mirror of
https://github.com/Ysurac/openmptcprouter.git
synced 2025-02-15 04:42:02 +00:00
40 lines
1.4 KiB
Diff
40 lines
1.4 KiB
Diff
From 1adf064f5c8a44ae56bc609a7648f384363a3df4 Mon Sep 17 00:00:00 2001
|
|
From: Maxime Ripard <maxime@cerno.tech>
|
|
Date: Thu, 21 Oct 2021 13:57:25 +0200
|
|
Subject: [PATCH 612/634] drm/vc4: kms: Clear the HVS FIFO commit pointer once
|
|
done
|
|
|
|
Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a
|
|
commit") introduced a wait on the previous commit done on a given HVS
|
|
FIFO.
|
|
|
|
However, we never cleared that pointer once done. Since
|
|
drm_crtc_commit_put can free the drm_crtc_commit structure directly if
|
|
we were the last user, this means that it can lead to a use-after free
|
|
if we were to duplicate the state, and that stale pointer would even be
|
|
copied to the new state.
|
|
|
|
Set the pointer to NULL once we're done with the wait so that we don't
|
|
carry over a pointer to a free'd structure.
|
|
|
|
Fixes: 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit")
|
|
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
|
|
---
|
|
drivers/gpu/drm/vc4/vc4_kms.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
|
|
index 82462d4c4853..59f10c4d76ae 100644
|
|
--- a/drivers/gpu/drm/vc4/vc4_kms.c
|
|
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
|
|
@@ -391,6 +391,7 @@ static void vc4_atomic_commit_tail(struct drm_atomic_state *state)
|
|
drm_err(dev, "Timed out waiting for commit\n");
|
|
|
|
drm_crtc_commit_put(commit);
|
|
+ old_hvs_state->fifo_state[channel].pending_commit = NULL;
|
|
}
|
|
|
|
if (vc4->hvs && vc4->hvs->hvs5) {
|
|
--
|
|
2.33.1
|
|
|