Patch "drm: damage_helper: Fix race checking plane->state->fb" has been added to the 5.4-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    drm: damage_helper: Fix race checking plane->state->fb

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-damage_helper-fix-race-checking-plane-state-fb.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From 354c2d310082d1c384213ba76c3757dd3cd8755d Mon Sep 17 00:00:00 2001
From: Sean Paul <seanpaul at chromium.org>
Date: Wed, 4 Sep 2019 16:29:13 -0400
Subject: drm: damage_helper: Fix race checking plane->state->fb

From: Sean Paul <seanpaul at chromium.org>

commit 354c2d310082d1c384213ba76c3757dd3cd8755d upstream.

Since the dirtyfb ioctl doesn't give us any hints as to which plane is
scanning out the fb it's marking as damaged, we need to loop through
planes to find it.

Currently we just reach into plane state and check, but that can race
with another commit changing the fb out from under us. This patch locks
the plane before checking the fb and will release the lock if the plane
is not displaying the dirty fb.

Fixes: b9fc5e01d1ce ("drm: Add helper to implement legacy dirtyfb")
Cc: Rob Clark <robdclark at gmail.com>
Cc: Deepak Rawat <drawat at vmware.com>
Cc: Daniel Vetter <daniel.vetter at ffwll.ch>
Cc: Thomas Hellstrom <thellstrom at vmware.com>
Cc: Maarten Lankhorst <maarten.lankhorst at linux.intel.com>
Cc: Maxime Ripard <maxime.ripard at bootlin.com>
Cc: Sean Paul <sean at poorly.run>
Cc: David Airlie <airlied at linux.ie>
Cc: Daniel Vetter <daniel at ffwll.ch>
Cc: dri-devel at lists.freedesktop.org
Cc: <stable at vger.kernel.org> # v5.0+
Reported-by: Daniel Vetter <daniel at ffwll.ch>
Reviewed-by: Daniel Vetter <daniel at ffwll.ch>
Signed-off-by: Sean Paul <seanpaul at chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190904202938.110207-1-sean@poorly.run
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

---
 drivers/gpu/drm/drm_damage_helper.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/drm_damage_helper.c
+++ b/drivers/gpu/drm/drm_damage_helper.c
@@ -212,8 +212,14 @@ retry:
 	drm_for_each_plane(plane, fb->dev) {
 		struct drm_plane_state *plane_state;
 
-		if (plane->state->fb != fb)
+		ret = drm_modeset_lock(&plane->mutex, state->acquire_ctx);
+		if (ret)
+			goto out;
+
+		if (plane->state->fb != fb) {
+			drm_modeset_unlock(&plane->mutex);
 			continue;
+		}
 
 		plane_state = drm_atomic_get_plane_state(state, plane);
 		if (IS_ERR(plane_state)) {


Patches currently in stable-queue which might be from seanpaul at chromium.org are

queue-5.4/drm-msm-fix-memleak-on-release.patch
queue-5.4/drm-damage_helper-fix-race-checking-plane-state-fb.patch