linux-kernel - Re: [WIP PATCH 06/15] drm/i915: Keep malloc references to MST ports

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ed0fbbed2a856e62134baa7ee88023d07f02f73c.camel@redhat.com>
Date:   Tue, 18 Dec 2018 16:52:24 -0500
From:   Lyude Paul <lyude@...hat.com>
To:     Daniel Vetter <daniel@...ll.ch>
Cc:     dri-devel@...ts.freedesktop.org, nouveau@...ts.freedesktop.org,
        intel-gfx@...ts.freedesktop.org, amd-gfx@...ts.freedesktop.org,
        Dave Airlie <airlied@...il.com>,
        Harry Wentland <harry.wentland@....com>,
        Jerry Zuo <Jerry.Zuo@....com>,
        Jani Nikula <jani.nikula@...ux.intel.com>,
        Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
        Rodrigo Vivi <rodrigo.vivi@...el.com>,
        David Airlie <airlied@...ux.ie>, linux-kernel@...r.kernel.org
Subject: Re: [WIP PATCH 06/15] drm/i915: Keep malloc references to MST ports

On Fri, 2018-12-14 at 10:32 +0100, Daniel Vetter wrote:
> On Thu, Dec 13, 2018 at 08:25:35PM -0500, Lyude Paul wrote:
> > So that the ports stay around until we've destroyed the connectors, in
> > order to ensure that we don't pass an invalid pointer to any MST helpers
> > once we introduce the new MST VCPI helpers.
> > 
> > Signed-off-by: Lyude Paul <lyude@...hat.com>
> > ---
> >  drivers/gpu/drm/i915/intel_connector.c | 4 ++++
> >  drivers/gpu/drm/i915/intel_dp_mst.c    | 2 ++
> >  2 files changed, 6 insertions(+)
> > 
> > diff --git a/drivers/gpu/drm/i915/intel_connector.c
> > b/drivers/gpu/drm/i915/intel_connector.c
> > index 18e370f607bc..37d2c644f4b8 100644
> > --- a/drivers/gpu/drm/i915/intel_connector.c
> > +++ b/drivers/gpu/drm/i915/intel_connector.c
> > @@ -95,6 +95,10 @@ void intel_connector_destroy(struct drm_connector
> > *connector)
> >  	intel_panel_fini(&intel_connector->panel);
> >  
> >  	drm_connector_cleanup(connector);
> > +
> > +	if (intel_connector->port)
> 
> We set this as the first thing in intel_dp_add_mst_connector, so this
> check isn't doing anything.

I think this comment might be a mistake? intel_connector_destroy() is shared
by all of the intel connectors, so some may not have a value in
intel_connector->port. I can move it to it's own destroy callback for MST if
you would prefer though.
> 
> > +		drm_dp_mst_put_port_malloc(intel_connector->port);
> > +
> >  	kfree(connector);
> >  }
> >  
> > diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c
> > b/drivers/gpu/drm/i915/intel_dp_mst.c
> > index f05427b74e34..4d6ced34d465 100644
> > --- a/drivers/gpu/drm/i915/intel_dp_mst.c
> > +++ b/drivers/gpu/drm/i915/intel_dp_mst.c
> > @@ -484,6 +484,8 @@ static struct drm_connector
> > *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
> >  	if (ret)
> >  		goto err;
> >  
> > +	drm_dp_mst_get_port_malloc(port);
> 
> Needs to be moved up where we assing intel_connector->port, or it'll
> underflow on cleanup on error paths.
> 
> > +
> >  	return connector;
> >  
> >  err:
> > -- 
> > 2.19.2
> > 
-- 
Cheers,
	Lyude Paul