Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1397576
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.19.y-ckt 27/54] drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1() |
| Date | 2016-05-10 02:20 +0200 |
| Message-ID | <rx3z5-871-29@gated-at.bofh.it> (permalink) |
| References | <rx3pn-81T-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.19.8-ckt21 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: "cpaul@redhat.com" <cpaul@redhat.com>
commit 263efde31f97c498e1ebad30e4d2906609d7ad6b upstream.
We can thank KASAN for finding this, otherwise I probably would have spent
hours on it. This fixes a somewhat harder to trigger kernel panic, occuring
while enabling MST where the port we were currently updating the payload on
would have all of it's refs dropped before we finished what we were doing:
==================================================================
BUG: KASAN: use-after-free in drm_dp_update_payload_part1+0xb3f/0xdb0 [drm_kms_helper] at addr ffff8800d29de018
Read of size 4 by task Xorg/973
=============================================================================
BUG kmalloc-2048 (Tainted: G B W ): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper] age=16477 cpu=0 pid=2175
___slab_alloc+0x472/0x490
__slab_alloc+0x20/0x40
kmem_cache_alloc_trace+0x151/0x190
drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper]
drm_dp_send_link_address+0x526/0x960 [drm_kms_helper]
drm_dp_check_and_send_link_address+0x1ac/0x210 [drm_kms_helper]
drm_dp_mst_link_probe_work+0x77/0xd0 [drm_kms_helper]
process_one_work+0x562/0x1350
worker_thread+0xd9/0x1390
kthread+0x1c5/0x260
ret_from_fork+0x22/0x40
INFO: Freed in drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper] age=7521 cpu=0 pid=2175
__slab_free+0x17f/0x2d0
kfree+0x169/0x180
drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper]
drm_dp_destroy_connector_work+0x2b8/0x490 [drm_kms_helper]
process_one_work+0x562/0x1350
worker_thread+0xd9/0x1390
kthread+0x1c5/0x260
ret_from_fork+0x22/0x40
which on this T460s, would eventually lead to kernel panics in somewhat
random places later in intel_mst_enable_dp() if we got lucky enough.
Signed-off-by: Lyude <cpaul@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/drm_dp_mst_topology.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index aab5614..d3a6bed 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1774,6 +1774,11 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr)
req_payload.start_slot = cur_slots;
if (mgr->proposed_vcpis[i]) {
port = container_of(mgr->proposed_vcpis[i], struct drm_dp_mst_port, vcpi);
+ port = drm_dp_get_validated_port_ref(mgr, port);
+ if (!port) {
+ mutex_unlock(&mgr->payload_lock);
+ return -EINVAL;
+ }
req_payload.num_slots = mgr->proposed_vcpis[i]->num_slots;
} else {
port = NULL;
@@ -1799,6 +1804,9 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr)
mgr->payloads[i].payload_state = req_payload.payload_state;
}
cur_slots += req_payload.num_slots;
+
+ if (port)
+ drm_dp_put_port(port);
}
for (i = 0; i < mgr->max_payloads; i++) {
--
2.7.4
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[3.19.y-ckt stable] Linux 3.19.8-ckt21 stable review Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 42/54] x86/sysfb_efi: Fix valid BAR address range check Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 53/54] cxgbi: fix uninitialized flowi6 Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 14/54] mm: split ET_DYN ASLR from mmap ASLR Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 51/54] batman-adv: Reduce refcnt of removed router when updating route Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 18/54] ASoC: dapm: Make sure we have a card when displaying component widgets Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 11/54] s390: standardize mmap_rnd() usage Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 04/54] arm: factor out mmap ASLR into mmap_rnd Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 52/54] batman-adv: Fix broadcast/ogm queue limit on a removed interface Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 31/54] ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 48/54] jme: Do not enable NIC WoL functions on S0 Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 54/54] net/mlx4_en: fix spurious timestamping callbacks Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 12/54] mm: expose arch_mmap_rnd when available Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:10 +0200
[PATCH 3.19.y-ckt 20/54] i2c: cpm: Fix build break due to incompatible pointer types Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 21/54] i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 37/54] Minimal fix-up of bad hashing behavior of hash_64() Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 36/54] powerpc: Fix bad inline asm constraint in create_zero_mask() Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 32/54] IB/security: Restrict use of the write() interface Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 24/54] USB: serial: cp210x: add Straizona Focusers device ids Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 09/54] s390: avoid z13 cache aliasing Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 34/54] mm: vmscan: reclaim highmem zone if buffer_heads is over limit Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 28/54] cxl: Keep IRQ mappings on context teardown Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 26/54] workqueue: fix ghost PENDING flag while doing MQ IO Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 27/54] drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1() Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 29/54] drm/i915: Fix system resume if PCI device remained enabled Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 08/54] powerpc: standardize mmap_rnd() usage Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 40/54] MAINTAINERS: Remove asterisk from EFI directory names Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 41/54] ACPICA: Dispatcher: Update thread ID for recursive method calls Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 47/54] parisc: fix a bug when syscall number of tracee is __NR_Linux_syscalls Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 25/54] ALSA: hda - Add dock support for ThinkPad X260 Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 23/54] USB: serial: cp210x: add ID for Link ECU Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 13/54] s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 30/54] drm/i915/ddi: Fix eDP VDD handling during booting and suspend/resume Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 35/54] EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 06/54] arm64: standardize mmap_rnd() usage Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 43/54] fs/pnode.c: treat zero mnt_group_id-s as unequal Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 44/54] propogate_mnt: Handle the first propogated copy being a slave Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 33/54] mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 10/54] s390/mm: align 64-bit PIE binaries to 4GB Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 17/54] ASoC: rt5640: Correct the digital interface data select Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 46/54] x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 39/54] drm/radeon: make sure vertical front porch is at least 1 Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 19/54] iio: ak8975: Fix NULL pointer exception on early interrupt Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:20 +0200
[PATCH 3.19.y-ckt 07/54] mips: extract logic for mmap_rnd() Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:30 +0200
[PATCH 3.19.y-ckt 01/54] [3.19-stable-only] Revert "powerpc: Update TM user feature bits in scan_features()" Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:30 +0200
Re: [PATCH 3.19.y-ckt 01/54] [3.19-stable-only] Revert "powerpc: Update TM user feature bits in scan_features()" Michael Ellerman <mpe@ellerman.id.au> - 2016-05-10 03:50 +0200
[PATCH 3.19.y-ckt 02/54] [3.19-stable-only] fix backport "KVM: s390: avoid memory overwrites on emergency signal injection" Kamal Mostafa <kamal@canonical.com> - 2016-05-10 02:30 +0200
csiph-web