From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f45.google.com ([74.125.82.45]:35808 "EHLO mail-wm0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753604AbbKQJyc (ORCPT ); Tue, 17 Nov 2015 04:54:32 -0500 Received: by wmdw130 with SMTP id w130so147055751wmd.0 for ; Tue, 17 Nov 2015 01:54:31 -0800 (PST) Date: Tue, 17 Nov 2015 10:54:28 +0100 From: Daniel Vetter To: Maarten Lankhorst Cc: dri-devel@lists.freedesktop.org, intel-gfx@lists.freedesktop.org, stable@vger.kernel.org Subject: Re: [PATCH 2/5] drm/core: Fix old_fb handling in drm_mode_atomic_ioctl. Message-ID: <20151117095415.GK16848@phenom.ffwll.local> References: <1447237751-9663-1-git-send-email-maarten.lankhorst@ubuntu.com> <1447237751-9663-3-git-send-email-maarten.lankhorst@ubuntu.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1447237751-9663-3-git-send-email-maarten.lankhorst@ubuntu.com> Sender: stable-owner@vger.kernel.org List-ID: On Wed, Nov 11, 2015 at 11:29:08AM +0100, Maarten Lankhorst wrote: > From: Maarten Lankhorst > > plane_mask should be cleared inside the retry loop, > because it gets reset on every retry. > > Signed-off-by: Maarten Lankhorst > Cc: stable@vger.kernel.org #v4.3 Nice catch, but a bit a terse commit message. We should add "Without this fix the plane->fb refcounting might get out of sync on retries, resulting in either leaked memory or use-after-free." With that: Reviewed-by: Daniel Vetter > --- > drivers/gpu/drm/drm_atomic.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c > index 7bb3845d9974..0ac31b1ecb67 100644 > --- a/drivers/gpu/drm/drm_atomic.c > +++ b/drivers/gpu/drm/drm_atomic.c > @@ -1446,7 +1446,7 @@ int drm_mode_atomic_ioctl(struct drm_device *dev, > struct drm_plane *plane; > struct drm_crtc *crtc; > struct drm_crtc_state *crtc_state; > - unsigned plane_mask = 0; > + unsigned plane_mask; > int ret = 0; > unsigned int i, j; > > @@ -1486,6 +1486,7 @@ int drm_mode_atomic_ioctl(struct drm_device *dev, > state->allow_modeset = !!(arg->flags & DRM_MODE_ATOMIC_ALLOW_MODESET); > > retry: > + plane_mask = 0; > copied_objs = 0; > copied_props = 0; > > -- > 2.1.0 > > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > http://lists.freedesktop.org/mailman/listinfo/dri-devel -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch