From patchwork Tue Oct 30 13:26:25 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Sasha Levin X-Patchwork-Id: 149747 Delivered-To: patch@linaro.org Received: by 2002:a2e:299d:0:0:0:0:0 with SMTP id p29-v6csp5460830ljp; Tue, 30 Oct 2018 06:27:10 -0700 (PDT) X-Google-Smtp-Source: AJdET5fhOeGt0xUTOaHd0bt02MzvmPoKBuVgbZ81okyx2PDLlJprMjG9/RofAUYO3Qw73zSHxqXv X-Received: by 2002:a17:902:930b:: with SMTP id bc11-v6mr19095831plb.101.1540906030186; Tue, 30 Oct 2018 06:27:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1540906030; cv=none; d=google.com; s=arc-20160816; b=r+WPsBOYob389PlgaRm2sacdZPRxqkllXqk3UnaIcBAMy6HmwlO5uFQ0hEPwgayPJG gOoXo3egNB45rHEZgk29tgnmNYPgrO6PqfaLYcEew8ADT4iaUIhcMNoy7UrpnbUY82R7 9G5UQyJt/jWg/7IdgX8Sx84IstuvNYxd5GehmR5h7RLM0p7oGcowT1Z33M8bwXusBZ2z rHYDMg99+tg4+nqqF/xYnUVlT12/IVcQewj6dnrNnLyncF4In30bL+Cottxf3f64NeL6 cAyex+4zB6mZqsyKhHbvpQjDyFTYH2+HeHO21zajehpA+vnxztXE9dtjl1s/WDnVXVI6 0qkg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=lt/lWnbJc3q5tLJDGWAxBDfgpuPp4kxqDYFFpqw4MXA=; b=ahkzGfg5oaiUPmENrfVAHxb8GIeTTdjmUozYJIjjUD/A7nbF2y5gWaQcGs6o3yPUUM rNEDVYqTstnU9A0fTLi3ZcxkVKjXfBzsYqfn6qOyQpZcQDne5k/0EzZb5/cKhrb+q695 /EtYDCINiYblwNFpoux0PdtOb7aTOAwgLLObvx9Awlc47ezJBof0Z7z/d4tyscB6VE/B yl+yluoNNdPrfkn0CMFG2+KxIdBdZN+O4NSYFYOwR6jx+E2F3EvI5eaYL6CRpsUb509o HB+otLHcxyqfQKQ0pRhP/W/zcoEnWyHqFcN+AVrOOLrIc7iDUsEtaL2R+cEDSvvX4a6l 4Pmg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=fF8d9uuu; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id f66-v6si24196830pfc.35.2018.10.30.06.27.07; Tue, 30 Oct 2018 06:27:10 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=fF8d9uuu; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728014AbeJ3WUe (ORCPT + 15 others); Tue, 30 Oct 2018 18:20:34 -0400 Received: from mail.kernel.org ([198.145.29.99]:51422 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727576AbeJ3WUe (ORCPT ); Tue, 30 Oct 2018 18:20:34 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A839F2075D; Tue, 30 Oct 2018 13:27:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1540906026; bh=qvTMp9NME4T1wpuT2GnKguX55scpDm65r+lRvZMiHHo=; h=From:To:Cc:Subject:Date:From; b=fF8d9uuujVW92iU4s8EBRUe1+6TI4ISDyjINRB1cL5tx335dCDiZRl2TwLp3SrH/W 6RDYihbmO+lAxvAAJ86e7ImKbjV99y3Iyc+09ATetnMsQFs6TCCFwbM4nL75ChkzqQ TaD+NYvOzT/cWRLeLDcj6N1emn0CkZrA+CRf72C0= From: Sasha Levin To: stable@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Tomi Valkeinen , Sasha Levin Subject: [PATCH AUTOSEL 4.18 01/33] drm: fix use of freed memory in drm_mode_setcrtc Date: Tue, 30 Oct 2018 09:26:25 -0400 Message-Id: <20181030132657.217970-1-sashal@kernel.org> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tomi Valkeinen [ Upstream commit 064253c1c0625efd0362a0b7ecdbe8bee2a2904d ] drm_mode_setcrtc() retries modesetting in case one of the functions it calls returns -EDEADLK. connector_set, mode and fb are freed before retrying, but they are not set to NULL. This can cause drm_mode_setcrtc() to use those variables. For example: On the first try __drm_mode_set_config_internal() returns -EDEADLK. connector_set, mode and fb are freed. Next retry starts, and drm_modeset_lock_all_ctx() returns -EDEADLK, and we jump to 'out'. The code will happily try to release all three again. This leads to crashes of different kinds, depending on the sequence the EDEADLKs happen. Fix this by setting the three variables to NULL at the start of the retry loop. Signed-off-by: Tomi Valkeinen Reviewed-by: Ville Syrjälä Reviewed-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20180917110054.4053-1-tomi.valkeinen@ti.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/drm_crtc.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) -- 2.17.1 diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index 98a36e6c69ad..bd207857a964 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -560,9 +560,9 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, struct drm_mode_crtc *crtc_req = data; struct drm_crtc *crtc; struct drm_plane *plane; - struct drm_connector **connector_set = NULL, *connector; - struct drm_framebuffer *fb = NULL; - struct drm_display_mode *mode = NULL; + struct drm_connector **connector_set, *connector; + struct drm_framebuffer *fb; + struct drm_display_mode *mode; struct drm_mode_set set; uint32_t __user *set_connectors_ptr; struct drm_modeset_acquire_ctx ctx; @@ -591,6 +591,10 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, mutex_lock(&crtc->dev->mode_config.mutex); drm_modeset_acquire_init(&ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE); retry: + connector_set = NULL; + fb = NULL; + mode = NULL; + ret = drm_modeset_lock_all_ctx(crtc->dev, &ctx); if (ret) goto out;