From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8236AC433EF for ; Wed, 17 Nov 2021 09:45:48 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 48E4961A52 for ; Wed, 17 Nov 2021 09:45:48 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 48E4961A52 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=cerno.tech Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 620466E92D; Wed, 17 Nov 2021 09:45:43 +0000 (UTC) Received: from new2-smtp.messagingengine.com (new2-smtp.messagingengine.com [66.111.4.224]) by gabe.freedesktop.org (Postfix) with ESMTPS id 914896E9AE for ; Wed, 17 Nov 2021 09:45:41 +0000 (UTC) Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailnew.nyi.internal (Postfix) with ESMTP id EABB258082C; Wed, 17 Nov 2021 04:45:40 -0500 (EST) Received: from mailfrontend1 ([10.202.2.162]) by compute6.internal (MEProxy); Wed, 17 Nov 2021 04:45:40 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cerno.tech; h= from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; s=fm1; bh=fXxmxjVhepE3q cmVUCO3YDZGl3sBQb+VLzlC1ueEruI=; b=aV7TsN/agM/Qts4UAGFskyaoBOsl+ qpM+Pr7NF2zPCrOR6LE4lTdBDtPDenq/3YZu41bgwb3rwVnso4pBi38fdqAs9fbf ozV04fYANr4Ox5Sqwvig717Z7IcAYnAuGuG29KDS4PW7rc1nlp6IoHIxmrkvqd2h Ip04J7Qdqz5JS0EqNlW97NNf5lZnBt4bxrifAtNOW4kgvPZlbZJdUsz5sv66TTKt BaH8yt7X80nwUQm0yG+lhzbJZ7OL/VSZdsZoJlwRhDL8f6gKAZgBfug7z7fTe7K/ efn8sM24xCBvjxXP8IYKfSXGP8nLFbrqlfafX7gynTZv32cIuPevjMjHg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:date:from :in-reply-to:message-id:mime-version:references:subject:to :x-me-proxy:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm1; bh=fXxmxjVhepE3qcmVUCO3YDZGl3sBQb+VLzlC1ueEruI=; b=V8vFjbmb +QeklnjJp1n9iY08MqJVMi6a4CW2Sx6U9wnq3oHhHorx4U9RS9m5b6vYTWzDPHQb kw6S5HsKWIkdp/lDM2Ue8vHrnmLtiBv4VW6SgpIA1x0YK5aACCerPsjLNBjlB0MM /+Ns8p3Wm6wfPkvM/KN56qpRXSAg55nBqebD1+5REjEXCMmvVFxBpXpagYjFJv9j dcd/7mi9Ve44bJ5HL6yLGk9T8wCTRtIVEmNXJ4X1juDbZ1x2ugWCpB2dP5iFIvvz iVbfpGM+T0Mr6+z065NtGKaR+ATEVy9TE3DF1e1Kthw0AYuDosklL8EywxrzXgks kAER1tm3bB5O8A== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvuddrfeeggddtfecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpefhvffufffkofgjfhgggfestdekredtredttdenucfhrhhomhepofgrgihimhgv ucftihhprghrugcuoehmrgigihhmvgestggvrhhnohdrthgvtghhqeenucggtffrrghtth gvrhhnpedvkeelveefffekjefhffeuleetleefudeifeehuddugffghffhffehveevheeh vdenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmrg igihhmvgestggvrhhnohdrthgvtghh X-ME-Proxy: Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 17 Nov 2021 04:45:40 -0500 (EST) From: Maxime Ripard To: Maarten Lankhorst , Thomas Zimmermann , Maxime Ripard , Daniel Vetter , David Airlie Subject: [PATCH v2 4/6] drm/vc4: kms: Clear the HVS FIFO commit pointer once done Date: Wed, 17 Nov 2021 10:45:25 +0100 Message-Id: <20211117094527.146275-5-maxime@cerno.tech> X-Mailer: git-send-email 2.33.1 In-Reply-To: <20211117094527.146275-1-maxime@cerno.tech> References: <20211117094527.146275-1-maxime@cerno.tech> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Dom Cobley , Tim Gover , Dave Stevenson , Jian-Hong Pan , dri-devel@lists.freedesktop.org, Phil Elwell Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit") introduced a wait on the previous commit done on a given HVS FIFO. However, we never cleared that pointer once done. Since drm_crtc_commit_put can free the drm_crtc_commit structure directly if we were the last user, this means that it can lead to a use-after free if we were to duplicate the state, and that stale pointer would even be copied to the new state. Set the pointer to NULL once we're done with the wait so that we don't carry over a pointer to a free'd structure. Fixes: 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit") Signed-off-by: Maxime Ripard --- drivers/gpu/drm/vc4/vc4_kms.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c index 7c1d0c3beba2..f80370e87e98 100644 --- a/drivers/gpu/drm/vc4/vc4_kms.c +++ b/drivers/gpu/drm/vc4/vc4_kms.c @@ -379,6 +379,7 @@ static void vc4_atomic_commit_tail(struct drm_atomic_state *state) drm_err(dev, "Timed out waiting for commit\n"); drm_crtc_commit_put(commit); + old_hvs_state->fifo_state[channel].pending_commit = NULL; } if (vc4->hvs->hvs5) -- 2.33.1