From: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
To: Imre Deak <imre.deak@intel.com>
Cc: intel-gfx@lists.freedesktop.org
Subject: Re: [PATCH] drm/i915: fix use after free during eDP encoder destroying
Date: Fri, 12 Dec 2014 19:06:24 +0200 [thread overview]
Message-ID: <20141212170624.GX10649@intel.com> (raw)
In-Reply-To: <1418399858-26849-1-git-send-email-imre.deak@intel.com>
On Fri, Dec 12, 2014 at 05:57:38PM +0200, Imre Deak wrote:
> After
>
> commit a18c0af171bfb875012da26f23df051004726973
> uthor: Thierry Reding <treding@nvidia.com>
> Date: Wed Dec 10 11:38:49 2014 +0100
>
> drm: Zero out DRM object memory upon cleanup
>
> we will use the eDP encoder during destroying it. Fix this by calling
> drm_encoder_cleanup() at a point when the encoder is not used any more.
> This caused a NULL pointer dereference in pps_lock(), I can't see that
> it caused any other problem.
>
> All the other encoders seem to call drm_encoder_cleanup() at a safe
> place.
>
> Signed-off-by: Imre Deak <imre.deak@intel.com>
drm_encoder_cleanup() doesn't appear to have any nasty side effects
so this looks sane.
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
> ---
> drivers/gpu/drm/i915/intel_dp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
> index 3fc3296..0a55623 100644
> --- a/drivers/gpu/drm/i915/intel_dp.c
> +++ b/drivers/gpu/drm/i915/intel_dp.c
> @@ -4310,7 +4310,6 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
>
> drm_dp_aux_unregister(&intel_dp->aux);
> intel_dp_mst_encoder_cleanup(intel_dig_port);
> - drm_encoder_cleanup(encoder);
> if (is_edp(intel_dp)) {
> cancel_delayed_work_sync(&intel_dp->panel_vdd_work);
> /*
> @@ -4326,6 +4325,7 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
> intel_dp->edp_notifier.notifier_call = NULL;
> }
> }
> + drm_encoder_cleanup(encoder);
> kfree(intel_dig_port);
> }
>
> --
> 1.8.4
>
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx
--
Ville Syrjälä
Intel OTC
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx
next prev parent reply other threads:[~2014-12-12 17:07 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-12-12 15:57 [PATCH] drm/i915: fix use after free during eDP encoder destroying Imre Deak
2014-12-12 17:06 ` Ville Syrjälä [this message]
2014-12-15 14:45 ` Daniel Vetter
2014-12-16 8:30 ` Thierry Reding
2014-12-14 5:51 ` shuang.he
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20141212170624.GX10649@intel.com \
--to=ville.syrjala@linux.intel.com \
--cc=imre.deak@intel.com \
--cc=intel-gfx@lists.freedesktop.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox