The port is removed synchronously, but the connector delayed. This causes a use after free which can cause a kernel BUG with slug_debug=FPZU. This is fixed by freeing the port after the connector. This fixes a regression introduced with 6b8eeca65b18ae77e175cc2b6571731f0ee413bf "drm/dp/mst: close deadlock in connector destruction."
Unified · Split
| @@ -873,9 +873,10 @@ static void drm_dp_destroy_port(struct kref *kref) · 872 unmodified lines | ||
| 873 | 873 | from an EDID retrieval */ |
| 874 | 874 | if (port->connector) { |
| 875 | 875 | mutex_lock(&mgr->destroy_connector_lock); |
| 876 | − list_add(&port->connector->destroy_list, &mgr->destroy_connector_list); | |
| 876 | + list_add(&port->next, &mgr->destroy_connector_list); | |
| 877 | 877 | mutex_unlock(&mgr->destroy_connector_lock); |
| 878 | 878 | schedule_work(&mgr->destroy_connector_work); |
| 879 | + return; | |
| 879 | 880 | } |
| 880 | 881 | drm_dp_port_teardown_pdt(port, port->pdt); |
| 881 | 882 | |
| @@ -2660,7 +2661,7 @@ static void drm_dp_tx_work(struct work_struct *work) · 1778 unmodified lines | ||
| 2660 | 2661 | static void drm_dp_destroy_connector_work(struct work_struct *work) |
| 2661 | 2662 | { |
| 2662 | 2663 | struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, destroy_connector_work); |
| 2663 | − struct drm_connector *connector; | |
| 2664 | + struct drm_dp_mst_port *port; | |
| 2664 | 2665 | |
| 2665 | 2666 | /* |
| 2666 | 2667 | * Not a regular list traverse as we have to drop the destroy |
| @@ -2669,15 +2670,21 @@ static void drm_dp_destroy_connector_work(struct work_struct *work) · 2 unmodified lines | ||
| 2669 | 2670 | */ |
| 2670 | 2671 | for (;;) { |
| 2671 | 2672 | mutex_lock(&mgr->destroy_connector_lock); |
| 2672 | − connector = list_first_entry_or_null(&mgr->destroy_connector_list, struct drm_connector, destroy_list); | |
| 2673 | − if (!connector) { | |
| 2673 | + port = list_first_entry_or_null(&mgr->destroy_connector_list, struct drm_dp_mst_port, next); | |
| 2674 | + if (!port) { | |
| 2674 | 2675 | mutex_unlock(&mgr->destroy_connector_lock); |
| 2675 | 2676 | break; |
| 2676 | 2677 | } |
| 2677 | − list_del(&connector->destroy_list); | |
| 2678 | + list_del(&port->next); | |
| 2678 | 2679 | mutex_unlock(&mgr->destroy_connector_lock); |
| 2679 | 2680 | |
| 2680 | − mgr->cbs->destroy_connector(mgr, connector); | |
| 2681 | + mgr->cbs->destroy_connector(mgr, port->connector); | |
| 2682 | + | |
| 2683 | + drm_dp_port_teardown_pdt(port, port->pdt); | |
| 2684 | + | |
| 2685 | + if (!port->input && port->vcpi.vcpi > 0) | |
| 2686 | + drm_dp_mst_put_payload_id(mgr, port->vcpi.vcpi); | |
| 2687 | + kfree(port); | |
| 2681 | 2688 | } |
| 2682 | 2689 | } |
| 2683 | 2690 | |
| @@ -743,8 +743,6 @@ struct drm_connector { · 742 unmodified lines | ||
| 743 | 743 | uint8_t num_h_tile, num_v_tile; |
| 744 | 744 | uint8_t tile_h_loc, tile_v_loc; |
| 745 | 745 | uint16_t tile_h_size, tile_v_size; |
| 746 | − | |
| 747 | − struct list_head destroy_list; | |
| 748 | 746 | }; |
| 749 | 747 | |
| 750 | 748 | /** |