p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

drm/i915: Avoid use-after-free of intel_encoder in intel_dp_connector_destrpy 

The drm_dp_aux is associated with the intel_dp encoder and not the
connector. Since the encoder is destroyed before the connector,
attempting to free the drm_dp_aux from inside the connector cleanup
causes a use-after-free.

This was applied to the patch that CI was happy with, but in the
confusion of so many series trying to make CI happy, the unready
patch was plucked.

Fixes: c191eca110 ("drm/i915: Move intel_connector->unregister to connector->early_unregister")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1466411357-730-1-git-send-email-chris@chris-wilson.co.uk
This commit is contained in:
Chris Wilson 2016-06-20 09:29:17 +01:00 committed by Daniel Vetter
parent e63d87c0b0
commit 996818869c
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/gpu/drm/i915/intel_dp.c
View File

@ -4463,8 +4463,6 @@ intel_dp_connector_destroy(struct drm_connector *connector)
if (!IS_ERR_OR_NULL(intel_connector->edid))
kfree(intel_connector->edid);
intel_dp_aux_fini(intel_attached_dp(connector));
/* Can't call is_edp() since the encoder may have been destroyed
* already. */
if (connector->connector_type == DRM_MODE_CONNECTOR_eDP)
@ -4495,6 +4493,9 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
intel_dp->edp_notifier.notifier_call = NULL;
}
}
intel_dp_aux_fini(intel_dp);
drm_encoder_cleanup(encoder);
kfree(intel_dig_port);
}