linux-kernel - Re: [PATCH] drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 26 Apr 2022 03:05:51 +0300
From:   Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
To:     Vinod Polimera <quic_vpolimer@...cinc.com>,
        dri-devel@...ts.freedesktop.org, linux-arm-msm@...r.kernel.org,
        freedreno@...ts.freedesktop.org, devicetree@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, robdclark@...il.com,
        dianders@...omium.org, quic_kalyant@...cinc.com
Subject: Re: [PATCH] drm/msm/disp/dpu1: set vbif hw config to NULL to avoid
 use after memory free during pm runtime resume

On 25/04/2022 06:26, Vinod Polimera wrote:
> BUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3
> 
> Call trace:
>    dpu_vbif_init_memtypes+0x40/0xb8
>    dpu_runtime_resume+0xcc/0x1c0
>    pm_generic_runtime_resume+0x30/0x44
>    __genpd_runtime_resume+0x68/0x7c
>    genpd_runtime_resume+0x134/0x258
>    __rpm_callback+0x98/0x138
>    rpm_callback+0x30/0x88
>    rpm_resume+0x36c/0x49c
>    __pm_runtime_resume+0x80/0xb0
>    dpu_core_irq_uninstall+0x30/0xb0
>    dpu_irq_uninstall+0x18/0x24
>    msm_drm_uninit+0xd8/0x16c
> 
> Fixes: 25fdd5933e4 ("drm/msm: Add SDM845 DPU support")
> Signed-off-by: Vinod Polimera <quic_vpolimer@...cinc.com>

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>

Let's merge this fix now. However I think that a proper solution would 
be to disable pm_runtime once we are in the uninit path.

> ---
>   drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
> index 9c346ce..59982d3 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
> @@ -793,8 +793,10 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms)
>   		for (i = 0; i < dpu_kms->catalog->vbif_count; i++) {
>   			u32 vbif_idx = dpu_kms->catalog->vbif[i].id;
>   
> -			if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx])
> +			if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) {
>   				dpu_hw_vbif_destroy(dpu_kms->hw_vbif[vbif_idx]);
> +				dpu_kms->hw_vbif[vbif_idx] = NULL;
> +			}
>   		}
>   	}
>   


-- 
With best wishes
Dmitry