4.14-stable patches

added patches:
	drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch

diff --git a/queue-4.14/drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch b/queue-4.14/drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch
new file mode 100644 (file)
index 0000000..cfae7ad
--- /dev/null
+++ b/queue-4.14/drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch
@@ -0,0 +1,63 @@
+From foo@baz Sat Dec 19 01:41:50 PM CET 2020
+From: Xin Xiong <xiongx18@fudan.edu.cn>
+Date: Sun, 19 Jul 2020 23:45:45 +0800
+Subject: drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
+
+From: Xin Xiong <xiongx18@fudan.edu.cn>
+
+commit a34a0a632dd991a371fec56431d73279f9c54029 upstream
+
+drm_dp_mst_allocate_vcpi() invokes
+drm_dp_mst_topology_get_port_validated(), which increases the refcount
+of the "port".
+
+These reference counting issues take place in two exception handling
+paths separately. Either when “slots” is less than 0 or when
+drm_dp_init_vcpi() returns a negative value, the function forgets to
+reduce the refcnt increased drm_dp_mst_topology_get_port_validated(),
+which results in a refcount leak.
+
+Fix these issues by pulling up the error handling when "slots" is less
+than 0, and calling drm_dp_mst_topology_put_port() before termination
+when drm_dp_init_vcpi() returns a negative value.
+
+Fixes: 1e797f556c61 ("drm/dp: Split drm_dp_mst_allocate_vcpi")
+Cc: <stable@vger.kernel.org> # v4.12+
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200719154545.GA41231@xin-virtual-machine
+[sudip: use old functions before rename]
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2629,11 +2629,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm
+ {
+       int ret;
+ 
+-      port = drm_dp_get_validated_port_ref(mgr, port);
+-      if (!port)
++      if (slots < 0)
+               return false;
+ 
+-      if (slots < 0)
++      port = drm_dp_get_validated_port_ref(mgr, port);
++      if (!port)
+               return false;
+ 
+       if (port->vcpi.vcpi > 0) {
+@@ -2648,6 +2648,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm
+       if (ret) {
+               DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n",
+                               DIV_ROUND_UP(pbn, mgr->pbn_div), ret);
++              drm_dp_put_port(port);
+               goto out;
+       }
+       DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n",

diff --git a/queue-4.14/series b/queue-4.14/series
index a0cb2e38bbc8fbbba136d611115fc19f30276066..8f24923097c1a0e9ad0fe8f1ffa26322c418933e 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -31,3 +31,4 @@ usb-uas-introduce-a-quirk-to-set-no_write_same.patch
 usb-sisusbvga-make-console-support-depend-on-broken.patch
 alsa-pcm-oss-fix-potential-out-of-bounds-shift.patch
 serial-8250_omap-avoid-fifo-corruption-caused-by-mdr1-access.patch
+drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch