From patchwork Tue Oct 9 21:30:48 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Agner X-Patchwork-Id: 10633299 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 67C2E933 for ; Tue, 9 Oct 2018 21:30:59 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 563282997F for ; Tue, 9 Oct 2018 21:30:59 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 53F8E2994B; Tue, 9 Oct 2018 21:30:59 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id F378B299FE for ; Tue, 9 Oct 2018 21:30:58 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 50E336E325; Tue, 9 Oct 2018 21:30:56 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail.kmu-office.ch (mail.kmu-office.ch [IPv6:2a02:418:6a02::a2]) by gabe.freedesktop.org (Postfix) with ESMTPS id 0E5E86E323 for ; Tue, 9 Oct 2018 21:30:54 +0000 (UTC) Received: from allenwind.lan (unknown [37.17.239.109]) by mail.kmu-office.ch (Postfix) with ESMTPSA id 193E75C05B4; Tue, 9 Oct 2018 23:30:51 +0200 (CEST) From: Stefan Agner To: p.zabel@pengutronix.de, airlied@linux.ie, gregkh@linuxfoundation.org Subject: [PATCH 1/2] component: add optional cleanup function Date: Tue, 9 Oct 2018 23:30:48 +0200 Message-Id: <83a28282a3f745a4cd4ca77d0593ad2e61359a5d.1539120077.git.stefan@agner.ch> X-Mailer: git-send-email 2.19.1 MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-kernel@vger.kernel.org, linux@armlinux.org.uk, dri-devel@lists.freedesktop.org, rafael@kernel.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP Add optional cleanup function on master level. This allows the master to call framework level cleanup functions in case binding of any component failed before the previously successfully bound components get unbound. Signed-off-by: Stefan Agner --- Hi, This is an attempt to fix the issue reported in: "drm/imx: Crash in drm_mode_config_cleanup" -- Stefan drivers/base/component.c | 4 ++++ include/linux/component.h | 1 + 2 files changed, 5 insertions(+) diff --git a/drivers/base/component.c b/drivers/base/component.c index 8946dfee4768..5350d931a663 100644 --- a/drivers/base/component.c +++ b/drivers/base/component.c @@ -535,6 +535,10 @@ int component_bind_all(struct device *master_dev, void *data) break; } + /* Allow the master to call framework cleanup functions */ + if (master->ops->cleanup) + master->ops->cleanup(master->dev); + if (ret != 0) { for (; i--; ) if (!master->match->compare[i].duplicate) { diff --git a/include/linux/component.h b/include/linux/component.h index e71fbbbc74e2..800534b52165 100644 --- a/include/linux/component.h +++ b/include/linux/component.h @@ -24,6 +24,7 @@ struct master; struct component_master_ops { int (*bind)(struct device *master); void (*unbind)(struct device *master); + void (*cleanup)(struct device *master); }; void component_master_del(struct device *, From patchwork Tue Oct 9 21:30:49 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Agner X-Patchwork-Id: 10633297 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8867D933 for ; Tue, 9 Oct 2018 21:30:57 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7A3C729943 for ; Tue, 9 Oct 2018 21:30:57 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 786C2299FD; Tue, 9 Oct 2018 21:30:57 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id A630E29954 for ; Tue, 9 Oct 2018 21:30:56 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 31A1C6E31C; Tue, 9 Oct 2018 21:30:55 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail.kmu-office.ch (mail.kmu-office.ch [IPv6:2a02:418:6a02::a2]) by gabe.freedesktop.org (Postfix) with ESMTPS id 0BBA46E31C for ; Tue, 9 Oct 2018 21:30:54 +0000 (UTC) Received: from allenwind.lan (unknown [37.17.239.109]) by mail.kmu-office.ch (Postfix) with ESMTPSA id 300D15C097A; Tue, 9 Oct 2018 23:30:51 +0200 (CEST) From: Stefan Agner To: p.zabel@pengutronix.de, airlied@linux.ie, gregkh@linuxfoundation.org Subject: [PATCH 2/2] drm/imx: make sure to cleanup DRM before unbinding components Date: Tue, 9 Oct 2018 23:30:49 +0200 Message-Id: X-Mailer: git-send-email 2.19.1 In-Reply-To: <83a28282a3f745a4cd4ca77d0593ad2e61359a5d.1539120077.git.stefan@agner.ch> References: <83a28282a3f745a4cd4ca77d0593ad2e61359a5d.1539120077.git.stefan@agner.ch> MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-kernel@vger.kernel.org, linux@armlinux.org.uk, dri-devel@lists.freedesktop.org, rafael@kernel.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP In situations where a component fails to bind, a previously successfully bound component might already registered itself with the DRM framework (e.g. an encoder). When the master component then calls drm_mode_config_cleanup, we end up in a use after free sitution. Use the cleanup callback to make sure all framework level cleanup is done by the time we unbind components. Signed-off-by: Stefan Agner --- drivers/gpu/drm/imx/imx-drm-core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c index 5ea0c82f9957..b174a0ca9acb 100644 --- a/drivers/gpu/drm/imx/imx-drm-core.c +++ b/drivers/gpu/drm/imx/imx-drm-core.c @@ -288,8 +288,8 @@ static int imx_drm_bind(struct device *dev) err_unbind: #endif component_unbind_all(drm->dev, drm); -err_kms: drm_mode_config_cleanup(drm); +err_kms: drm_dev_put(drm); return ret; @@ -313,9 +313,17 @@ static void imx_drm_unbind(struct device *dev) drm_dev_put(drm); } +static void imx_drm_cleanup(struct device *dev) +{ + struct drm_device *drm = dev_get_drvdata(dev); + + drm_mode_config_cleanup(drm); +} + static const struct component_master_ops imx_drm_ops = { .bind = imx_drm_bind, .unbind = imx_drm_unbind, + .cleanup = imx_drm_cleanup, }; static int imx_drm_platform_probe(struct platform_device *pdev)