b24uY29uc3Rwcm9wLjArMHg4MC8weDUyMApbICArMC4wMDAwMTFdICBwcmludF9yZXBvcnQrMHgx MjgvMHgyNjAKWyAgKzAuMDAwMDA3XSAga2FzYW5fcmVwb3J0KzB4YjgvMHhmYwpbICArMC4wMDAw MDhdICBfX2FzYW5fcmVwb3J0X2xvYWQ4X25vYWJvcnQrMHgzYy8weDUwClsgICswLjAwMDAxMF0g IF9fbGlzdF9kZWxfZW50cnlfdmFsaWQrMHhlMC8weDFhMApbICArMC4wMDAwMDldICBkcm1fYXRv bWljX3ByaXZhdGVfb2JqX2ZpbmkrMHgzMC8weDIwMCBbZHJtXQpbICArMC4wMDAxNzJdICBkcm1f YnJpZGdlX2RldGFjaCsweDk0LzB4MjYwIFtkcm1dClsgICswLjAwMDE0NV0gIGRybV9lbmNvZGVy X2NsZWFudXArMHhhNC8weDI5MCBbZHJtXQpbICArMC4wMDAxNDRdICBkcm1fbW9kZV9jb25maWdf Y2xlYW51cCsweDExOC8weDc0MCBbZHJtXQpbICArMC4wMDAxNDNdICBkcm1fbW9kZV9jb25maWdf aW5pdF9yZWxlYXNlKzB4MWMvMHgyYyBbZHJtXQpbICArMC4wMDAxNDRdICBkcm1fbWFuYWdlZF9y ZWxlYXNlKzB4MTcwLzB4NDE0IFtkcm1dClsgICswLjAwMDE0Ml0gIGRybV9kZXZfcHV0LnBhcnQu MCsweGMwLzB4MTI0IFtkcm1dClsgICswLjAwMDE0M10gIGRybV9kZXZfcHV0KzB4MjAvMHgzMCBb ZHJtXQpbICArMC4wMDAxNDJdICBtZXNvbl9kcnZfdW5iaW5kKzB4MWQ4LzB4MmFjIFttZXNvbl9k cm1dClsgICswLjAwMDAyOF0gIHRha2VfZG93bl9hZ2dyZWdhdGVfZGV2aWNlKzB4YjAvMHgxNjAK WyAgKzAuMDAwMDE2XSAgY29tcG9uZW50X2RlbCsweDE4Yy8weDM2MApbICArMC4wMDAwMDldICBt ZXNvbl9kd19oZG1pX3JlbW92ZSsweDI4LzB4NDAgW21lc29uX2R3X2hkbWldClsgICswLjAwMDAx NV0gIHBsYXRmb3JtX3JlbW92ZSsweDY0LzB4YjAKWyAgKzAuMDAwMDA5XSAgZGV2aWNlX3JlbW92 ZSsweGI4LzB4MTU0ClsgICswLjAwMDAwOV0gIGRldmljZV9yZWxlYXNlX2RyaXZlcl9pbnRlcm5h bCsweDM5OC8weDViMApbICArMC4wMDAwMDldICBkcml2ZXJfZGV0YWNoKzB4YWMvMHgxYjAKWyAg KzAuMDAwMDA5XSAgYnVzX3JlbW92ZV9kcml2ZXIrMHgxNTgvMHgyOWMKWyAgKzAuMDAwMDA5XSAg ZHJpdmVyX3VucmVnaXN0ZXIrMHg3MC8weGIwClsgICswLjAwMDAwOF0gIHBsYXRmb3JtX2RyaXZl cl91bnJlZ2lzdGVyKzB4MjAvMHgyYwpbICArMC4wMDAwMDhdICBtZXNvbl9kd19oZG1pX3BsYXRm b3JtX2RyaXZlcl9leGl0KzB4MWMvMHgzMCBbbWVzb25fZHdfaGRtaV0KWyAgKzAuMDAwMDEyXSAg X19kb19zeXNfZGVsZXRlX21vZHVsZSsweDI4OC8weDQwMApbICArMC4wMDAwMTFdICBfX2FybTY0 X3N5c19kZWxldGVfbW9kdWxlKzB4NWMvMHg4MApbICArMC4wMDAwMDldICBpbnZva2Vfc3lzY2Fs bCsweDc0LzB4MjYwClsgICswLjAwMDAwOV0gIGVsMF9zdmNfY29tbW9uLmNvbnN0cHJvcC4wKzB4 Y2MvMHgyNjAKWyAgKzAuMDAwMDA5XSAgZG9fZWwwX3N2YysweDUwLzB4NzAKWyAgKzAuMDAwMDA3 XSAgZWwwX3N2YysweDY4LzB4MWEwClsgICswLjAwMDAxMl0gIGVsMHRfNjRfc3luY19oYW5kbGVy KzB4MTFjLzB4MTUwClsgICswLjAwMDAwOF0gIGVsMHRfNjRfc3luYysweDE4Yy8weDE5MAoKWyAg KzAuMDAwMDE4XSBBbGxvY2F0ZWQgYnkgdGFzayAwOgpbICArMC4wMDAwMDddIChzdGFjayBpcyBu b3QgYXZhaWxhYmxlKQoKWyAgKzAuMDAwMDExXSBGcmVlZCBieSB0YXNrIDI2OTU6ClsgICswLjAw MDAwOF0gIGthc2FuX3NhdmVfc3RhY2srMHgyYy8weDVjClsgICswLjAwMDAxMV0gIGthc2FuX3Nl dF90cmFjaysweDJjLzB4NDAKWyAgKzAuMDAwMDA4XSAga2FzYW5fc2V0X2ZyZWVfaW5mbysweDI4 LzB4NTAKWyAgKzAuMDAwMDA5XSAgX19fX2thc2FuX3NsYWJfZnJlZSsweDEyOC8weDFkNApbICAr MC4wMDAwMDhdICBfX2thc2FuX3NsYWJfZnJlZSsweDE4LzB4MjQKWyAgKzAuMDAwMDA3XSAgc2xh Yl9mcmVlX2ZyZWVsaXN0X2hvb2srMHgxMDgvMHgyMzAKWyAgKzAuMDAwMDExXSAga2ZyZWUrMHgx MTAvMHgzNWMKWyAgKzAuMDAwMDA4XSAgcmVsZWFzZV9ub2RlcysweGYwLzB4MTZjClsgICswLjAw MDAwOV0gIGRldnJlc19yZWxlYXNlX2dyb3VwKzB4MTgwLzB4MjcwClsgICswLjAwMDAwOF0gIGNv bXBvbmVudF91bmJpbmQrMHgxMjgvMHgxZTAKWyAgKzAuMDAwMDEwXSAgY29tcG9uZW50X3VuYmlu ZF9hbGwrMHgxYjgvMHgyNjQKWyAgKzAuMDAwMDA5XSAgbWVzb25fZHJ2X3VuYmluZCsweDFhMC8w eDJhYyBbbWVzb25fZHJtXQpbICArMC4wMDAwMjVdICB0YWtlX2Rvd25fYWdncmVnYXRlX2Rldmlj ZSsweGIwLzB4MTYwClsgICswLjAwMDAwOV0gIGNvbXBvbmVudF9kZWwrMHgxOGMvMHgzNjAKWyAg KzAuMDAwMDA5XSAgbWVzb25fZHdfaGRtaV9yZW1vdmUrMHgyOC8weDQwIFttZXNvbl9kd19oZG1p XQpbICArMC4wMDAwMTJdICBwbGF0Zm9ybV9yZW1vdmUrMHg2NC8weGIwClsgICswLjAwMDAwOF0g IGRldmljZV9yZW1vdmUrMHhiOC8weDE1NApbICArMC4wMDAwMDldICBkZXZpY2VfcmVsZWFzZV9k cml2ZXJfaW50ZXJuYWwrMHgzOTgvMHg1YjAKWyAgKzAuMDAwMDA5XSAgZHJpdmVyX2RldGFjaCsw eGFjLzB4MWIwClsgICswLjAwMDAwOV0gIGJ1c19yZW1vdmVfZHJpdmVyKzB4MTU4LzB4MjljClsg ICswLjAwMDAwOF0gIGRyaXZlcl91bnJlZ2lzdGVyKzB4NzAvMHhiMApbICArMC4wMDAwMDhdICBw bGF0Zm9ybV9kcml2ZXJfdW5yZWdpc3RlcisweDIwLzB4MmMKWyAgKzAuMDAwMDA4XSAgbWVzb25f ZHdfaGRtaV9wbGF0Zm9ybV9kcml2ZXJfZXhpdCsweDFjLzB4MzAgW21lc29uX2R3X2hkbWldClsg ICswLjAwMDAxMV0gIF9fZG9fc3lzX2RlbGV0ZV9tb2R1bGUrMHgyODgvMHg0MDAKWyAgKzAuMDAw MDEwXSAgX19hcm02NF9zeXNfZGVsZXRlX21vZHVsZSsweDVjLzB4ODAKWyAgKzAuMDAwMDA4XSAg aW52b2tlX3N5c2NhbGwrMHg3NC8weDI2MApbICArMC4wMDAwMDhdICBlbDBfc3ZjX2NvbW1vbi5j b25zdHByb3AuMCsweGNjLzB4MjYwClsgICswLjAwMDAwOF0gIGRvX2VsMF9zdmMrMHg1MC8weDcw ClsgICswLjAwMDAwN10gIGVsMF9zdmMrMHg2OC8weDFhMApbICArMC4wMDAwMDldICBlbDB0XzY0 X3N5bmNfaGFuZGxlcisweDExYy8weDE1MApbICArMC4wMDAwMDldICBlbDB0XzY0X3N5bmMrMHgx OGMvMHgxOTAKClsgICswLjAwMDAxNF0gVGhlIGJ1Z2d5IGFkZHJlc3MgYmVsb25ncyB0byB0aGUg b2JqZWN0IGF0IGZmZmYwMDAwMjBjMzkwMDAKICAgICAgICAgICAgICAgd2hpY2ggYmVsb25ncyB0 byB0aGUgY2FjaGUga21hbGxvYy00ayBvZiBzaXplIDQwOTYKWyAgKzAuMDAwMDA4XSBUaGUgYnVn Z3kgYWRkcmVzcyBpcyBsb2NhdGVkIDE1MDQgYnl0ZXMgaW5zaWRlIG9mCiAgICAgICAgICAgICAg IDQwOTYtYnl0ZSByZWdpb24gW2ZmZmYwMDAwMjBjMzkwMDAsIGZmZmYwMDAwMjBjM2EwMDApCgpb ICArMC4wMDAwMTZdIFRoZSBidWdneSBhZGRyZXNzIGJlbG9uZ3MgdG8gdGhlIHBoeXNpY2FsIHBh Z2U6ClsgICswLjAwMDAwOV0gcGFnZTpmZmZmZmMwMDAwODMwZTAwIHJlZmNvdW50OjEgbWFwY291 bnQ6MCBtYXBwaW5nOjAwMDAwMDAwMDAwMDAwMDAgaW5kZXg6MHgwIHBmbjoweDIwYzM4ClsgICsw LjAwMDAxM10gaGVhZDpmZmZmZmMwMDAwODMwZTAwIG9yZGVyOjMgY29tcG91bmRfbWFwY291bnQ6 MCBjb21wb3VuZF9waW5jb3VudDowClsgICswLjAwMDAwOF0gZmxhZ3M6IDB4ZmZmZjAwMDAwMDEw MjAwKHNsYWJ8aGVhZHxub2RlPTB8em9uZT0wfGxhc3RjcHVwaWQ9MHhmZmZmKQpbICArMC4wMDAw MTldIHJhdzogMGZmZmYwMDAwMDAxMDIwMCBmZmZmZmMwMDAwZmQ0ODA4IGZmZmZmYzAwMDAxMjYy MDggZmZmZjAwMDAwMDAwMmU4MApbICArMC4wMDAwMDldIHJhdzogMDAwMDAwMDAwMDAwMDAwMCAw MDAwMDAwMDAwMDIwMDAyIDAwMDAwMDAxZmZmZmZmZmYgMDAwMDAwMDAwMDAwMDAwMApbICArMC4w MDAwMDhdIHBhZ2UgZHVtcGVkIGJlY2F1c2U6IGthc2FuOiBiYWQgYWNjZXNzIGRldGVjdGVkCgpb ICArMC4wMDAwMTFdIE1lbW9yeSBzdGF0ZSBhcm91bmQgdGhlIGJ1Z2d5IGFkZHJlc3M6ClsgICsw LjAwMDAwOF0gIGZmZmYwMDAwMjBjMzk0ODA6IGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZi IGZiIGZiIGZiIGZiIGZiIGZiClsgICswLjAwMDAwN10gIGZmZmYwMDAwMjBjMzk1MDA6IGZiIGZi IGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiClsgICswLjAwMDAwN10g PmZmZmYwMDAwMjBjMzk1ODA6IGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZi IGZiIGZiIGZiClsgICswLjAwMDAwN10gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIF4KWyAgKzAuMDAwMDA3XSAgZmZmZjAwMDAyMGMzOTYwMDog ZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIKWyAgKzAuMDAw MDA3XSAgZmZmZjAwMDAyMGMzOTY4MDogZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIg ZmIgZmIgZmIgZmIgZmIKWyAgKzAuMDAwMDA2XSA9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KClRoZSByZWFzb24gdGhpcyBp cyBoYXBwZW5pbmcgaXMgdW5sb2FkaW5nIG1lc29uLWR3LWhkbWkgd2lsbCBjYXVzZSB0aGUKY29t cG9uZW50IEFQSSB0byB0YWtlIGRvd24gdGhlIGFnZ3JlZ2F0ZSBkZXZpY2UsIHdoaWNoIGluIHR1 cm4gd2lsbCBjYXVzZQphbGwgZGV2cmVzLW1hbmFnZWQgbWVtb3J5IHRvIGJlIGZyZWVkLCBpbmNs dWRpbmcgdGhlIHN0cnVjdCBkd19oZG1pCmFsbG9jYXRlZCBpbiBkd19oZG1pX3Byb2JlLiBUaGlz IHN0cnVjdCBlbWJlZHMgYSBzdHJ1Y3QgZHJtX2JyaWRnZSB0aGF0IGlzCmFkZGVkIGF0IHRoZSBl bmQgb2YgdGhlIGZ1bmN0aW9uLCBhbmQgd2hpY2ggaXMgbGF0ZXIgb24gcGlja2VkIHVwIGluCm1l c29uX2VuY29kZXJfaGRtaV9pbml0LgoKSG93ZXZlciwgd2hlbiBhdHRhY2hpbmcgdGhlIGJyaWRn ZSB0byB0aGUgZW5jb2RlciBjcmVhdGVkIGluCm1lc29uX2VuY29kZXJfaGRtaV9pbml0LCBpdCdz IGxpbmtlZCB0byB0aGUgZW5jb2RlcidzIGJyaWRnZSBjaGFpbiwgZnJvbQp3aGVyZSBpdCBuZXZl ciBsZWF2ZXMsIGV2ZW4gYWZ0ZXIgZGV2cmVzX3JlbGVhc2VfZ3JvdXAgaXMgY2FsbGVkIHdoZW4g dGhlCmRyaXZlcidzIGNvbXBvbmVudHMgYXJlIHVuYm91bmQgYW5kIHRoZSBlbWJlZGRpbmcgc3Ry dWN0dXJlIGZyZWVkLgoKVGhlbiwgd2hlbiBjYWxsaW5nIGRybV9kZXZfcHV0IGluIHRoZSBhZ2dy ZWdhdGUgZHJpdmVyJ3MgdW5iaW5kIGZ1bmN0aW9uLApkcm1fYnJpZGdlX2RldGFjaCBpcyBjYWxs ZWQgZm9yIGV2ZXJ5IHNpbmdsZSBicmlkZ2UgbGlua2VkIHRvIHRoZSBlbmNvZGVyLAppbmNsdWRp bmcgdGhlIG9uZSB3aG9zZSBtZW1vcnkgaGFkIGFscmVhZHkgYmVlbiBkZWFsbG9jYXRlZC4KCkZp eCBieSBjYWxsaW5nIGNvbXBvbmVudF91bmJpbmRfYWxsIGFmdGVyIGRybV9kZXZfcHV0LgoKU2ln bmVkLW9mZi1ieTogQWRyacOhbiBMYXJ1bWJlIDxhZHJpYW4ubGFydW1iZUBjb2xsYWJvcmEuY29t PgpSZXZpZXdlZC1ieTogTmVpbCBBcm1zdHJvbmcgPG5laWwuYXJtc3Ryb25nQGxpbmFyby5vcmc+ ClNpZ25lZC1vZmYtYnk6IE5laWwgQXJtc3Ryb25nIDxuZWlsLmFybXN0cm9uZ0BsaW5hcm8ub3Jn PgpMaW5rOiBodHRwczovL3BhdGNod29yay5mcmVlZGVza3RvcC5vcmcvcGF0Y2gvbXNnaWQvMjAy MjA5MTkwMTA5NDAuNDE5ODkzLTItYWRyaWFuLmxhcnVtYmVAY29sbGFib3JhLmNvbQpTaWduZWQt b2ZmLWJ5OiBTYXNoYSBMZXZpbiA8c2FzaGFsQGtlcm5lbC5vcmc+Ci0tLQogZHJpdmVycy9ncHUv ZHJtL21lc29uL21lc29uX2Rydi5jIHwgMiArLQogMSBmaWxlIGNoYW5nZWQsIDEgaW5zZXJ0aW9u KCspLCAxIGRlbGV0aW9uKC0pCgpkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL21lc29uL21l c29uX2Rydi5jIGIvZHJpdmVycy9ncHUvZHJtL21lc29uL21lc29uX2Rydi5jCmluZGV4IGJkNGNh MTFkM2ZmNS4uN2RmMTQ5ZDQyNzI4IDEwMDY0NAotLS0gYS9kcml2ZXJzL2dwdS9kcm0vbWVzb24v bWVzb25fZHJ2LmMKKysrIGIvZHJpdmVycy9ncHUvZHJtL21lc29uL21lc29uX2Rydi5jCkBAIC0z ODgsOSArMzg4LDkgQEAgc3RhdGljIHZvaWQgbWVzb25fZHJ2X3VuYmluZChzdHJ1Y3QgZGV2aWNl ICpkZXYpCiAJZHJtX2Rldl91bnJlZ2lzdGVyKGRybSk7CiAJZHJtX2ttc19oZWxwZXJfcG9sbF9m aW5pKGRybSk7CiAJZHJtX2F0b21pY19oZWxwZXJfc2h1dGRvd24oZHJtKTsKLQljb21wb25lbnRf dW5iaW5kX2FsbChkZXYsIGRybSk7CiAJZnJlZV9pcnEocHJpdi0+dnN5bmNfaXJxLCBkcm0pOwog CWRybV9kZXZfcHV0KGRybSk7CisJY29tcG9uZW50X3VuYmluZF9hbGwoZGV2LCBkcm0pOwogCiAJ aWYgKHByaXYtPmFmYmNkLm9wcykKIAkJcHJpdi0+YWZiY2Qub3BzLT5leGl0KHByaXYpOwotLSAK Mi4zNS4xCgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K bGludXgtYXJtLWtlcm5lbCBtYWlsaW5nIGxpc3QKbGludXgtYXJtLWtlcm5lbEBsaXN0cy5pbmZy YWRlYWQub3JnCmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8vbGlu dXgtYXJtLWtlcm5lbAo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 791EFC4332F for ; Sun, 9 Oct 2022 23:51:47 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 231D410E565; Sun, 9 Oct 2022 23:51:46 +0000 (UTC) Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by gabe.freedesktop.org (Postfix) with ESMTPS id 4902F10E562 for ; Sun, 9 Oct 2022 23:51:42 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B623060D3D; Sun, 9 Oct 2022 23:51:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B5C8C43147; Sun, 9 Oct 2022 23:51:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1665359501; bh=5aAshN+FiXLo+cw/dQPsDHOuHlVtKNPBBkoCEdY0WK8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PRnFc19TCmMo/xZm6LhwwjqxKj8d6jLglGmw52i46lOKPtQb/cDiE3iPGi+371SRn cEHI/cAsFCAjH2vN9erjixXvPrDJ618mBQ9ZEMNCev4azjPKL2fS85qBmNeEMhsQiI U7gXBwiE/N2GhnLMEGJDLOQpxfnjrQbKZsUfh1R900U6nfFnYjv99o+kclDEFyUxNf 5vcLlWLUi534+MvAlhqQ9QCwM8iuoVqOEQtzoMHlQobWsY+fRuu32MKvA40M43Iedo KsENwfwsgF0+AuJr5QDrgib1DCbYCsv+4kXuazC7fv6ata4klrYe82p0+4R6hK7u3U /NnR6MaCzfKxw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH AUTOSEL 6.0 35/44] drm/meson: reorder driver deinit sequence to fix use-after-free bug Date: Sun, 9 Oct 2022 19:49:23 -0400 Message-Id: <20221009234932.1230196-35-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221009234932.1230196-1-sashal@kernel.org> References: <20221009234932.1230196-1-sashal@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sasha Levin , Neil Armstrong , khilman@baylibre.com, =?UTF-8?q?Adri=C3=A1n=20Larumbe?= , dri-devel@lists.freedesktop.org, linux-amlogic@lists.infradead.org, linux-arm-kernel@lists.infradead.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" From: Adrián Larumbe [ Upstream commit 31c519981eb141c7ec39bfd5be25d35f02edb868 ] Unloading the driver triggers the following KASAN warning: [ +0.006275] ============================================================= [ +0.000029] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0x1a0 [ +0.000026] Read of size 8 at addr ffff000020c395e0 by task rmmod/2695 [ +0.000019] CPU: 5 PID: 2695 Comm: rmmod Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1 [ +0.000013] Hardware name: Hardkernel ODROID-N2Plus (DT) [ +0.000008] Call trace: [ +0.000007] dump_backtrace+0x1ec/0x280 [ +0.000013] show_stack+0x24/0x80 [ +0.000008] dump_stack_lvl+0x98/0xd4 [ +0.000011] print_address_description.constprop.0+0x80/0x520 [ +0.000011] print_report+0x128/0x260 [ +0.000007] kasan_report+0xb8/0xfc [ +0.000008] __asan_report_load8_noabort+0x3c/0x50 [ +0.000010] __list_del_entry_valid+0xe0/0x1a0 [ +0.000009] drm_atomic_private_obj_fini+0x30/0x200 [drm] [ +0.000172] drm_bridge_detach+0x94/0x260 [drm] [ +0.000145] drm_encoder_cleanup+0xa4/0x290 [drm] [ +0.000144] drm_mode_config_cleanup+0x118/0x740 [drm] [ +0.000143] drm_mode_config_init_release+0x1c/0x2c [drm] [ +0.000144] drm_managed_release+0x170/0x414 [drm] [ +0.000142] drm_dev_put.part.0+0xc0/0x124 [drm] [ +0.000143] drm_dev_put+0x20/0x30 [drm] [ +0.000142] meson_drv_unbind+0x1d8/0x2ac [meson_drm] [ +0.000028] take_down_aggregate_device+0xb0/0x160 [ +0.000016] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000015] platform_remove+0x64/0xb0 [ +0.000009] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000009] driver_unregister+0x70/0xb0 [ +0.000008] platform_driver_unregister+0x20/0x2c [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000012] __do_sys_delete_module+0x288/0x400 [ +0.000011] __arm64_sys_delete_module+0x5c/0x80 [ +0.000009] invoke_syscall+0x74/0x260 [ +0.000009] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000009] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000012] el0t_64_sync_handler+0x11c/0x150 [ +0.000008] el0t_64_sync+0x18c/0x190 [ +0.000018] Allocated by task 0: [ +0.000007] (stack is not available) [ +0.000011] Freed by task 2695: [ +0.000008] kasan_save_stack+0x2c/0x5c [ +0.000011] kasan_set_track+0x2c/0x40 [ +0.000008] kasan_set_free_info+0x28/0x50 [ +0.000009] ____kasan_slab_free+0x128/0x1d4 [ +0.000008] __kasan_slab_free+0x18/0x24 [ +0.000007] slab_free_freelist_hook+0x108/0x230 [ +0.000011] kfree+0x110/0x35c [ +0.000008] release_nodes+0xf0/0x16c [ +0.000009] devres_release_group+0x180/0x270 [ +0.000008] component_unbind+0x128/0x1e0 [ +0.000010] component_unbind_all+0x1b8/0x264 [ +0.000009] meson_drv_unbind+0x1a0/0x2ac [meson_drm] [ +0.000025] take_down_aggregate_device+0xb0/0x160 [ +0.000009] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000012] platform_remove+0x64/0xb0 [ +0.000008] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000008] driver_unregister+0x70/0xb0 [ +0.000008] platform_driver_unregister+0x20/0x2c [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000011] __do_sys_delete_module+0x288/0x400 [ +0.000010] __arm64_sys_delete_module+0x5c/0x80 [ +0.000008] invoke_syscall+0x74/0x260 [ +0.000008] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000008] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000009] el0t_64_sync_handler+0x11c/0x150 [ +0.000009] el0t_64_sync+0x18c/0x190 [ +0.000014] The buggy address belongs to the object at ffff000020c39000 which belongs to the cache kmalloc-4k of size 4096 [ +0.000008] The buggy address is located 1504 bytes inside of 4096-byte region [ffff000020c39000, ffff000020c3a000) [ +0.000016] The buggy address belongs to the physical page: [ +0.000009] page:fffffc0000830e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20c38 [ +0.000013] head:fffffc0000830e00 order:3 compound_mapcount:0 compound_pincount:0 [ +0.000008] flags: 0xffff00000010200(slab|head|node=0|zone=0|lastcpupid=0xffff) [ +0.000019] raw: 0ffff00000010200 fffffc0000fd4808 fffffc0000126208 ffff000000002e80 [ +0.000009] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ +0.000008] page dumped because: kasan: bad access detected [ +0.000011] Memory state around the buggy address: [ +0.000008] ffff000020c39480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ffff000020c39500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] >ffff000020c39580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ^ [ +0.000007] ffff000020c39600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ffff000020c39680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000006] ================================================================== The reason this is happening is unloading meson-dw-hdmi will cause the component API to take down the aggregate device, which in turn will cause all devres-managed memory to be freed, including the struct dw_hdmi allocated in dw_hdmi_probe. This struct embeds a struct drm_bridge that is added at the end of the function, and which is later on picked up in meson_encoder_hdmi_init. However, when attaching the bridge to the encoder created in meson_encoder_hdmi_init, it's linked to the encoder's bridge chain, from where it never leaves, even after devres_release_group is called when the driver's components are unbound and the embedding structure freed. Then, when calling drm_dev_put in the aggregate driver's unbind function, drm_bridge_detach is called for every single bridge linked to the encoder, including the one whose memory had already been deallocated. Fix by calling component_unbind_all after drm_dev_put. Signed-off-by: Adrián Larumbe Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220919010940.419893-2-adrian.larumbe@collabora.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/meson/meson_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c index bd4ca11d3ff5..7df149d42728 100644 --- a/drivers/gpu/drm/meson/meson_drv.c +++ b/drivers/gpu/drm/meson/meson_drv.c @@ -388,9 +388,9 @@ static void meson_drv_unbind(struct device *dev) drm_dev_unregister(drm); drm_kms_helper_poll_fini(drm); drm_atomic_helper_shutdown(drm); - component_unbind_all(dev, drm); free_irq(priv->vsync_irq, drm); drm_dev_put(drm); + component_unbind_all(dev, drm); if (priv->afbcd.ops) priv->afbcd.ops->exit(priv); -- 2.35.1