linux-kernel - Re: [PATCH 1/2] drm/tegra: Get ref for DP AUX channel, not its ddc adapter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 26 Apr 2021 09:42:24 +0200
From:   Thierry Reding <thierry.reding@...il.com>
To:     Lyude Paul <lyude@...hat.com>
Cc:     linux-tegra@...r.kernel.org, dri-devel@...ts.freedesktop.org,
        Thierry Reding <treding@...dia.com>,
        Ville Syrjälä <ville.syrjala@...ux.intel.com>,
        Jonathan Hunter <jonathanh@...dia.com>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/2] drm/tegra: Get ref for DP AUX channel, not its ddc
 adapter

On Fri, Apr 23, 2021 at 02:21:45PM -0400, Lyude Paul wrote:
> While we're taking a reference of the DDC adapter for a DP AUX channel in
> tegra_sor_probe() because we're going to be using that adapter with the
> SOR, now that we've moved where AUX registration happens the actual device
> structure for the DDC adapter isn't initialized yet. Which means that we
> can't really take a reference from it to try to keep it around anymore.
> 
> This should be fine though, because we can just take a reference of its
> parent instead.
> 
> Signed-off-by: Lyude Paul <lyude@...hat.com>
> Fixes: 39c17ae60ea9 ("drm/tegra: Don't register DP AUX channels before connectors")
> Cc: Lyude Paul <lyude@...hat.com>
> Cc: Thierry Reding <thierry.reding@...il.com>
> Cc: Jonathan Hunter <jonathanh@...dia.com>
> Cc: dri-devel@...ts.freedesktop.org
> Cc: linux-tegra@...r.kernel.org
> ---
>  drivers/gpu/drm/tegra/sor.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
> index 7b88261f57bb..4e0e3a63e586 100644
> --- a/drivers/gpu/drm/tegra/sor.c
> +++ b/drivers/gpu/drm/tegra/sor.c
> @@ -3739,11 +3739,11 @@ static int tegra_sor_probe(struct platform_device *pdev)
>  		if (!sor->aux)
>  			return -EPROBE_DEFER;
>  
> -		if (get_device(&sor->aux->ddc.dev)) {
> -			if (try_module_get(sor->aux->ddc.owner))
> +		if (get_device(sor->aux->dev)) {
> +			if (try_module_get(sor->aux->dev->driver->owner))
>  				sor->output.ddc = &sor->aux->ddc;
>  			else
> -				put_device(&sor->aux->ddc.dev);
> +				put_device(sor->aux->dev);
>  		}
>  	}

Unfortunately, I think it's a bit more subtle than that. The reason for
this get_device()/try_module_get() dance was to mirror the behaviour of
of_get_i2c_adapter_by_node() so that when we call i2c_put_adapter() in
tegra_output_remove() we correctly decrease the reference count.

The above will increase the reference on the I2C adapter's parent while
i2c_put_adapter() will then only decrease the reference on the I2C
adapter, so I think effectively we'd be leaking a reference to the I2C
adapter's parent.

Also, since we didn't take a reference on the I2C adapter explicitly,
releasing that reference in tegra_output_remove() might free the I2C
adapter too early.

I wonder if perhaps it'd be easier to get rid of the struct tegra_output
abstraction altogether and push this down into the individual drivers,
even if that means a bit more code duplication. That's not the kind of
quick fix to resolve this current situation, so perhaps as a stop-gap we
just need to sprinkle a few more conditionals throughout tegra_output
code. We could, for example, avoid calling i2c_put_adapter() in
tegra_output_remove() for the DisplayPort cases and instead manually
release the reference to the I2C adapter's parent in tegra_sor_remove().
On top of your patch above that /should/ fix things properly for now.

Thierry

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)