From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF9CCC433E4 for ; Mon, 20 Jul 2020 13:22:57 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 9D2ED20729 for ; Mon, 20 Jul 2020 13:22:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9D2ED20729 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=pengutronix.de Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 09C7D89DB4; Mon, 20 Jul 2020 13:22:57 +0000 (UTC) Received: from metis.ext.pengutronix.de (metis.ext.pengutronix.de [IPv6:2001:67c:670:201:290:27ff:fe1d:cc33]) by gabe.freedesktop.org (Postfix) with ESMTPS id 9FF1389DB4 for ; Mon, 20 Jul 2020 13:22:55 +0000 (UTC) Received: from lupine.hi.pengutronix.de ([2001:67c:670:100:3ad5:47ff:feaf:1a17] helo=lupine) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jxVkn-0005Q0-0w; Mon, 20 Jul 2020 15:22:49 +0200 Received: from pza by lupine with local (Exim 4.92) (envelope-from ) id 1jxVkl-0006sd-IY; Mon, 20 Jul 2020 15:22:47 +0200 Message-ID: <90a99bbca52358d81f2313dfb3953f6baad12152.camel@pengutronix.de> Subject: Re: [PATCH 1/2] drm/imx: fix use after free From: Philipp Zabel To: Marco Felsch , airlied@linux.ie, daniel@ffwll.ch, shawnguo@kernel.org, stefan@agner.ch, rmk+kernel@armlinux.org.uk Date: Mon, 20 Jul 2020 15:22:47 +0200 In-Reply-To: <20200611124332.20819-1-m.felsch@pengutronix.de> References: <20200611124332.20819-1-m.felsch@pengutronix.de> User-Agent: Evolution 3.30.5-1.1 MIME-Version: 1.0 X-SA-Exim-Connect-IP: 2001:67c:670:100:3ad5:47ff:feaf:1a17 X-SA-Exim-Mail-From: p.zabel@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: dri-devel@lists.freedesktop.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, kernel@pengutronix.de Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Thu, 2020-06-11 at 14:43 +0200, Marco Felsch wrote: > From: Philipp Zabel > > Component driver structures allocated with devm_kmalloc() in bind() are > freed automatically after unbind(). Since the contained drm structures > are accessed afterwards in drm_mode_config_cleanup(), move the > allocation into probe() to extend the driver structure's lifetime to the > lifetime of the device. This should eventually be changed to use drm > resource managed allocations with lifetime of the drm device. > > We also need to ensure that all componets are available during the > unbind() so we need to call component_unbind_all() before we free > non-devres resources like planes. > > Note this patch fixes the the use after free bug but introduces a > possible boot loop issue. The issue is triggered if the HDMI support is > enabled and a component driver always return -EPROBE_DEFER, see > discussion [1] for more details. > > [1] https://lkml.org/lkml/2020/3/24/1467 > > Fixes: 17b5001b5143 ("imx-drm: convert to componentised device support") > Signed-off-by: Philipp Zabel > [m.felsch@pengutronix: fix imx_tve_probe()] > [m.felsch@pengutronix: resort component_unbind_all()) > [m.felsch@pengutronix: adapt commit message] > Signed-off-by: Marco Felsch Thank you, applied to imx-drm/next. regards Philipp _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel