| Message ID | 20241231-hotplug-drm-bridge-v5-9-173065a1ece1@bootlin.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Add support for hot-pluggable DRM bridges | expand |
On Tue, Dec 31, 2024 at 11:40:03AM +0100, Luca Ceresoli wrote: > Refcount the out_bridge to avoid a use-after-free in case it is > hot-unplugged. > > Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> > > --- > > This patch was added in v5. > --- > drivers/gpu/drm/bridge/samsung-dsim.c | 11 ++++++++--- > 1 file changed, 8 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c > index c4d1563fd32019efde523dfc0863be044c05a826..4d32c453265931b5aecdc125623368fecacf4be3 100644 > --- a/drivers/gpu/drm/bridge/samsung-dsim.c > +++ b/drivers/gpu/drm/bridge/samsung-dsim.c > @@ -1756,6 +1756,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host, > return ret; > } > > + drm_bridge_get(out_bridge); Well... out_bridge might already be gone now. You got the pointer, but it is not protected in any way. Gone. > dsi->out_bridge = out_bridge; > > DRM_DEV_INFO(dev, "Attached %s device (lanes:%d bpp:%d mode-flags:0x%lx)\n", > @@ -1774,13 +1775,13 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host, > if (!(device->mode_flags & MIPI_DSI_MODE_VIDEO)) { > ret = samsung_dsim_register_te_irq(dsi, &device->dev); > if (ret) > - return ret; > + goto err_put_bridge; > } > > if (pdata->host_ops && pdata->host_ops->attach) { > ret = pdata->host_ops->attach(dsi, device); > if (ret) > - return ret; > + goto err_put_bridge; > } > > dsi->lanes = device->lanes; > @@ -1788,6 +1789,10 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host, > dsi->mode_flags = device->mode_flags; > > return 0; > + > +err_put_bridge: > + drm_bridge_put_and_clear(dsi->out_bridge); > + return ret; > } > > static void samsung_dsim_unregister_te_irq(struct samsung_dsim *dsi) > @@ -1804,7 +1809,7 @@ static int samsung_dsim_host_detach(struct mipi_dsi_host *host, > struct samsung_dsim *dsi = host_to_dsi(host); > const struct samsung_dsim_plat_data *pdata = dsi->plat_data; > > - dsi->out_bridge = NULL; > + drm_bridge_put_and_clear(dsi->out_bridge); > > if (pdata->host_ops && pdata->host_ops->detach) > pdata->host_ops->detach(dsi, device); > > -- > 2.34.1 >
diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c index c4d1563fd32019efde523dfc0863be044c05a826..4d32c453265931b5aecdc125623368fecacf4be3 100644 --- a/drivers/gpu/drm/bridge/samsung-dsim.c +++ b/drivers/gpu/drm/bridge/samsung-dsim.c @@ -1756,6 +1756,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host, return ret; } + drm_bridge_get(out_bridge); dsi->out_bridge = out_bridge; DRM_DEV_INFO(dev, "Attached %s device (lanes:%d bpp:%d mode-flags:0x%lx)\n", @@ -1774,13 +1775,13 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host, if (!(device->mode_flags & MIPI_DSI_MODE_VIDEO)) { ret = samsung_dsim_register_te_irq(dsi, &device->dev); if (ret) - return ret; + goto err_put_bridge; } if (pdata->host_ops && pdata->host_ops->attach) { ret = pdata->host_ops->attach(dsi, device); if (ret) - return ret; + goto err_put_bridge; } dsi->lanes = device->lanes; @@ -1788,6 +1789,10 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host, dsi->mode_flags = device->mode_flags; return 0; + +err_put_bridge: + drm_bridge_put_and_clear(dsi->out_bridge); + return ret; } static void samsung_dsim_unregister_te_irq(struct samsung_dsim *dsi) @@ -1804,7 +1809,7 @@ static int samsung_dsim_host_detach(struct mipi_dsi_host *host, struct samsung_dsim *dsi = host_to_dsi(host); const struct samsung_dsim_plat_data *pdata = dsi->plat_data; - dsi->out_bridge = NULL; + drm_bridge_put_and_clear(dsi->out_bridge); if (pdata->host_ops && pdata->host_ops->detach) pdata->host_ops->detach(dsi, device);
Refcount the out_bridge to avoid a use-after-free in case it is hot-unplugged. Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> --- This patch was added in v5. --- drivers/gpu/drm/bridge/samsung-dsim.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)