| Message ID | 1523544152-15241-1-git-send-email-ayan.halder@arm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, Apr 12, 2018 at 03:42:32PM +0100, Ayan Kumar Halder wrote: > In a situation when the reference count of the drm connector is greater than 1, > the unbind function should not invoke drm_connector_cleanup as this will lead > to an inconsistent state where the drm_crtc_state->connector_mask still has > a bitmask referring to the stale connector. Later, when drm driver invokes > drm_atomic_helper_shutdown() which invokes ---> drm_atomic_helper_disable_all() > ---> drm_atomic_commit() --> drm_atomic_check_only() --> > drm_atomic_helper_check() --> drm_atomic_helper_check_modeset(). This returns > an error due to enabled/connectors mismatch. > > In such a scenario, one should just return from _unbind() and let the drm driver > subsequently invoke drm_atomic_helper_shutdown. This will reset the > drm_crtc_state->connector_mask and will shutdown the crtcs. It will also decrement > the reference count of the connectors to 1. Subsequently, drm_mode_config_cleanup > will get invoked which will do the following :- If the device is still in-use after unbind() has been called, that is _very_ bad news, and probably means that the "host" driver is not calling component_unbind() at the right point. Any resources claimed in the bind() callback using devm functions will be freed, which will include (eg) the drm_encoder structure and in fact the drm_connector. So what you have here is a use-after-free bug, and your change does nothing for that. Please fix the "host" driver instead.
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c index 9e67a7b..8ad1cc7 100644 --- a/drivers/gpu/drm/i2c/tda998x_drv.c +++ b/drivers/gpu/drm/i2c/tda998x_drv.c @@ -1709,6 +1709,9 @@ static void tda998x_unbind(struct device *dev, struct device *master, { struct tda998x_priv *priv = dev_get_drvdata(dev); + if (kref_read(&priv->connector.base.refcount) > 1) + return; + drm_connector_cleanup(&priv->connector); drm_encoder_cleanup(&priv->encoder); tda998x_destroy(priv);
In a situation when the reference count of the drm connector is greater than 1, the unbind function should not invoke drm_connector_cleanup as this will lead to an inconsistent state where the drm_crtc_state->connector_mask still has a bitmask referring to the stale connector. Later, when drm driver invokes drm_atomic_helper_shutdown() which invokes ---> drm_atomic_helper_disable_all() ---> drm_atomic_commit() --> drm_atomic_check_only() --> drm_atomic_helper_check() --> drm_atomic_helper_check_modeset(). This returns an error due to enabled/connectors mismatch. In such a scenario, one should just return from _unbind() and let the drm driver subsequently invoke drm_atomic_helper_shutdown. This will reset the drm_crtc_state->connector_mask and will shutdown the crtcs. It will also decrement the reference count of the connectors to 1. Subsequently, drm_mode_config_cleanup will get invoked which will do the following :- 1. Decrement the reference count for each of the connectors. Thus the ref count will reach 0 and drm_connector_funcs->destroy() gets called. Thus, tda998x_connector_destroy() gets invoked which calls drm_connector_cleanup 2. Invokes the destroy callback for each encoder. Thus tda998x_encoder_destroy() gets invoked. Signed-off-by: Ayan Kumar Halder <ayan.halder@arm.com> --- drivers/gpu/drm/i2c/tda998x_drv.c | 3 +++ 1 file changed, 3 insertions(+)