linux-kernel - [PATCH] tda998x: Check ref count before invoking drm_connector

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1523544152-15241-1-git-send-email-ayan.halder@arm.com>
Date:   Thu, 12 Apr 2018 15:42:32 +0100
From:   Ayan Kumar Halder <ayan.halder@....com>
To:     ayan.halder@....com, liviu.dudau@....com, brian.starkey@....com,
        linux@...linux.org.uk, airlied@...ux.ie,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
        alexandru-cosmin.gheorghe@....com
Cc:     nd@....com
Subject: [PATCH] tda998x: Check ref count before invoking drm_connector_cleanup in unbind

In a situation when the reference count of the drm connector is greater than 1,
the unbind function should not invoke drm_connector_cleanup as this will lead
to an inconsistent state where the drm_crtc_state->connector_mask still has
a bitmask referring to the stale connector. Later, when drm driver invokes
drm_atomic_helper_shutdown() which invokes ---> drm_atomic_helper_disable_all()
 ---> drm_atomic_commit() --> drm_atomic_check_only() -->
drm_atomic_helper_check() --> drm_atomic_helper_check_modeset(). This returns
an error due to enabled/connectors mismatch.

In such a scenario, one should just return from _unbind() and let the drm driver
subsequently invoke drm_atomic_helper_shutdown. This will reset the
drm_crtc_state->connector_mask and will shutdown the crtcs. It will also decrement
the reference count of the connectors to 1. Subsequently, drm_mode_config_cleanup
will get invoked which will do the following :-

1. Decrement the reference count for each of the connectors. Thus the ref count
will reach 0 and drm_connector_funcs->destroy() gets called. Thus,
tda998x_connector_destroy() gets invoked which calls drm_connector_cleanup

2. Invokes the destroy callback for each encoder. Thus tda998x_encoder_destroy()
gets invoked.

Signed-off-by: Ayan Kumar Halder <ayan.halder@....com>
---
 drivers/gpu/drm/i2c/tda998x_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index 9e67a7b..8ad1cc7 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -1709,6 +1709,9 @@ static void tda998x_unbind(struct device *dev, struct device *master,
 {
 	struct tda998x_priv *priv = dev_get_drvdata(dev);
 
+	if (kref_read(&priv->connector.base.refcount) > 1)
+		return;
+
 	drm_connector_cleanup(&priv->connector);
 	drm_encoder_cleanup(&priv->encoder);
 	tda998x_destroy(priv);
-- 
2.7.4