All of lore.kernel.org
 help / color / mirror / Atom feed
* [Intel-gfx] [PATCH v2] drm/i915/display: Fix a use-after-free when intel_edp_init_connector fails
@ 2023-05-29 11:38 Jani Nikula
  2023-05-31  0:52 ` [Intel-gfx] ✗ Fi.CI.BAT: failure for drm/i915/display: Fix a use-after-free when intel_edp_init_connector fails (rev2) Patchwork
  2023-06-02 17:43 ` [Intel-gfx] [PATCH v2] drm/i915/display: Fix a use-after-free when intel_edp_init_connector fails Jani Nikula
  0 siblings, 2 replies; 3+ messages in thread
From: Jani Nikula @ 2023-05-29 11:38 UTC (permalink / raw)
  To: intel-gfx; +Cc: jani.nikula

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>

We enable the DP aux channel during probe, but may free the connector
soon afterwards. Ensure the DP aux display power put (and any other
async put for that matter) is completed before everything is freed, to
prevent a use-after-free in icl_aux_pw_to_phy(), called from
icl_combo_phy_aux_power_well_disable.

v2 by Jani:
- do a regular flush before freeing dig_port

Cc: Imre Deak <imre.deak@intel.com>
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>

---

v2 of https://patchwork.freedesktop.org/patch/msgid/20221220094618.207126-1-maarten.lankhorst@linux.intel.com

The encoder cleanup paths could use some cleanup and unification, but do
what's needed here.
---
 drivers/gpu/drm/i915/display/g4x_dp.c    | 2 ++
 drivers/gpu/drm/i915/display/intel_ddi.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/g4x_dp.c b/drivers/gpu/drm/i915/display/g4x_dp.c
index 112d91d81fdc..e8147c18fa93 100644
--- a/drivers/gpu/drm/i915/display/g4x_dp.c
+++ b/drivers/gpu/drm/i915/display/g4x_dp.c
@@ -1379,6 +1379,8 @@ bool g4x_dp_init(struct drm_i915_private *dev_priv,
 	return true;
 
 err_init_connector:
+	/* aync put accesses the dig_port, ensure it's done before free */
+	intel_display_power_flush_work(dev_priv);
 	drm_encoder_cleanup(encoder);
 err_encoder_init:
 	kfree(intel_connector);
diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c
index d1a9a3cf94b5..dfa1c44dc442 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi.c
@@ -4971,6 +4971,8 @@ void intel_ddi_init(struct drm_i915_private *dev_priv, enum port port)
 	return;
 
 err:
+	/* aync put accesses the dig_port, ensure it's done before free */
+	intel_display_power_flush_work(dev_priv);
 	drm_encoder_cleanup(&encoder->base);
 	kfree(dig_port);
 }
-- 
2.39.2


^ permalink raw reply related	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-06-02 17:43 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-05-29 11:38 [Intel-gfx] [PATCH v2] drm/i915/display: Fix a use-after-free when intel_edp_init_connector fails Jani Nikula
2023-05-31  0:52 ` [Intel-gfx] ✗ Fi.CI.BAT: failure for drm/i915/display: Fix a use-after-free when intel_edp_init_connector fails (rev2) Patchwork
2023-06-02 17:43 ` [Intel-gfx] [PATCH v2] drm/i915/display: Fix a use-after-free when intel_edp_init_connector fails Jani Nikula

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.