From 656a01d7f3a3af41bb04dbad80827345e4390fba Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 19 Dec 2020 13:52:23 +0100 Subject: [PATCH] 4.14-stable patches added patches: drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch --- ...nt-leaks-in-drm_dp_mst_allocate_vcpi.patch | 63 +++++++++++++++++++ queue-4.14/series | 1 + 2 files changed, 64 insertions(+) create mode 100644 queue-4.14/drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch diff --git a/queue-4.14/drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch b/queue-4.14/drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch new file mode 100644 index 00000000000..cfae7ad010f --- /dev/null +++ b/queue-4.14/drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch @@ -0,0 +1,63 @@ +From foo@baz Sat Dec 19 01:41:50 PM CET 2020 +From: Xin Xiong +Date: Sun, 19 Jul 2020 23:45:45 +0800 +Subject: drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi + +From: Xin Xiong + +commit a34a0a632dd991a371fec56431d73279f9c54029 upstream + +drm_dp_mst_allocate_vcpi() invokes +drm_dp_mst_topology_get_port_validated(), which increases the refcount +of the "port". + +These reference counting issues take place in two exception handling +paths separately. Either when “slots” is less than 0 or when +drm_dp_init_vcpi() returns a negative value, the function forgets to +reduce the refcnt increased drm_dp_mst_topology_get_port_validated(), +which results in a refcount leak. + +Fix these issues by pulling up the error handling when "slots" is less +than 0, and calling drm_dp_mst_topology_put_port() before termination +when drm_dp_init_vcpi() returns a negative value. + +Fixes: 1e797f556c61 ("drm/dp: Split drm_dp_mst_allocate_vcpi") +Cc: # v4.12+ +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Signed-off-by: Xin Xiong +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20200719154545.GA41231@xin-virtual-machine +[sudip: use old functions before rename] +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -2629,11 +2629,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm + { + int ret; + +- port = drm_dp_get_validated_port_ref(mgr, port); +- if (!port) ++ if (slots < 0) + return false; + +- if (slots < 0) ++ port = drm_dp_get_validated_port_ref(mgr, port); ++ if (!port) + return false; + + if (port->vcpi.vcpi > 0) { +@@ -2648,6 +2648,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm + if (ret) { + DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n", + DIV_ROUND_UP(pbn, mgr->pbn_div), ret); ++ drm_dp_put_port(port); + goto out; + } + DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n", diff --git a/queue-4.14/series b/queue-4.14/series index a0cb2e38bbc..8f24923097c 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -31,3 +31,4 @@ usb-uas-introduce-a-quirk-to-set-no_write_same.patch usb-sisusbvga-make-console-support-depend-on-broken.patch alsa-pcm-oss-fix-potential-out-of-bounds-shift.patch serial-8250_omap-avoid-fifo-corruption-caused-by-mdr1-access.patch +drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch -- 2.47.3