releases/6.6.28/drm-client-fully-protect-modes-with-dev-mode_config.mutex.patch

   1 From 3eadd887dbac1df8f25f701e5d404d1b90fd0fea Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
   3 Date: Thu, 4 Apr 2024 23:33:25 +0300
   4 Subject: drm/client: Fully protect modes[] with dev->mode_config.mutex
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 From: Ville Syrjälä <ville.syrjala@linux.intel.com>
  10
  11 commit 3eadd887dbac1df8f25f701e5d404d1b90fd0fea upstream.
  12
  13 The modes[] array contains pointers to modes on the connectors'
  14 mode lists, which are protected by dev->mode_config.mutex.
  15 Thus we need to extend modes[] the same protection or by the
  16 time we use it the elements may already be pointing to
  17 freed/reused memory.
  18
  19 Cc: stable@vger.kernel.org
  20 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/10583
  21 Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
  22 Link: https://patchwork.freedesktop.org/patch/msgid/20240404203336.10454-2-ville.syrjala@linux.intel.com
  23 Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
  24 Reviewed-by: Jani Nikula <jani.nikula@intel.com>
  25 Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
  26 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  27 ---
  28  drivers/gpu/drm/drm_client_modeset.c |    3 ++-
  29  1 file changed, 2 insertions(+), 1 deletion(-)
  30
  31 --- a/drivers/gpu/drm/drm_client_modeset.c
  32 +++ b/drivers/gpu/drm/drm_client_modeset.c
  33 @@ -777,6 +777,7 @@ int drm_client_modeset_probe(struct drm_
  34         unsigned int total_modes_count = 0;
  35         struct drm_client_offset *offsets;
  36         unsigned int connector_count = 0;
  37 +       /* points to modes protected by mode_config.mutex */
  38         struct drm_display_mode **modes;
  39         struct drm_crtc **crtcs;
  40         int i, ret = 0;
  41 @@ -845,7 +846,6 @@ int drm_client_modeset_probe(struct drm_
  42                 drm_client_pick_crtcs(client, connectors, connector_count,
  43                                       crtcs, modes, 0, width, height);
  44         }
  45 -       mutex_unlock(&dev->mode_config.mutex);
  46
  47         drm_client_modeset_release(client);
  48
  49 @@ -875,6 +875,7 @@ int drm_client_modeset_probe(struct drm_
  50                         modeset->y = offset->y;
  51                 }
  52         }
  53 +       mutex_unlock(&dev->mode_config.mutex);
  54
  55         mutex_unlock(&client->modeset_mutex);
  56  out: