[Intel-gfx] [PATCH] drm/i915: fix use after free during eDP encoder destroying

[Ville Syrjälä]

On Fri, Dec 12, 2014 at 05:57:38PM +0200, Imre Deak wrote:
> After
> 
> commit a18c0af171bfb875012da26f23df051004726973
> uthor: Thierry Reding <treding at nvidia.com>
> Date:   Wed Dec 10 11:38:49 2014 +0100
> 
>     drm: Zero out DRM object memory upon cleanup
> 
> we will use the eDP encoder during destroying it. Fix this by calling
> drm_encoder_cleanup() at a point when the encoder is not used any more.
> This caused a NULL pointer dereference in pps_lock(), I can't see that
> it caused any other problem.
> 
> All the other encoders seem to call drm_encoder_cleanup() at a safe
> place.
> 
> Signed-off-by: Imre Deak <imre.deak at intel.com>

drm_encoder_cleanup() doesn't appear to have any nasty side effects
so this looks sane.

Reviewed-by: Ville Syrjälä <ville.syrjala at linux.intel.com>

> ---
>  drivers/gpu/drm/i915/intel_dp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
> index 3fc3296..0a55623 100644
> --- a/drivers/gpu/drm/i915/intel_dp.c
> +++ b/drivers/gpu/drm/i915/intel_dp.c
> @@ -4310,7 +4310,6 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
>  
>  	drm_dp_aux_unregister(&intel_dp->aux);
>  	intel_dp_mst_encoder_cleanup(intel_dig_port);
> -	drm_encoder_cleanup(encoder);
>  	if (is_edp(intel_dp)) {
>  		cancel_delayed_work_sync(&intel_dp->panel_vdd_work);
>  		/*
> @@ -4326,6 +4325,7 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
>  			intel_dp->edp_notifier.notifier_call = NULL;
>  		}
>  	}
> +	drm_encoder_cleanup(encoder);
>  	kfree(intel_dig_port);
>  }
>  
> -- 
> 1.8.4
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Ville Syrjälä
Intel OTC