]>
Commit | Line | Data |
---|---|---|
018ee245 GKH |
1 | From 3eadd887dbac1df8f25f701e5d404d1b90fd0fea Mon Sep 17 00:00:00 2001 |
2 | From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> | |
3 | Date: Thu, 4 Apr 2024 23:33:25 +0300 | |
4 | Subject: drm/client: Fully protect modes[] with dev->mode_config.mutex | |
5 | MIME-Version: 1.0 | |
6 | Content-Type: text/plain; charset=UTF-8 | |
7 | Content-Transfer-Encoding: 8bit | |
8 | ||
9 | From: Ville Syrjälä <ville.syrjala@linux.intel.com> | |
10 | ||
11 | commit 3eadd887dbac1df8f25f701e5d404d1b90fd0fea upstream. | |
12 | ||
13 | The modes[] array contains pointers to modes on the connectors' | |
14 | mode lists, which are protected by dev->mode_config.mutex. | |
15 | Thus we need to extend modes[] the same protection or by the | |
16 | time we use it the elements may already be pointing to | |
17 | freed/reused memory. | |
18 | ||
19 | Cc: stable@vger.kernel.org | |
20 | Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/10583 | |
21 | Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> | |
22 | Link: https://patchwork.freedesktop.org/patch/msgid/20240404203336.10454-2-ville.syrjala@linux.intel.com | |
23 | Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> | |
24 | Reviewed-by: Jani Nikula <jani.nikula@intel.com> | |
25 | Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> | |
26 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
27 | --- | |
28 | drivers/gpu/drm/drm_client_modeset.c | 3 ++- | |
29 | 1 file changed, 2 insertions(+), 1 deletion(-) | |
30 | ||
31 | --- a/drivers/gpu/drm/drm_client_modeset.c | |
32 | +++ b/drivers/gpu/drm/drm_client_modeset.c | |
33 | @@ -774,6 +774,7 @@ int drm_client_modeset_probe(struct drm_ | |
34 | unsigned int total_modes_count = 0; | |
35 | struct drm_client_offset *offsets; | |
36 | unsigned int connector_count = 0; | |
37 | + /* points to modes protected by mode_config.mutex */ | |
38 | struct drm_display_mode **modes; | |
39 | struct drm_crtc **crtcs; | |
40 | int i, ret = 0; | |
41 | @@ -842,7 +843,6 @@ int drm_client_modeset_probe(struct drm_ | |
42 | drm_client_pick_crtcs(client, connectors, connector_count, | |
43 | crtcs, modes, 0, width, height); | |
44 | } | |
45 | - mutex_unlock(&dev->mode_config.mutex); | |
46 | ||
47 | drm_client_modeset_release(client); | |
48 | ||
49 | @@ -872,6 +872,7 @@ int drm_client_modeset_probe(struct drm_ | |
50 | modeset->y = offset->y; | |
51 | } | |
52 | } | |
53 | + mutex_unlock(&dev->mode_config.mutex); | |
54 | ||
55 | mutex_unlock(&client->modeset_mutex); | |
56 | out: |