From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4542CC4332F for ; Sun, 9 Oct 2022 23:55:27 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id D22C510E5B8; Sun, 9 Oct 2022 23:55:24 +0000 (UTC) Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by gabe.freedesktop.org (Postfix) with ESMTPS id CD81910E5C1 for ; Sun, 9 Oct 2022 23:55:16 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6C9A1B80DE9; Sun, 9 Oct 2022 23:55:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 090BBC43470; Sun, 9 Oct 2022 23:55:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1665359714; bh=UYP2oKc4P3SHCiQi03PA0B37xuoGOAcj8Lm2E2okRUA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Np238c4xZ/p1su1a8Q6tLhBBfFFlF/ui0VsAHizZmCyRl+HBuEzwSAlBO7Tgyfb+p dYI6Wymt6KBxPohb44831c0LB0sudBMYa1zVsgychw5T8tJcxRWDRlAWDqwMFHD5oz r8Ce0g4gTtH4S9PFjd0WFkhYJ7gjZYsXQD6NUOSGsV7UnZUIN9u6+X/pkJt9G4ZwiR pAyi5IVJ6ztZ0A3pYqghT4Lf1n34XXkiHB4MiPqbHqK50n9J5W1HE5PHCHo5DfKjhb TTE4s0s2usoYsGToeULHGXLPe8BKGavvCYgp3iNFuOmXaTeyurod2MlcdmBrjQlqyo n5fv5uT53AylQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH AUTOSEL 5.15 19/25] drm/meson: reorder driver deinit sequence to fix use-after-free bug Date: Sun, 9 Oct 2022 19:54:19 -0400 Message-Id: <20221009235426.1231313-19-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221009235426.1231313-1-sashal@kernel.org> References: <20221009235426.1231313-1-sashal@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sasha Levin , Neil Armstrong , khilman@baylibre.com, =?UTF-8?q?Adri=C3=A1n=20Larumbe?= , dri-devel@lists.freedesktop.org, linux-amlogic@lists.infradead.org, linux-arm-kernel@lists.infradead.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" From: Adrián Larumbe [ Upstream commit 31c519981eb141c7ec39bfd5be25d35f02edb868 ] Unloading the driver triggers the following KASAN warning: [ +0.006275] ============================================================= [ +0.000029] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0x1a0 [ +0.000026] Read of size 8 at addr ffff000020c395e0 by task rmmod/2695 [ +0.000019] CPU: 5 PID: 2695 Comm: rmmod Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1 [ +0.000013] Hardware name: Hardkernel ODROID-N2Plus (DT) [ +0.000008] Call trace: [ +0.000007] dump_backtrace+0x1ec/0x280 [ +0.000013] show_stack+0x24/0x80 [ +0.000008] dump_stack_lvl+0x98/0xd4 [ +0.000011] print_address_description.constprop.0+0x80/0x520 [ +0.000011] print_report+0x128/0x260 [ +0.000007] kasan_report+0xb8/0xfc [ +0.000008] __asan_report_load8_noabort+0x3c/0x50 [ +0.000010] __list_del_entry_valid+0xe0/0x1a0 [ +0.000009] drm_atomic_private_obj_fini+0x30/0x200 [drm] [ +0.000172] drm_bridge_detach+0x94/0x260 [drm] [ +0.000145] drm_encoder_cleanup+0xa4/0x290 [drm] [ +0.000144] drm_mode_config_cleanup+0x118/0x740 [drm] [ +0.000143] drm_mode_config_init_release+0x1c/0x2c [drm] [ +0.000144] drm_managed_release+0x170/0x414 [drm] [ +0.000142] drm_dev_put.part.0+0xc0/0x124 [drm] [ +0.000143] drm_dev_put+0x20/0x30 [drm] [ +0.000142] meson_drv_unbind+0x1d8/0x2ac [meson_drm] [ +0.000028] take_down_aggregate_device+0xb0/0x160 [ +0.000016] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000015] platform_remove+0x64/0xb0 [ +0.000009] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000009] driver_unregister+0x70/0xb0 [ +0.000008] platform_driver_unregister+0x20/0x2c [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000012] __do_sys_delete_module+0x288/0x400 [ +0.000011] __arm64_sys_delete_module+0x5c/0x80 [ +0.000009] invoke_syscall+0x74/0x260 [ +0.000009] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000009] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000012] el0t_64_sync_handler+0x11c/0x150 [ +0.000008] el0t_64_sync+0x18c/0x190 [ +0.000018] Allocated by task 0: [ +0.000007] (stack is not available) [ +0.000011] Freed by task 2695: [ +0.000008] kasan_save_stack+0x2c/0x5c [ +0.000011] kasan_set_track+0x2c/0x40 [ +0.000008] kasan_set_free_info+0x28/0x50 [ +0.000009] ____kasan_slab_free+0x128/0x1d4 [ +0.000008] __kasan_slab_free+0x18/0x24 [ +0.000007] slab_free_freelist_hook+0x108/0x230 [ +0.000011] kfree+0x110/0x35c [ +0.000008] release_nodes+0xf0/0x16c [ +0.000009] devres_release_group+0x180/0x270 [ +0.000008] component_unbind+0x128/0x1e0 [ +0.000010] component_unbind_all+0x1b8/0x264 [ +0.000009] meson_drv_unbind+0x1a0/0x2ac [meson_drm] [ +0.000025] take_down_aggregate_device+0xb0/0x160 [ +0.000009] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000012] platform_remove+0x64/0xb0 [ +0.000008] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000008] driver_unregister+0x70/0xb0 [ +0.000008] platform_driver_unregister+0x20/0x2c [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000011] __do_sys_delete_module+0x288/0x400 [ +0.000010] __arm64_sys_delete_module+0x5c/0x80 [ +0.000008] invoke_syscall+0x74/0x260 [ +0.000008] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000008] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000009] el0t_64_sync_handler+0x11c/0x150 [ +0.000009] el0t_64_sync+0x18c/0x190 [ +0.000014] The buggy address belongs to the object at ffff000020c39000 which belongs to the cache kmalloc-4k of size 4096 [ +0.000008] The buggy address is located 1504 bytes inside of 4096-byte region [ffff000020c39000, ffff000020c3a000) [ +0.000016] The buggy address belongs to the physical page: [ +0.000009] page:fffffc0000830e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20c38 [ +0.000013] head:fffffc0000830e00 order:3 compound_mapcount:0 compound_pincount:0 [ +0.000008] flags: 0xffff00000010200(slab|head|node=0|zone=0|lastcpupid=0xffff) [ +0.000019] raw: 0ffff00000010200 fffffc0000fd4808 fffffc0000126208 ffff000000002e80 [ +0.000009] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ +0.000008] page dumped because: kasan: bad access detected [ +0.000011] Memory state around the buggy address: [ +0.000008] ffff000020c39480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ffff000020c39500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] >ffff000020c39580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ^ [ +0.000007] ffff000020c39600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ffff000020c39680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000006] ================================================================== The reason this is happening is unloading meson-dw-hdmi will cause the component API to take down the aggregate device, which in turn will cause all devres-managed memory to be freed, including the struct dw_hdmi allocated in dw_hdmi_probe. This struct embeds a struct drm_bridge that is added at the end of the function, and which is later on picked up in meson_encoder_hdmi_init. However, when attaching the bridge to the encoder created in meson_encoder_hdmi_init, it's linked to the encoder's bridge chain, from where it never leaves, even after devres_release_group is called when the driver's components are unbound and the embedding structure freed. Then, when calling drm_dev_put in the aggregate driver's unbind function, drm_bridge_detach is called for every single bridge linked to the encoder, including the one whose memory had already been deallocated. Fix by calling component_unbind_all after drm_dev_put. Signed-off-by: Adrián Larumbe Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220919010940.419893-2-adrian.larumbe@collabora.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/meson/meson_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c index a56607501d36..56c7daeb116a 100644 --- a/drivers/gpu/drm/meson/meson_drv.c +++ b/drivers/gpu/drm/meson/meson_drv.c @@ -387,9 +387,9 @@ static void meson_drv_unbind(struct device *dev) drm_dev_unregister(drm); drm_kms_helper_poll_fini(drm); drm_atomic_helper_shutdown(drm); - component_unbind_all(dev, drm); free_irq(priv->vsync_irq, drm); drm_dev_put(drm); + component_unbind_all(dev, drm); if (priv->afbcd.ops) priv->afbcd.ops->exit(priv); -- 2.35.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0F693C433FE for ; Sun, 9 Oct 2022 23:55:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=82yQdqZDJ9gWKOWY3mUVmSuG0oLchdhmJTkKb+xQ/YY=; b=r0CS0ntAkeUuTu A9s4breTuj9Qps+7XjnZkSyoOIzd9UVRDNddyVnAw5X6ZD4rX3fXG1UOwlhGpmcnwzzQusy4kn4vs 1R8BN9rbDrwIRJxKZ9t3HGrBJ2CqjUiqhv6Aax9jl1rlYoREa1g+w79H7tdd3l/4liSoCl73SOJLQ kZNEtpEEWow3FLMKPmj6R9Afbq3KGeRxLrgLhA39TaNF6RrdSFrXTWKq2BnbTSDlBYuoS0YWjVN8V cJhY8Mwqbw1T9fkuNxkKgOPN/dWKk0YsG2vSdT+97zPB85Np4c5z5MTVERNdLDO9o6oDLzatSOJqz 0t80I+dM5DXprvngYLGw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1ohg8f-00GUAw-NX; Sun, 09 Oct 2022 23:55:21 +0000 Received: from ams.source.kernel.org ([145.40.68.75]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1ohg8a-00GU7M-Q6; Sun, 09 Oct 2022 23:55:19 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6C9A1B80DE9; Sun, 9 Oct 2022 23:55:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 090BBC43470; Sun, 9 Oct 2022 23:55:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1665359714; bh=UYP2oKc4P3SHCiQi03PA0B37xuoGOAcj8Lm2E2okRUA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Np238c4xZ/p1su1a8Q6tLhBBfFFlF/ui0VsAHizZmCyRl+HBuEzwSAlBO7Tgyfb+p dYI6Wymt6KBxPohb44831c0LB0sudBMYa1zVsgychw5T8tJcxRWDRlAWDqwMFHD5oz r8Ce0g4gTtH4S9PFjd0WFkhYJ7gjZYsXQD6NUOSGsV7UnZUIN9u6+X/pkJt9G4ZwiR pAyi5IVJ6ztZ0A3pYqghT4Lf1n34XXkiHB4MiPqbHqK50n9J5W1HE5PHCHo5DfKjhb TTE4s0s2usoYsGToeULHGXLPe8BKGavvCYgp3iNFuOmXaTeyurod2MlcdmBrjQlqyo n5fv5uT53AylQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: =?UTF-8?q?Adri=C3=A1n=20Larumbe?= , Neil Armstrong , Sasha Levin , airlied@gmail.com, daniel@ffwll.ch, khilman@baylibre.com, dri-devel@lists.freedesktop.org, linux-amlogic@lists.infradead.org, linux-arm-kernel@lists.infradead.org Subject: [PATCH AUTOSEL 5.15 19/25] drm/meson: reorder driver deinit sequence to fix use-after-free bug Date: Sun, 9 Oct 2022 19:54:19 -0400 Message-Id: <20221009235426.1231313-19-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221009235426.1231313-1-sashal@kernel.org> References: <20221009235426.1231313-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20221009_165517_205873_2DF9B01A X-CRM114-Status: GOOD ( 14.82 ) X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org RnJvbTogQWRyacOhbiBMYXJ1bWJlIDxhZHJpYW4ubGFydW1iZUBjb2xsYWJvcmEuY29tPgoKWyBV cHN0cmVhbSBjb21taXQgMzFjNTE5OTgxZWIxNDFjN2VjMzliZmQ1YmUyNWQzNWYwMmVkYjg2OCBd CgpVbmxvYWRpbmcgdGhlIGRyaXZlciB0cmlnZ2VycyB0aGUgZm9sbG93aW5nIEtBU0FOIHdhcm5p bmc6CgpbICArMC4wMDYyNzVdID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KWyAgKzAuMDAwMDI5XSBCVUc6IEtBU0FOOiB1c2UtYWZ0 ZXItZnJlZSBpbiBfX2xpc3RfZGVsX2VudHJ5X3ZhbGlkKzB4ZTAvMHgxYTAKWyAgKzAuMDAwMDI2 XSBSZWFkIG9mIHNpemUgOCBhdCBhZGRyIGZmZmYwMDAwMjBjMzk1ZTAgYnkgdGFzayBybW1vZC8y Njk1CgpbICArMC4wMDAwMTldIENQVTogNSBQSUQ6IDI2OTUgQ29tbTogcm1tb2QgVGFpbnRlZDog RyAgICAgICAgIEMgTyAgICAgIDUuMTkuMC1yYzYtbHJtYmthc2FuKyAjMQpbICArMC4wMDAwMTNd IEhhcmR3YXJlIG5hbWU6IEhhcmRrZXJuZWwgT0RST0lELU4yUGx1cyAoRFQpClsgICswLjAwMDAw OF0gQ2FsbCB0cmFjZToKWyAgKzAuMDAwMDA3XSAgZHVtcF9iYWNrdHJhY2UrMHgxZWMvMHgyODAK WyAgKzAuMDAwMDEzXSAgc2hvd19zdGFjaysweDI0LzB4ODAKWyAgKzAuMDAwMDA4XSAgZHVtcF9z dGFja19sdmwrMHg5OC8weGQ0ClsgICswLjAwMDAxMV0gIHByaW50X2FkZHJlc3NfZGVzY3JpcHRp b24uY29uc3Rwcm9wLjArMHg4MC8weDUyMApbICArMC4wMDAwMTFdICBwcmludF9yZXBvcnQrMHgx MjgvMHgyNjAKWyAgKzAuMDAwMDA3XSAga2FzYW5fcmVwb3J0KzB4YjgvMHhmYwpbICArMC4wMDAw MDhdICBfX2FzYW5fcmVwb3J0X2xvYWQ4X25vYWJvcnQrMHgzYy8weDUwClsgICswLjAwMDAxMF0g IF9fbGlzdF9kZWxfZW50cnlfdmFsaWQrMHhlMC8weDFhMApbICArMC4wMDAwMDldICBkcm1fYXRv bWljX3ByaXZhdGVfb2JqX2ZpbmkrMHgzMC8weDIwMCBbZHJtXQpbICArMC4wMDAxNzJdICBkcm1f YnJpZGdlX2RldGFjaCsweDk0LzB4MjYwIFtkcm1dClsgICswLjAwMDE0NV0gIGRybV9lbmNvZGVy X2NsZWFudXArMHhhNC8weDI5MCBbZHJtXQpbICArMC4wMDAxNDRdICBkcm1fbW9kZV9jb25maWdf Y2xlYW51cCsweDExOC8weDc0MCBbZHJtXQpbICArMC4wMDAxNDNdICBkcm1fbW9kZV9jb25maWdf aW5pdF9yZWxlYXNlKzB4MWMvMHgyYyBbZHJtXQpbICArMC4wMDAxNDRdICBkcm1fbWFuYWdlZF9y ZWxlYXNlKzB4MTcwLzB4NDE0IFtkcm1dClsgICswLjAwMDE0Ml0gIGRybV9kZXZfcHV0LnBhcnQu MCsweGMwLzB4MTI0IFtkcm1dClsgICswLjAwMDE0M10gIGRybV9kZXZfcHV0KzB4MjAvMHgzMCBb ZHJtXQpbICArMC4wMDAxNDJdICBtZXNvbl9kcnZfdW5iaW5kKzB4MWQ4LzB4MmFjIFttZXNvbl9k cm1dClsgICswLjAwMDAyOF0gIHRha2VfZG93bl9hZ2dyZWdhdGVfZGV2aWNlKzB4YjAvMHgxNjAK WyAgKzAuMDAwMDE2XSAgY29tcG9uZW50X2RlbCsweDE4Yy8weDM2MApbICArMC4wMDAwMDldICBt ZXNvbl9kd19oZG1pX3JlbW92ZSsweDI4LzB4NDAgW21lc29uX2R3X2hkbWldClsgICswLjAwMDAx NV0gIHBsYXRmb3JtX3JlbW92ZSsweDY0LzB4YjAKWyAgKzAuMDAwMDA5XSAgZGV2aWNlX3JlbW92 ZSsweGI4LzB4MTU0ClsgICswLjAwMDAwOV0gIGRldmljZV9yZWxlYXNlX2RyaXZlcl9pbnRlcm5h bCsweDM5OC8weDViMApbICArMC4wMDAwMDldICBkcml2ZXJfZGV0YWNoKzB4YWMvMHgxYjAKWyAg KzAuMDAwMDA5XSAgYnVzX3JlbW92ZV9kcml2ZXIrMHgxNTgvMHgyOWMKWyAgKzAuMDAwMDA5XSAg ZHJpdmVyX3VucmVnaXN0ZXIrMHg3MC8weGIwClsgICswLjAwMDAwOF0gIHBsYXRmb3JtX2RyaXZl cl91bnJlZ2lzdGVyKzB4MjAvMHgyYwpbICArMC4wMDAwMDhdICBtZXNvbl9kd19oZG1pX3BsYXRm b3JtX2RyaXZlcl9leGl0KzB4MWMvMHgzMCBbbWVzb25fZHdfaGRtaV0KWyAgKzAuMDAwMDEyXSAg X19kb19zeXNfZGVsZXRlX21vZHVsZSsweDI4OC8weDQwMApbICArMC4wMDAwMTFdICBfX2FybTY0 X3N5c19kZWxldGVfbW9kdWxlKzB4NWMvMHg4MApbICArMC4wMDAwMDldICBpbnZva2Vfc3lzY2Fs bCsweDc0LzB4MjYwClsgICswLjAwMDAwOV0gIGVsMF9zdmNfY29tbW9uLmNvbnN0cHJvcC4wKzB4 Y2MvMHgyNjAKWyAgKzAuMDAwMDA5XSAgZG9fZWwwX3N2YysweDUwLzB4NzAKWyAgKzAuMDAwMDA3 XSAgZWwwX3N2YysweDY4LzB4MWEwClsgICswLjAwMDAxMl0gIGVsMHRfNjRfc3luY19oYW5kbGVy KzB4MTFjLzB4MTUwClsgICswLjAwMDAwOF0gIGVsMHRfNjRfc3luYysweDE4Yy8weDE5MAoKWyAg KzAuMDAwMDE4XSBBbGxvY2F0ZWQgYnkgdGFzayAwOgpbICArMC4wMDAwMDddIChzdGFjayBpcyBu b3QgYXZhaWxhYmxlKQoKWyAgKzAuMDAwMDExXSBGcmVlZCBieSB0YXNrIDI2OTU6ClsgICswLjAw MDAwOF0gIGthc2FuX3NhdmVfc3RhY2srMHgyYy8weDVjClsgICswLjAwMDAxMV0gIGthc2FuX3Nl dF90cmFjaysweDJjLzB4NDAKWyAgKzAuMDAwMDA4XSAga2FzYW5fc2V0X2ZyZWVfaW5mbysweDI4 LzB4NTAKWyAgKzAuMDAwMDA5XSAgX19fX2thc2FuX3NsYWJfZnJlZSsweDEyOC8weDFkNApbICAr MC4wMDAwMDhdICBfX2thc2FuX3NsYWJfZnJlZSsweDE4LzB4MjQKWyAgKzAuMDAwMDA3XSAgc2xh Yl9mcmVlX2ZyZWVsaXN0X2hvb2srMHgxMDgvMHgyMzAKWyAgKzAuMDAwMDExXSAga2ZyZWUrMHgx MTAvMHgzNWMKWyAgKzAuMDAwMDA4XSAgcmVsZWFzZV9ub2RlcysweGYwLzB4MTZjClsgICswLjAw MDAwOV0gIGRldnJlc19yZWxlYXNlX2dyb3VwKzB4MTgwLzB4MjcwClsgICswLjAwMDAwOF0gIGNv bXBvbmVudF91bmJpbmQrMHgxMjgvMHgxZTAKWyAgKzAuMDAwMDEwXSAgY29tcG9uZW50X3VuYmlu ZF9hbGwrMHgxYjgvMHgyNjQKWyAgKzAuMDAwMDA5XSAgbWVzb25fZHJ2X3VuYmluZCsweDFhMC8w eDJhYyBbbWVzb25fZHJtXQpbICArMC4wMDAwMjVdICB0YWtlX2Rvd25fYWdncmVnYXRlX2Rldmlj ZSsweGIwLzB4MTYwClsgICswLjAwMDAwOV0gIGNvbXBvbmVudF9kZWwrMHgxOGMvMHgzNjAKWyAg KzAuMDAwMDA5XSAgbWVzb25fZHdfaGRtaV9yZW1vdmUrMHgyOC8weDQwIFttZXNvbl9kd19oZG1p XQpbICArMC4wMDAwMTJdICBwbGF0Zm9ybV9yZW1vdmUrMHg2NC8weGIwClsgICswLjAwMDAwOF0g IGRldmljZV9yZW1vdmUrMHhiOC8weDE1NApbICArMC4wMDAwMDldICBkZXZpY2VfcmVsZWFzZV9k cml2ZXJfaW50ZXJuYWwrMHgzOTgvMHg1YjAKWyAgKzAuMDAwMDA5XSAgZHJpdmVyX2RldGFjaCsw eGFjLzB4MWIwClsgICswLjAwMDAwOV0gIGJ1c19yZW1vdmVfZHJpdmVyKzB4MTU4LzB4MjljClsg ICswLjAwMDAwOF0gIGRyaXZlcl91bnJlZ2lzdGVyKzB4NzAvMHhiMApbICArMC4wMDAwMDhdICBw bGF0Zm9ybV9kcml2ZXJfdW5yZWdpc3RlcisweDIwLzB4MmMKWyAgKzAuMDAwMDA4XSAgbWVzb25f ZHdfaGRtaV9wbGF0Zm9ybV9kcml2ZXJfZXhpdCsweDFjLzB4MzAgW21lc29uX2R3X2hkbWldClsg ICswLjAwMDAxMV0gIF9fZG9fc3lzX2RlbGV0ZV9tb2R1bGUrMHgyODgvMHg0MDAKWyAgKzAuMDAw MDEwXSAgX19hcm02NF9zeXNfZGVsZXRlX21vZHVsZSsweDVjLzB4ODAKWyAgKzAuMDAwMDA4XSAg aW52b2tlX3N5c2NhbGwrMHg3NC8weDI2MApbICArMC4wMDAwMDhdICBlbDBfc3ZjX2NvbW1vbi5j b25zdHByb3AuMCsweGNjLzB4MjYwClsgICswLjAwMDAwOF0gIGRvX2VsMF9zdmMrMHg1MC8weDcw ClsgICswLjAwMDAwN10gIGVsMF9zdmMrMHg2OC8weDFhMApbICArMC4wMDAwMDldICBlbDB0XzY0 X3N5bmNfaGFuZGxlcisweDExYy8weDE1MApbICArMC4wMDAwMDldICBlbDB0XzY0X3N5bmMrMHgx OGMvMHgxOTAKClsgICswLjAwMDAxNF0gVGhlIGJ1Z2d5IGFkZHJlc3MgYmVsb25ncyB0byB0aGUg b2JqZWN0IGF0IGZmZmYwMDAwMjBjMzkwMDAKICAgICAgICAgICAgICAgd2hpY2ggYmVsb25ncyB0 byB0aGUgY2FjaGUga21hbGxvYy00ayBvZiBzaXplIDQwOTYKWyAgKzAuMDAwMDA4XSBUaGUgYnVn Z3kgYWRkcmVzcyBpcyBsb2NhdGVkIDE1MDQgYnl0ZXMgaW5zaWRlIG9mCiAgICAgICAgICAgICAg IDQwOTYtYnl0ZSByZWdpb24gW2ZmZmYwMDAwMjBjMzkwMDAsIGZmZmYwMDAwMjBjM2EwMDApCgpb ICArMC4wMDAwMTZdIFRoZSBidWdneSBhZGRyZXNzIGJlbG9uZ3MgdG8gdGhlIHBoeXNpY2FsIHBh Z2U6ClsgICswLjAwMDAwOV0gcGFnZTpmZmZmZmMwMDAwODMwZTAwIHJlZmNvdW50OjEgbWFwY291 bnQ6MCBtYXBwaW5nOjAwMDAwMDAwMDAwMDAwMDAgaW5kZXg6MHgwIHBmbjoweDIwYzM4ClsgICsw LjAwMDAxM10gaGVhZDpmZmZmZmMwMDAwODMwZTAwIG9yZGVyOjMgY29tcG91bmRfbWFwY291bnQ6 MCBjb21wb3VuZF9waW5jb3VudDowClsgICswLjAwMDAwOF0gZmxhZ3M6IDB4ZmZmZjAwMDAwMDEw MjAwKHNsYWJ8aGVhZHxub2RlPTB8em9uZT0wfGxhc3RjcHVwaWQ9MHhmZmZmKQpbICArMC4wMDAw MTldIHJhdzogMGZmZmYwMDAwMDAxMDIwMCBmZmZmZmMwMDAwZmQ0ODA4IGZmZmZmYzAwMDAxMjYy MDggZmZmZjAwMDAwMDAwMmU4MApbICArMC4wMDAwMDldIHJhdzogMDAwMDAwMDAwMDAwMDAwMCAw MDAwMDAwMDAwMDIwMDAyIDAwMDAwMDAxZmZmZmZmZmYgMDAwMDAwMDAwMDAwMDAwMApbICArMC4w MDAwMDhdIHBhZ2UgZHVtcGVkIGJlY2F1c2U6IGthc2FuOiBiYWQgYWNjZXNzIGRldGVjdGVkCgpb ICArMC4wMDAwMTFdIE1lbW9yeSBzdGF0ZSBhcm91bmQgdGhlIGJ1Z2d5IGFkZHJlc3M6ClsgICsw LjAwMDAwOF0gIGZmZmYwMDAwMjBjMzk0ODA6IGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZi IGZiIGZiIGZiIGZiIGZiIGZiClsgICswLjAwMDAwN10gIGZmZmYwMDAwMjBjMzk1MDA6IGZiIGZi IGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiClsgICswLjAwMDAwN10g PmZmZmYwMDAwMjBjMzk1ODA6IGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZi IGZiIGZiIGZiClsgICswLjAwMDAwN10gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIF4KWyAgKzAuMDAwMDA3XSAgZmZmZjAwMDAyMGMzOTYwMDog ZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIKWyAgKzAuMDAw MDA3XSAgZmZmZjAwMDAyMGMzOTY4MDogZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIg ZmIgZmIgZmIgZmIgZmIKWyAgKzAuMDAwMDA2XSA9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KClRoZSByZWFzb24gdGhpcyBp cyBoYXBwZW5pbmcgaXMgdW5sb2FkaW5nIG1lc29uLWR3LWhkbWkgd2lsbCBjYXVzZSB0aGUKY29t cG9uZW50IEFQSSB0byB0YWtlIGRvd24gdGhlIGFnZ3JlZ2F0ZSBkZXZpY2UsIHdoaWNoIGluIHR1 cm4gd2lsbCBjYXVzZQphbGwgZGV2cmVzLW1hbmFnZWQgbWVtb3J5IHRvIGJlIGZyZWVkLCBpbmNs dWRpbmcgdGhlIHN0cnVjdCBkd19oZG1pCmFsbG9jYXRlZCBpbiBkd19oZG1pX3Byb2JlLiBUaGlz IHN0cnVjdCBlbWJlZHMgYSBzdHJ1Y3QgZHJtX2JyaWRnZSB0aGF0IGlzCmFkZGVkIGF0IHRoZSBl bmQgb2YgdGhlIGZ1bmN0aW9uLCBhbmQgd2hpY2ggaXMgbGF0ZXIgb24gcGlja2VkIHVwIGluCm1l c29uX2VuY29kZXJfaGRtaV9pbml0LgoKSG93ZXZlciwgd2hlbiBhdHRhY2hpbmcgdGhlIGJyaWRn ZSB0byB0aGUgZW5jb2RlciBjcmVhdGVkIGluCm1lc29uX2VuY29kZXJfaGRtaV9pbml0LCBpdCdz IGxpbmtlZCB0byB0aGUgZW5jb2RlcidzIGJyaWRnZSBjaGFpbiwgZnJvbQp3aGVyZSBpdCBuZXZl ciBsZWF2ZXMsIGV2ZW4gYWZ0ZXIgZGV2cmVzX3JlbGVhc2VfZ3JvdXAgaXMgY2FsbGVkIHdoZW4g dGhlCmRyaXZlcidzIGNvbXBvbmVudHMgYXJlIHVuYm91bmQgYW5kIHRoZSBlbWJlZGRpbmcgc3Ry dWN0dXJlIGZyZWVkLgoKVGhlbiwgd2hlbiBjYWxsaW5nIGRybV9kZXZfcHV0IGluIHRoZSBhZ2dy ZWdhdGUgZHJpdmVyJ3MgdW5iaW5kIGZ1bmN0aW9uLApkcm1fYnJpZGdlX2RldGFjaCBpcyBjYWxs ZWQgZm9yIGV2ZXJ5IHNpbmdsZSBicmlkZ2UgbGlua2VkIHRvIHRoZSBlbmNvZGVyLAppbmNsdWRp bmcgdGhlIG9uZSB3aG9zZSBtZW1vcnkgaGFkIGFscmVhZHkgYmVlbiBkZWFsbG9jYXRlZC4KCkZp eCBieSBjYWxsaW5nIGNvbXBvbmVudF91bmJpbmRfYWxsIGFmdGVyIGRybV9kZXZfcHV0LgoKU2ln bmVkLW9mZi1ieTogQWRyacOhbiBMYXJ1bWJlIDxhZHJpYW4ubGFydW1iZUBjb2xsYWJvcmEuY29t PgpSZXZpZXdlZC1ieTogTmVpbCBBcm1zdHJvbmcgPG5laWwuYXJtc3Ryb25nQGxpbmFyby5vcmc+ ClNpZ25lZC1vZmYtYnk6IE5laWwgQXJtc3Ryb25nIDxuZWlsLmFybXN0cm9uZ0BsaW5hcm8ub3Jn PgpMaW5rOiBodHRwczovL3BhdGNod29yay5mcmVlZGVza3RvcC5vcmcvcGF0Y2gvbXNnaWQvMjAy MjA5MTkwMTA5NDAuNDE5ODkzLTItYWRyaWFuLmxhcnVtYmVAY29sbGFib3JhLmNvbQpTaWduZWQt b2ZmLWJ5OiBTYXNoYSBMZXZpbiA8c2FzaGFsQGtlcm5lbC5vcmc+Ci0tLQogZHJpdmVycy9ncHUv ZHJtL21lc29uL21lc29uX2Rydi5jIHwgMiArLQogMSBmaWxlIGNoYW5nZWQsIDEgaW5zZXJ0aW9u KCspLCAxIGRlbGV0aW9uKC0pCgpkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL21lc29uL21l c29uX2Rydi5jIGIvZHJpdmVycy9ncHUvZHJtL21lc29uL21lc29uX2Rydi5jCmluZGV4IGE1NjYw NzUwMWQzNi4uNTZjN2RhZWIxMTZhIDEwMDY0NAotLS0gYS9kcml2ZXJzL2dwdS9kcm0vbWVzb24v bWVzb25fZHJ2LmMKKysrIGIvZHJpdmVycy9ncHUvZHJtL21lc29uL21lc29uX2Rydi5jCkBAIC0z ODcsOSArMzg3LDkgQEAgc3RhdGljIHZvaWQgbWVzb25fZHJ2X3VuYmluZChzdHJ1Y3QgZGV2aWNl ICpkZXYpCiAJZHJtX2Rldl91bnJlZ2lzdGVyKGRybSk7CiAJZHJtX2ttc19oZWxwZXJfcG9sbF9m aW5pKGRybSk7CiAJZHJtX2F0b21pY19oZWxwZXJfc2h1dGRvd24oZHJtKTsKLQljb21wb25lbnRf dW5iaW5kX2FsbChkZXYsIGRybSk7CiAJZnJlZV9pcnEocHJpdi0+dnN5bmNfaXJxLCBkcm0pOwog CWRybV9kZXZfcHV0KGRybSk7CisJY29tcG9uZW50X3VuYmluZF9hbGwoZGV2LCBkcm0pOwogCiAJ aWYgKHByaXYtPmFmYmNkLm9wcykKIAkJcHJpdi0+YWZiY2Qub3BzLT5leGl0KHByaXYpOwotLSAK Mi4zNS4xCgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K bGludXgtYW1sb2dpYyBtYWlsaW5nIGxpc3QKbGludXgtYW1sb2dpY0BsaXN0cy5pbmZyYWRlYWQu b3JnCmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8vbGludXgtYW1s b2dpYwo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id ECDC1C433FE for ; Sun, 9 Oct 2022 23:56:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=ijIa9gtYiMXi6+FH2JPlx4c5sF/vR7wXiZAija+m2SM=; b=1IIWCsv0Kb9nAd 5fkUqSYMtu8MXUU3hRFENtVI68H2mX/lNmC+VFgjl5vTWa37SlIgHLYoFHrV2iNWxiGWLIa1mKw/Y vI8tcxJ3i8AqaGBDmm+D0J4RtjxLHV/WXK8AHVRlS8R+bjmptY/uaKoSweORJzxyW+SRGuQjPlPim vX6IHt18CIjBNUzvJZY5QVrTXslALMmCA0uk7tp5HvbyoraG7Ms/hK1Ep0h7fm9q6XXAg2rX+6PNO nrpOxuPlK1zKleA6RIBZHF4htj0qkhhPtuabuh/WPPTE2sD6KIJiG9prll3d/6NjXSGLTIjCKg6+2 tJVOk4wTa7avn5i/qLtQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1ohg8h-00GUBR-NQ; Sun, 09 Oct 2022 23:55:24 +0000 Received: from ams.source.kernel.org ([145.40.68.75]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1ohg8a-00GU7M-Q6; Sun, 09 Oct 2022 23:55:19 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6C9A1B80DE9; Sun, 9 Oct 2022 23:55:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 090BBC43470; Sun, 9 Oct 2022 23:55:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1665359714; bh=UYP2oKc4P3SHCiQi03PA0B37xuoGOAcj8Lm2E2okRUA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Np238c4xZ/p1su1a8Q6tLhBBfFFlF/ui0VsAHizZmCyRl+HBuEzwSAlBO7Tgyfb+p dYI6Wymt6KBxPohb44831c0LB0sudBMYa1zVsgychw5T8tJcxRWDRlAWDqwMFHD5oz r8Ce0g4gTtH4S9PFjd0WFkhYJ7gjZYsXQD6NUOSGsV7UnZUIN9u6+X/pkJt9G4ZwiR pAyi5IVJ6ztZ0A3pYqghT4Lf1n34XXkiHB4MiPqbHqK50n9J5W1HE5PHCHo5DfKjhb TTE4s0s2usoYsGToeULHGXLPe8BKGavvCYgp3iNFuOmXaTeyurod2MlcdmBrjQlqyo n5fv5uT53AylQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: =?UTF-8?q?Adri=C3=A1n=20Larumbe?= , Neil Armstrong , Sasha Levin , airlied@gmail.com, daniel@ffwll.ch, khilman@baylibre.com, dri-devel@lists.freedesktop.org, linux-amlogic@lists.infradead.org, linux-arm-kernel@lists.infradead.org Subject: [PATCH AUTOSEL 5.15 19/25] drm/meson: reorder driver deinit sequence to fix use-after-free bug Date: Sun, 9 Oct 2022 19:54:19 -0400 Message-Id: <20221009235426.1231313-19-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221009235426.1231313-1-sashal@kernel.org> References: <20221009235426.1231313-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20221009_165517_205873_2DF9B01A X-CRM114-Status: GOOD ( 14.82 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org RnJvbTogQWRyacOhbiBMYXJ1bWJlIDxhZHJpYW4ubGFydW1iZUBjb2xsYWJvcmEuY29tPgoKWyBV cHN0cmVhbSBjb21taXQgMzFjNTE5OTgxZWIxNDFjN2VjMzliZmQ1YmUyNWQzNWYwMmVkYjg2OCBd CgpVbmxvYWRpbmcgdGhlIGRyaXZlciB0cmlnZ2VycyB0aGUgZm9sbG93aW5nIEtBU0FOIHdhcm5p bmc6CgpbICArMC4wMDYyNzVdID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KWyAgKzAuMDAwMDI5XSBCVUc6IEtBU0FOOiB1c2UtYWZ0 ZXItZnJlZSBpbiBfX2xpc3RfZGVsX2VudHJ5X3ZhbGlkKzB4ZTAvMHgxYTAKWyAgKzAuMDAwMDI2 XSBSZWFkIG9mIHNpemUgOCBhdCBhZGRyIGZmZmYwMDAwMjBjMzk1ZTAgYnkgdGFzayBybW1vZC8y Njk1CgpbICArMC4wMDAwMTldIENQVTogNSBQSUQ6IDI2OTUgQ29tbTogcm1tb2QgVGFpbnRlZDog RyAgICAgICAgIEMgTyAgICAgIDUuMTkuMC1yYzYtbHJtYmthc2FuKyAjMQpbICArMC4wMDAwMTNd IEhhcmR3YXJlIG5hbWU6IEhhcmRrZXJuZWwgT0RST0lELU4yUGx1cyAoRFQpClsgICswLjAwMDAw OF0gQ2FsbCB0cmFjZToKWyAgKzAuMDAwMDA3XSAgZHVtcF9iYWNrdHJhY2UrMHgxZWMvMHgyODAK WyAgKzAuMDAwMDEzXSAgc2hvd19zdGFjaysweDI0LzB4ODAKWyAgKzAuMDAwMDA4XSAgZHVtcF9z dGFja19sdmwrMHg5OC8weGQ0ClsgICswLjAwMDAxMV0gIHByaW50X2FkZHJlc3NfZGVzY3JpcHRp b24uY29uc3Rwcm9wLjArMHg4MC8weDUyMApbICArMC4wMDAwMTFdICBwcmludF9yZXBvcnQrMHgx MjgvMHgyNjAKWyAgKzAuMDAwMDA3XSAga2FzYW5fcmVwb3J0KzB4YjgvMHhmYwpbICArMC4wMDAw MDhdICBfX2FzYW5fcmVwb3J0X2xvYWQ4X25vYWJvcnQrMHgzYy8weDUwClsgICswLjAwMDAxMF0g IF9fbGlzdF9kZWxfZW50cnlfdmFsaWQrMHhlMC8weDFhMApbICArMC4wMDAwMDldICBkcm1fYXRv bWljX3ByaXZhdGVfb2JqX2ZpbmkrMHgzMC8weDIwMCBbZHJtXQpbICArMC4wMDAxNzJdICBkcm1f YnJpZGdlX2RldGFjaCsweDk0LzB4MjYwIFtkcm1dClsgICswLjAwMDE0NV0gIGRybV9lbmNvZGVy X2NsZWFudXArMHhhNC8weDI5MCBbZHJtXQpbICArMC4wMDAxNDRdICBkcm1fbW9kZV9jb25maWdf Y2xlYW51cCsweDExOC8weDc0MCBbZHJtXQpbICArMC4wMDAxNDNdICBkcm1fbW9kZV9jb25maWdf aW5pdF9yZWxlYXNlKzB4MWMvMHgyYyBbZHJtXQpbICArMC4wMDAxNDRdICBkcm1fbWFuYWdlZF9y ZWxlYXNlKzB4MTcwLzB4NDE0IFtkcm1dClsgICswLjAwMDE0Ml0gIGRybV9kZXZfcHV0LnBhcnQu MCsweGMwLzB4MTI0IFtkcm1dClsgICswLjAwMDE0M10gIGRybV9kZXZfcHV0KzB4MjAvMHgzMCBb ZHJtXQpbICArMC4wMDAxNDJdICBtZXNvbl9kcnZfdW5iaW5kKzB4MWQ4LzB4MmFjIFttZXNvbl9k cm1dClsgICswLjAwMDAyOF0gIHRha2VfZG93bl9hZ2dyZWdhdGVfZGV2aWNlKzB4YjAvMHgxNjAK WyAgKzAuMDAwMDE2XSAgY29tcG9uZW50X2RlbCsweDE4Yy8weDM2MApbICArMC4wMDAwMDldICBt ZXNvbl9kd19oZG1pX3JlbW92ZSsweDI4LzB4NDAgW21lc29uX2R3X2hkbWldClsgICswLjAwMDAx NV0gIHBsYXRmb3JtX3JlbW92ZSsweDY0LzB4YjAKWyAgKzAuMDAwMDA5XSAgZGV2aWNlX3JlbW92 ZSsweGI4LzB4MTU0ClsgICswLjAwMDAwOV0gIGRldmljZV9yZWxlYXNlX2RyaXZlcl9pbnRlcm5h bCsweDM5OC8weDViMApbICArMC4wMDAwMDldICBkcml2ZXJfZGV0YWNoKzB4YWMvMHgxYjAKWyAg KzAuMDAwMDA5XSAgYnVzX3JlbW92ZV9kcml2ZXIrMHgxNTgvMHgyOWMKWyAgKzAuMDAwMDA5XSAg ZHJpdmVyX3VucmVnaXN0ZXIrMHg3MC8weGIwClsgICswLjAwMDAwOF0gIHBsYXRmb3JtX2RyaXZl cl91bnJlZ2lzdGVyKzB4MjAvMHgyYwpbICArMC4wMDAwMDhdICBtZXNvbl9kd19oZG1pX3BsYXRm b3JtX2RyaXZlcl9leGl0KzB4MWMvMHgzMCBbbWVzb25fZHdfaGRtaV0KWyAgKzAuMDAwMDEyXSAg X19kb19zeXNfZGVsZXRlX21vZHVsZSsweDI4OC8weDQwMApbICArMC4wMDAwMTFdICBfX2FybTY0 X3N5c19kZWxldGVfbW9kdWxlKzB4NWMvMHg4MApbICArMC4wMDAwMDldICBpbnZva2Vfc3lzY2Fs bCsweDc0LzB4MjYwClsgICswLjAwMDAwOV0gIGVsMF9zdmNfY29tbW9uLmNvbnN0cHJvcC4wKzB4 Y2MvMHgyNjAKWyAgKzAuMDAwMDA5XSAgZG9fZWwwX3N2YysweDUwLzB4NzAKWyAgKzAuMDAwMDA3 XSAgZWwwX3N2YysweDY4LzB4MWEwClsgICswLjAwMDAxMl0gIGVsMHRfNjRfc3luY19oYW5kbGVy KzB4MTFjLzB4MTUwClsgICswLjAwMDAwOF0gIGVsMHRfNjRfc3luYysweDE4Yy8weDE5MAoKWyAg KzAuMDAwMDE4XSBBbGxvY2F0ZWQgYnkgdGFzayAwOgpbICArMC4wMDAwMDddIChzdGFjayBpcyBu b3QgYXZhaWxhYmxlKQoKWyAgKzAuMDAwMDExXSBGcmVlZCBieSB0YXNrIDI2OTU6ClsgICswLjAw MDAwOF0gIGthc2FuX3NhdmVfc3RhY2srMHgyYy8weDVjClsgICswLjAwMDAxMV0gIGthc2FuX3Nl dF90cmFjaysweDJjLzB4NDAKWyAgKzAuMDAwMDA4XSAga2FzYW5fc2V0X2ZyZWVfaW5mbysweDI4 LzB4NTAKWyAgKzAuMDAwMDA5XSAgX19fX2thc2FuX3NsYWJfZnJlZSsweDEyOC8weDFkNApbICAr MC4wMDAwMDhdICBfX2thc2FuX3NsYWJfZnJlZSsweDE4LzB4MjQKWyAgKzAuMDAwMDA3XSAgc2xh Yl9mcmVlX2ZyZWVsaXN0X2hvb2srMHgxMDgvMHgyMzAKWyAgKzAuMDAwMDExXSAga2ZyZWUrMHgx MTAvMHgzNWMKWyAgKzAuMDAwMDA4XSAgcmVsZWFzZV9ub2RlcysweGYwLzB4MTZjClsgICswLjAw MDAwOV0gIGRldnJlc19yZWxlYXNlX2dyb3VwKzB4MTgwLzB4MjcwClsgICswLjAwMDAwOF0gIGNv bXBvbmVudF91bmJpbmQrMHgxMjgvMHgxZTAKWyAgKzAuMDAwMDEwXSAgY29tcG9uZW50X3VuYmlu ZF9hbGwrMHgxYjgvMHgyNjQKWyAgKzAuMDAwMDA5XSAgbWVzb25fZHJ2X3VuYmluZCsweDFhMC8w eDJhYyBbbWVzb25fZHJtXQpbICArMC4wMDAwMjVdICB0YWtlX2Rvd25fYWdncmVnYXRlX2Rldmlj ZSsweGIwLzB4MTYwClsgICswLjAwMDAwOV0gIGNvbXBvbmVudF9kZWwrMHgxOGMvMHgzNjAKWyAg KzAuMDAwMDA5XSAgbWVzb25fZHdfaGRtaV9yZW1vdmUrMHgyOC8weDQwIFttZXNvbl9kd19oZG1p XQpbICArMC4wMDAwMTJdICBwbGF0Zm9ybV9yZW1vdmUrMHg2NC8weGIwClsgICswLjAwMDAwOF0g IGRldmljZV9yZW1vdmUrMHhiOC8weDE1NApbICArMC4wMDAwMDldICBkZXZpY2VfcmVsZWFzZV9k cml2ZXJfaW50ZXJuYWwrMHgzOTgvMHg1YjAKWyAgKzAuMDAwMDA5XSAgZHJpdmVyX2RldGFjaCsw eGFjLzB4MWIwClsgICswLjAwMDAwOV0gIGJ1c19yZW1vdmVfZHJpdmVyKzB4MTU4LzB4MjljClsg ICswLjAwMDAwOF0gIGRyaXZlcl91bnJlZ2lzdGVyKzB4NzAvMHhiMApbICArMC4wMDAwMDhdICBw bGF0Zm9ybV9kcml2ZXJfdW5yZWdpc3RlcisweDIwLzB4MmMKWyAgKzAuMDAwMDA4XSAgbWVzb25f ZHdfaGRtaV9wbGF0Zm9ybV9kcml2ZXJfZXhpdCsweDFjLzB4MzAgW21lc29uX2R3X2hkbWldClsg ICswLjAwMDAxMV0gIF9fZG9fc3lzX2RlbGV0ZV9tb2R1bGUrMHgyODgvMHg0MDAKWyAgKzAuMDAw MDEwXSAgX19hcm02NF9zeXNfZGVsZXRlX21vZHVsZSsweDVjLzB4ODAKWyAgKzAuMDAwMDA4XSAg aW52b2tlX3N5c2NhbGwrMHg3NC8weDI2MApbICArMC4wMDAwMDhdICBlbDBfc3ZjX2NvbW1vbi5j b25zdHByb3AuMCsweGNjLzB4MjYwClsgICswLjAwMDAwOF0gIGRvX2VsMF9zdmMrMHg1MC8weDcw ClsgICswLjAwMDAwN10gIGVsMF9zdmMrMHg2OC8weDFhMApbICArMC4wMDAwMDldICBlbDB0XzY0 X3N5bmNfaGFuZGxlcisweDExYy8weDE1MApbICArMC4wMDAwMDldICBlbDB0XzY0X3N5bmMrMHgx OGMvMHgxOTAKClsgICswLjAwMDAxNF0gVGhlIGJ1Z2d5IGFkZHJlc3MgYmVsb25ncyB0byB0aGUg b2JqZWN0IGF0IGZmZmYwMDAwMjBjMzkwMDAKICAgICAgICAgICAgICAgd2hpY2ggYmVsb25ncyB0 byB0aGUgY2FjaGUga21hbGxvYy00ayBvZiBzaXplIDQwOTYKWyAgKzAuMDAwMDA4XSBUaGUgYnVn Z3kgYWRkcmVzcyBpcyBsb2NhdGVkIDE1MDQgYnl0ZXMgaW5zaWRlIG9mCiAgICAgICAgICAgICAg IDQwOTYtYnl0ZSByZWdpb24gW2ZmZmYwMDAwMjBjMzkwMDAsIGZmZmYwMDAwMjBjM2EwMDApCgpb ICArMC4wMDAwMTZdIFRoZSBidWdneSBhZGRyZXNzIGJlbG9uZ3MgdG8gdGhlIHBoeXNpY2FsIHBh Z2U6ClsgICswLjAwMDAwOV0gcGFnZTpmZmZmZmMwMDAwODMwZTAwIHJlZmNvdW50OjEgbWFwY291 bnQ6MCBtYXBwaW5nOjAwMDAwMDAwMDAwMDAwMDAgaW5kZXg6MHgwIHBmbjoweDIwYzM4ClsgICsw LjAwMDAxM10gaGVhZDpmZmZmZmMwMDAwODMwZTAwIG9yZGVyOjMgY29tcG91bmRfbWFwY291bnQ6 MCBjb21wb3VuZF9waW5jb3VudDowClsgICswLjAwMDAwOF0gZmxhZ3M6IDB4ZmZmZjAwMDAwMDEw MjAwKHNsYWJ8aGVhZHxub2RlPTB8em9uZT0wfGxhc3RjcHVwaWQ9MHhmZmZmKQpbICArMC4wMDAw MTldIHJhdzogMGZmZmYwMDAwMDAxMDIwMCBmZmZmZmMwMDAwZmQ0ODA4IGZmZmZmYzAwMDAxMjYy MDggZmZmZjAwMDAwMDAwMmU4MApbICArMC4wMDAwMDldIHJhdzogMDAwMDAwMDAwMDAwMDAwMCAw MDAwMDAwMDAwMDIwMDAyIDAwMDAwMDAxZmZmZmZmZmYgMDAwMDAwMDAwMDAwMDAwMApbICArMC4w MDAwMDhdIHBhZ2UgZHVtcGVkIGJlY2F1c2U6IGthc2FuOiBiYWQgYWNjZXNzIGRldGVjdGVkCgpb ICArMC4wMDAwMTFdIE1lbW9yeSBzdGF0ZSBhcm91bmQgdGhlIGJ1Z2d5IGFkZHJlc3M6ClsgICsw LjAwMDAwOF0gIGZmZmYwMDAwMjBjMzk0ODA6IGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZi IGZiIGZiIGZiIGZiIGZiIGZiClsgICswLjAwMDAwN10gIGZmZmYwMDAwMjBjMzk1MDA6IGZiIGZi IGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiClsgICswLjAwMDAwN10g PmZmZmYwMDAwMjBjMzk1ODA6IGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZiIGZi IGZiIGZiIGZiClsgICswLjAwMDAwN10gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIF4KWyAgKzAuMDAwMDA3XSAgZmZmZjAwMDAyMGMzOTYwMDog ZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIKWyAgKzAuMDAw MDA3XSAgZmZmZjAwMDAyMGMzOTY4MDogZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIg ZmIgZmIgZmIgZmIgZmIKWyAgKzAuMDAwMDA2XSA9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KClRoZSByZWFzb24gdGhpcyBp cyBoYXBwZW5pbmcgaXMgdW5sb2FkaW5nIG1lc29uLWR3LWhkbWkgd2lsbCBjYXVzZSB0aGUKY29t cG9uZW50IEFQSSB0byB0YWtlIGRvd24gdGhlIGFnZ3JlZ2F0ZSBkZXZpY2UsIHdoaWNoIGluIHR1 cm4gd2lsbCBjYXVzZQphbGwgZGV2cmVzLW1hbmFnZWQgbWVtb3J5IHRvIGJlIGZyZWVkLCBpbmNs dWRpbmcgdGhlIHN0cnVjdCBkd19oZG1pCmFsbG9jYXRlZCBpbiBkd19oZG1pX3Byb2JlLiBUaGlz IHN0cnVjdCBlbWJlZHMgYSBzdHJ1Y3QgZHJtX2JyaWRnZSB0aGF0IGlzCmFkZGVkIGF0IHRoZSBl bmQgb2YgdGhlIGZ1bmN0aW9uLCBhbmQgd2hpY2ggaXMgbGF0ZXIgb24gcGlja2VkIHVwIGluCm1l c29uX2VuY29kZXJfaGRtaV9pbml0LgoKSG93ZXZlciwgd2hlbiBhdHRhY2hpbmcgdGhlIGJyaWRn ZSB0byB0aGUgZW5jb2RlciBjcmVhdGVkIGluCm1lc29uX2VuY29kZXJfaGRtaV9pbml0LCBpdCdz IGxpbmtlZCB0byB0aGUgZW5jb2RlcidzIGJyaWRnZSBjaGFpbiwgZnJvbQp3aGVyZSBpdCBuZXZl ciBsZWF2ZXMsIGV2ZW4gYWZ0ZXIgZGV2cmVzX3JlbGVhc2VfZ3JvdXAgaXMgY2FsbGVkIHdoZW4g dGhlCmRyaXZlcidzIGNvbXBvbmVudHMgYXJlIHVuYm91bmQgYW5kIHRoZSBlbWJlZGRpbmcgc3Ry dWN0dXJlIGZyZWVkLgoKVGhlbiwgd2hlbiBjYWxsaW5nIGRybV9kZXZfcHV0IGluIHRoZSBhZ2dy ZWdhdGUgZHJpdmVyJ3MgdW5iaW5kIGZ1bmN0aW9uLApkcm1fYnJpZGdlX2RldGFjaCBpcyBjYWxs ZWQgZm9yIGV2ZXJ5IHNpbmdsZSBicmlkZ2UgbGlua2VkIHRvIHRoZSBlbmNvZGVyLAppbmNsdWRp bmcgdGhlIG9uZSB3aG9zZSBtZW1vcnkgaGFkIGFscmVhZHkgYmVlbiBkZWFsbG9jYXRlZC4KCkZp eCBieSBjYWxsaW5nIGNvbXBvbmVudF91bmJpbmRfYWxsIGFmdGVyIGRybV9kZXZfcHV0LgoKU2ln bmVkLW9mZi1ieTogQWRyacOhbiBMYXJ1bWJlIDxhZHJpYW4ubGFydW1iZUBjb2xsYWJvcmEuY29t PgpSZXZpZXdlZC1ieTogTmVpbCBBcm1zdHJvbmcgPG5laWwuYXJtc3Ryb25nQGxpbmFyby5vcmc+ ClNpZ25lZC1vZmYtYnk6IE5laWwgQXJtc3Ryb25nIDxuZWlsLmFybXN0cm9uZ0BsaW5hcm8ub3Jn PgpMaW5rOiBodHRwczovL3BhdGNod29yay5mcmVlZGVza3RvcC5vcmcvcGF0Y2gvbXNnaWQvMjAy MjA5MTkwMTA5NDAuNDE5ODkzLTItYWRyaWFuLmxhcnVtYmVAY29sbGFib3JhLmNvbQpTaWduZWQt b2ZmLWJ5OiBTYXNoYSBMZXZpbiA8c2FzaGFsQGtlcm5lbC5vcmc+Ci0tLQogZHJpdmVycy9ncHUv ZHJtL21lc29uL21lc29uX2Rydi5jIHwgMiArLQogMSBmaWxlIGNoYW5nZWQsIDEgaW5zZXJ0aW9u KCspLCAxIGRlbGV0aW9uKC0pCgpkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL21lc29uL21l c29uX2Rydi5jIGIvZHJpdmVycy9ncHUvZHJtL21lc29uL21lc29uX2Rydi5jCmluZGV4IGE1NjYw NzUwMWQzNi4uNTZjN2RhZWIxMTZhIDEwMDY0NAotLS0gYS9kcml2ZXJzL2dwdS9kcm0vbWVzb24v bWVzb25fZHJ2LmMKKysrIGIvZHJpdmVycy9ncHUvZHJtL21lc29uL21lc29uX2Rydi5jCkBAIC0z ODcsOSArMzg3LDkgQEAgc3RhdGljIHZvaWQgbWVzb25fZHJ2X3VuYmluZChzdHJ1Y3QgZGV2aWNl ICpkZXYpCiAJZHJtX2Rldl91bnJlZ2lzdGVyKGRybSk7CiAJZHJtX2ttc19oZWxwZXJfcG9sbF9m aW5pKGRybSk7CiAJZHJtX2F0b21pY19oZWxwZXJfc2h1dGRvd24oZHJtKTsKLQljb21wb25lbnRf dW5iaW5kX2FsbChkZXYsIGRybSk7CiAJZnJlZV9pcnEocHJpdi0+dnN5bmNfaXJxLCBkcm0pOwog CWRybV9kZXZfcHV0KGRybSk7CisJY29tcG9uZW50X3VuYmluZF9hbGwoZGV2LCBkcm0pOwogCiAJ aWYgKHByaXYtPmFmYmNkLm9wcykKIAkJcHJpdi0+YWZiY2Qub3BzLT5leGl0KHByaXYpOwotLSAK Mi4zNS4xCgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K bGludXgtYXJtLWtlcm5lbCBtYWlsaW5nIGxpc3QKbGludXgtYXJtLWtlcm5lbEBsaXN0cy5pbmZy YWRlYWQub3JnCmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8vbGlu dXgtYXJtLWtlcm5lbAo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AAD80C433FE for ; Mon, 10 Oct 2022 00:22:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231557AbiJJAWu (ORCPT ); Sun, 9 Oct 2022 20:22:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47184 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232370AbiJJAVG (ORCPT ); Sun, 9 Oct 2022 20:21:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 41CB9399DF; Sun, 9 Oct 2022 16:55:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B9DBA60D57; Sun, 9 Oct 2022 23:55:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 090BBC43470; Sun, 9 Oct 2022 23:55:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1665359714; bh=UYP2oKc4P3SHCiQi03PA0B37xuoGOAcj8Lm2E2okRUA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Np238c4xZ/p1su1a8Q6tLhBBfFFlF/ui0VsAHizZmCyRl+HBuEzwSAlBO7Tgyfb+p dYI6Wymt6KBxPohb44831c0LB0sudBMYa1zVsgychw5T8tJcxRWDRlAWDqwMFHD5oz r8Ce0g4gTtH4S9PFjd0WFkhYJ7gjZYsXQD6NUOSGsV7UnZUIN9u6+X/pkJt9G4ZwiR pAyi5IVJ6ztZ0A3pYqghT4Lf1n34XXkiHB4MiPqbHqK50n9J5W1HE5PHCHo5DfKjhb TTE4s0s2usoYsGToeULHGXLPe8BKGavvCYgp3iNFuOmXaTeyurod2MlcdmBrjQlqyo n5fv5uT53AylQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: =?UTF-8?q?Adri=C3=A1n=20Larumbe?= , Neil Armstrong , Sasha Levin , airlied@gmail.com, daniel@ffwll.ch, khilman@baylibre.com, dri-devel@lists.freedesktop.org, linux-amlogic@lists.infradead.org, linux-arm-kernel@lists.infradead.org Subject: [PATCH AUTOSEL 5.15 19/25] drm/meson: reorder driver deinit sequence to fix use-after-free bug Date: Sun, 9 Oct 2022 19:54:19 -0400 Message-Id: <20221009235426.1231313-19-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221009235426.1231313-1-sashal@kernel.org> References: <20221009235426.1231313-1-sashal@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Adrián Larumbe [ Upstream commit 31c519981eb141c7ec39bfd5be25d35f02edb868 ] Unloading the driver triggers the following KASAN warning: [ +0.006275] ============================================================= [ +0.000029] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0x1a0 [ +0.000026] Read of size 8 at addr ffff000020c395e0 by task rmmod/2695 [ +0.000019] CPU: 5 PID: 2695 Comm: rmmod Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1 [ +0.000013] Hardware name: Hardkernel ODROID-N2Plus (DT) [ +0.000008] Call trace: [ +0.000007] dump_backtrace+0x1ec/0x280 [ +0.000013] show_stack+0x24/0x80 [ +0.000008] dump_stack_lvl+0x98/0xd4 [ +0.000011] print_address_description.constprop.0+0x80/0x520 [ +0.000011] print_report+0x128/0x260 [ +0.000007] kasan_report+0xb8/0xfc [ +0.000008] __asan_report_load8_noabort+0x3c/0x50 [ +0.000010] __list_del_entry_valid+0xe0/0x1a0 [ +0.000009] drm_atomic_private_obj_fini+0x30/0x200 [drm] [ +0.000172] drm_bridge_detach+0x94/0x260 [drm] [ +0.000145] drm_encoder_cleanup+0xa4/0x290 [drm] [ +0.000144] drm_mode_config_cleanup+0x118/0x740 [drm] [ +0.000143] drm_mode_config_init_release+0x1c/0x2c [drm] [ +0.000144] drm_managed_release+0x170/0x414 [drm] [ +0.000142] drm_dev_put.part.0+0xc0/0x124 [drm] [ +0.000143] drm_dev_put+0x20/0x30 [drm] [ +0.000142] meson_drv_unbind+0x1d8/0x2ac [meson_drm] [ +0.000028] take_down_aggregate_device+0xb0/0x160 [ +0.000016] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000015] platform_remove+0x64/0xb0 [ +0.000009] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000009] driver_unregister+0x70/0xb0 [ +0.000008] platform_driver_unregister+0x20/0x2c [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000012] __do_sys_delete_module+0x288/0x400 [ +0.000011] __arm64_sys_delete_module+0x5c/0x80 [ +0.000009] invoke_syscall+0x74/0x260 [ +0.000009] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000009] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000012] el0t_64_sync_handler+0x11c/0x150 [ +0.000008] el0t_64_sync+0x18c/0x190 [ +0.000018] Allocated by task 0: [ +0.000007] (stack is not available) [ +0.000011] Freed by task 2695: [ +0.000008] kasan_save_stack+0x2c/0x5c [ +0.000011] kasan_set_track+0x2c/0x40 [ +0.000008] kasan_set_free_info+0x28/0x50 [ +0.000009] ____kasan_slab_free+0x128/0x1d4 [ +0.000008] __kasan_slab_free+0x18/0x24 [ +0.000007] slab_free_freelist_hook+0x108/0x230 [ +0.000011] kfree+0x110/0x35c [ +0.000008] release_nodes+0xf0/0x16c [ +0.000009] devres_release_group+0x180/0x270 [ +0.000008] component_unbind+0x128/0x1e0 [ +0.000010] component_unbind_all+0x1b8/0x264 [ +0.000009] meson_drv_unbind+0x1a0/0x2ac [meson_drm] [ +0.000025] take_down_aggregate_device+0xb0/0x160 [ +0.000009] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000012] platform_remove+0x64/0xb0 [ +0.000008] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000008] driver_unregister+0x70/0xb0 [ +0.000008] platform_driver_unregister+0x20/0x2c [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000011] __do_sys_delete_module+0x288/0x400 [ +0.000010] __arm64_sys_delete_module+0x5c/0x80 [ +0.000008] invoke_syscall+0x74/0x260 [ +0.000008] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000008] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000009] el0t_64_sync_handler+0x11c/0x150 [ +0.000009] el0t_64_sync+0x18c/0x190 [ +0.000014] The buggy address belongs to the object at ffff000020c39000 which belongs to the cache kmalloc-4k of size 4096 [ +0.000008] The buggy address is located 1504 bytes inside of 4096-byte region [ffff000020c39000, ffff000020c3a000) [ +0.000016] The buggy address belongs to the physical page: [ +0.000009] page:fffffc0000830e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20c38 [ +0.000013] head:fffffc0000830e00 order:3 compound_mapcount:0 compound_pincount:0 [ +0.000008] flags: 0xffff00000010200(slab|head|node=0|zone=0|lastcpupid=0xffff) [ +0.000019] raw: 0ffff00000010200 fffffc0000fd4808 fffffc0000126208 ffff000000002e80 [ +0.000009] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ +0.000008] page dumped because: kasan: bad access detected [ +0.000011] Memory state around the buggy address: [ +0.000008] ffff000020c39480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ffff000020c39500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] >ffff000020c39580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ^ [ +0.000007] ffff000020c39600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ffff000020c39680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000006] ================================================================== The reason this is happening is unloading meson-dw-hdmi will cause the component API to take down the aggregate device, which in turn will cause all devres-managed memory to be freed, including the struct dw_hdmi allocated in dw_hdmi_probe. This struct embeds a struct drm_bridge that is added at the end of the function, and which is later on picked up in meson_encoder_hdmi_init. However, when attaching the bridge to the encoder created in meson_encoder_hdmi_init, it's linked to the encoder's bridge chain, from where it never leaves, even after devres_release_group is called when the driver's components are unbound and the embedding structure freed. Then, when calling drm_dev_put in the aggregate driver's unbind function, drm_bridge_detach is called for every single bridge linked to the encoder, including the one whose memory had already been deallocated. Fix by calling component_unbind_all after drm_dev_put. Signed-off-by: Adrián Larumbe Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220919010940.419893-2-adrian.larumbe@collabora.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/meson/meson_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c index a56607501d36..56c7daeb116a 100644 --- a/drivers/gpu/drm/meson/meson_drv.c +++ b/drivers/gpu/drm/meson/meson_drv.c @@ -387,9 +387,9 @@ static void meson_drv_unbind(struct device *dev) drm_dev_unregister(drm); drm_kms_helper_poll_fini(drm); drm_atomic_helper_shutdown(drm); - component_unbind_all(dev, drm); free_irq(priv->vsync_irq, drm); drm_dev_put(drm); + component_unbind_all(dev, drm); if (priv->afbcd.ops) priv->afbcd.ops->exit(priv); -- 2.35.1