From nobody Fri Apr 10 20:17:13 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1589C32771 for ; Fri, 19 Aug 2022 11:09:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348650AbiHSLJE (ORCPT ); Fri, 19 Aug 2022 07:09:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348596AbiHSLI7 (ORCPT ); Fri, 19 Aug 2022 07:08:59 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D8236C2E9C for ; Fri, 19 Aug 2022 04:08:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1660907336; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZdQAnurZVFdXXS4WbKVSyp7TafzRJAbZ0GKKLX98Mwk=; b=DqyFhg5BfT6E8fRpEieINgE7VboJYRVEDxSsQBt8UnfiLqMhn0yLJgWLZ2nzZvTBAvjCkl /MGh68Z4sSvKtmeWtHyRcUbDjgJYRFF7KfqpBQGcv3dP/73DByubkez9RKjrqBPDDld5TC D4AUU9X8ugqYU/Z2MaUBMCldkfR44yM= Received: from mail-ed1-f70.google.com (mail-ed1-f70.google.com [209.85.208.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-523-AS4SRSMYOiep83MIEzKC3w-1; Fri, 19 Aug 2022 07:08:55 -0400 X-MC-Unique: AS4SRSMYOiep83MIEzKC3w-1 Received: by mail-ed1-f70.google.com with SMTP id v19-20020a056402349300b0043d42b7ddefso2627681edc.13 for ; Fri, 19 Aug 2022 04:08:55 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc; bh=ZdQAnurZVFdXXS4WbKVSyp7TafzRJAbZ0GKKLX98Mwk=; b=lmClUMP3K2jGGoLjrfL4/nLFtpiyrPDEVTsXA3lOwDYyY1O800pG/8lcdRjU693dCv deUqAPWWBsLcZPDW6Y6Hz9p3Fbs920fJaqMn7ZoYj8jrQAuNO4RF6u/85UprI6l20+9Y +p+DLmWvKP05d9u+s65UW0vyaiWZYI0CRIYGWbqDLAKpw5zBc/AREhv7g2At6EdGvln5 VrKJcHOHPd9Bn0pCUSoiMP2H3NXhNKtU95YTXOraTfmuEl/bJoCo0fuZjnJGEYwKWSyG /QX14VaFGIxxFCoSisMsWSRhO7q3gS5PyCQlA/9gi4YGSO8INKLnSqSO6iSTs9SOTAqK AQYA== X-Gm-Message-State: ACgBeo1XMi/n5bv4HXc4bv08+0smc3x1Opu8Wfqc94diw9OMMOrqQhrw JlFC06uCIYHldZpV/3P5iWcyL+2Yk8OaRNmvmEEsIKsqWERpeA5YPRuez/LEwGBwfR9AHj5vRSN gb316a2fJcuOt18I9gCJf+iG0 X-Received: by 2002:a17:907:c10:b0:731:58aa:7783 with SMTP id ga16-20020a1709070c1000b0073158aa7783mr4727747ejc.19.1660907334721; Fri, 19 Aug 2022 04:08:54 -0700 (PDT) X-Google-Smtp-Source: AA6agR6WDs6mnNC4SmZKIMC1pcP1UBsEQ2H0aHnmJU1kPSrf3TZKof2KEiTrd1TmPeGkr3GplEZ4xg== X-Received: by 2002:a17:907:c10:b0:731:58aa:7783 with SMTP id ga16-20020a1709070c1000b0073158aa7783mr4727734ejc.19.1660907334571; Fri, 19 Aug 2022 04:08:54 -0700 (PDT) Received: from pollux.redhat.com ([2a02:810d:4b40:2ee8:642:1aff:fe31:a15c]) by smtp.gmail.com with ESMTPSA id l17-20020a1709060cd100b007308fab3eb7sm2167827ejh.195.2022.08.19.04.08.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 19 Aug 2022 04:08:54 -0700 (PDT) From: Danilo Krummrich To: daniel@ffwll.ch, airlied@linux.ie, tzimmermann@suse.de, mripard@kernel.org Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Danilo Krummrich Subject: [PATCH drm-misc-next v2 1/4] drm/vc4: hdmi: unlock mutex when device is unplugged Date: Fri, 19 Aug 2022 13:08:46 +0200 Message-Id: <20220819110849.192037-2-dakr@redhat.com> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220819110849.192037-1-dakr@redhat.com> References: <20220819110849.192037-1-dakr@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In vc4_hdmi_encoder_{pre,post}_crtc_enable() commit cd00ed5187bf ("drm/vc4: hdmi: Protect device resources after removal") missed to unlock the mutex before returning due to drm_dev_enter() indicating the device being unplugged. Fixes: cd00ed5187bf ("drm/vc4: hdmi: Protect device resources after removal= ") Signed-off-by: Danilo Krummrich --- drivers/gpu/drm/vc4/vc4_hdmi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c index 84e5a91c2ea7..4d3ff51ad2a8 100644 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c @@ -1425,7 +1425,7 @@ static void vc4_hdmi_encoder_pre_crtc_enable(struct d= rm_encoder *encoder, mutex_lock(&vc4_hdmi->mutex); =20 if (!drm_dev_enter(drm, &idx)) - return; + goto out; =20 if (vc4_hdmi->variant->csc_setup) vc4_hdmi->variant->csc_setup(vc4_hdmi, conn_state, mode); @@ -1436,6 +1436,7 @@ static void vc4_hdmi_encoder_pre_crtc_enable(struct d= rm_encoder *encoder, =20 drm_dev_exit(idx); =20 +out: mutex_unlock(&vc4_hdmi->mutex); } =20 @@ -1455,7 +1456,7 @@ static void vc4_hdmi_encoder_post_crtc_enable(struct = drm_encoder *encoder, mutex_lock(&vc4_hdmi->mutex); =20 if (!drm_dev_enter(drm, &idx)) - return; + goto out; =20 spin_lock_irqsave(&vc4_hdmi->hw_lock, flags); =20 @@ -1516,6 +1517,8 @@ static void vc4_hdmi_encoder_post_crtc_enable(struct = drm_encoder *encoder, vc4_hdmi_enable_scrambling(encoder); =20 drm_dev_exit(idx); + +out: mutex_unlock(&vc4_hdmi->mutex); } =20 --=20 2.37.2 From nobody Fri Apr 10 20:17:13 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A705C32771 for ; Fri, 19 Aug 2022 11:09:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348596AbiHSLJK (ORCPT ); Fri, 19 Aug 2022 07:09:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58960 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348631AbiHSLJA (ORCPT ); Fri, 19 Aug 2022 07:09:00 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 205BBE0965 for ; Fri, 19 Aug 2022 04:08:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1660907338; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bnEk9MrA+hzYjtEm67vAGY8w0ZNE3V5OyctQYUJSNY0=; b=hLkMJEmOD9zC3F1sQyn/BesfqUgsykoLzpZPrh11J+3BzJSpBwNZr7QOYvQeLybEsD71/7 FfSyBf+Mc6bY5+ejPpukWXwpzpwOcDNKlNcxNWyvUUnDSCejPUezJOdyMNrqNcPQ73a5fF a9xTXFTyemtpkU6husctaALk+CRUs7I= Received: from mail-ed1-f70.google.com (mail-ed1-f70.google.com [209.85.208.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-591-3bfQ_EyZMZqkO9HOfZVrMQ-1; Fri, 19 Aug 2022 07:08:57 -0400 X-MC-Unique: 3bfQ_EyZMZqkO9HOfZVrMQ-1 Received: by mail-ed1-f70.google.com with SMTP id t13-20020a056402524d00b0043db1fbefdeso2638782edd.2 for ; Fri, 19 Aug 2022 04:08:57 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc; bh=bnEk9MrA+hzYjtEm67vAGY8w0ZNE3V5OyctQYUJSNY0=; b=lYz9iPwehGZFG3Z5dBc6+BkuXs9owyQuhiUag/RgkPYp39rEPnV4GOK2SOcbER2DWH rQXk1el0GW/jjHygIrLE6Xq8uiqUJcZJkLWQ7YZ0PuV3/+LlVpCm37vPnqS2THks00aI CyjbPl295NMDLYdzqQEt+rRP3XJjcoStA2rkNaBY7QNzQS1jgbPnyF2iYJ4eCmuDgoqj 9okpOig+ZLxknIFlDTAV6zbYhBBxc+cdomuxy+9GSvZNqnIRJqOcGwMpqB8CUjOWZvh6 eyulY18KMNHh8uMt3udyAd/QMV8krxCxEUeeJlYK0KgaP74u1C60QgY2gywphGZ1UmFp s11g== X-Gm-Message-State: ACgBeo03e8jOrXedtMuqf4ZIE6e/ow0JQ4ebK6tOsXSLtKsdAkaGLvg+ LxdwZzoEoaZirA1Zt7bpfO6keNf9OmV2GMeuo0ptnE+vaauMJBp1meyHIkb+NTSLecYpsm67O32 Ex7zaztoI4qE8RmRo4esCHpxm X-Received: by 2002:a17:907:9694:b0:73c:4e5c:fd33 with SMTP id hd20-20020a170907969400b0073c4e5cfd33mr3189984ejc.331.1660907336024; Fri, 19 Aug 2022 04:08:56 -0700 (PDT) X-Google-Smtp-Source: AA6agR7IFFav8FqlP0liaFDWjQPBAHizE1g8lUigMsowQvbddBjddRYveYE9uBswm+NtsueITuzvIQ== X-Received: by 2002:a17:907:9694:b0:73c:4e5c:fd33 with SMTP id hd20-20020a170907969400b0073c4e5cfd33mr3189971ejc.331.1660907335876; Fri, 19 Aug 2022 04:08:55 -0700 (PDT) Received: from pollux.redhat.com ([2a02:810d:4b40:2ee8:642:1aff:fe31:a15c]) by smtp.gmail.com with ESMTPSA id l17-20020a1709060cd100b007308fab3eb7sm2167827ejh.195.2022.08.19.04.08.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 19 Aug 2022 04:08:55 -0700 (PDT) From: Danilo Krummrich To: daniel@ffwll.ch, airlied@linux.ie, tzimmermann@suse.de, mripard@kernel.org Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Danilo Krummrich Subject: [PATCH drm-misc-next v2 2/4] drm/vc4: plane: protect device resources after removal Date: Fri, 19 Aug 2022 13:08:47 +0200 Message-Id: <20220819110849.192037-3-dakr@redhat.com> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220819110849.192037-1-dakr@redhat.com> References: <20220819110849.192037-1-dakr@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" (Hardware) resources which are bound to the driver and device lifecycle must not be accessed after the device and driver are unbound. However, the DRM device isn't freed as long as the last user closed it, hence userspace can still call into the driver. Therefore protect the critical sections which are accessing those resources with drm_dev_enter() and drm_dev_exit(). Fixes: 9872c7a31921 ("drm/vc4: plane: Switch to drmm_universal_plane_alloc(= )") Signed-off-by: Danilo Krummrich --- drivers/gpu/drm/vc4/vc4_plane.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plan= e.c index eff9c63adfa7..c46acb770036 100644 --- a/drivers/gpu/drm/vc4/vc4_plane.c +++ b/drivers/gpu/drm/vc4/vc4_plane.c @@ -19,6 +19,7 @@ #include #include #include +#include #include #include #include @@ -1219,6 +1220,10 @@ u32 vc4_plane_write_dlist(struct drm_plane *plane, u= 32 __iomem *dlist) { struct vc4_plane_state *vc4_state =3D to_vc4_plane_state(plane->state); int i; + int idx; + + if (!drm_dev_enter(plane->dev, &idx)) + goto out; =20 vc4_state->hw_dlist =3D dlist; =20 @@ -1226,6 +1231,9 @@ u32 vc4_plane_write_dlist(struct drm_plane *plane, u3= 2 __iomem *dlist) for (i =3D 0; i < vc4_state->dlist_count; i++) writel(vc4_state->dlist[i], &dlist[i]); =20 + drm_dev_exit(idx); + +out: return vc4_state->dlist_count; } =20 @@ -1245,6 +1253,7 @@ void vc4_plane_async_set_fb(struct drm_plane *plane, = struct drm_framebuffer *fb) struct vc4_plane_state *vc4_state =3D to_vc4_plane_state(plane->state); struct drm_gem_dma_object *bo =3D drm_fb_dma_get_gem_obj(fb, 0); uint32_t addr; + int idx; =20 /* We're skipping the address adjustment for negative origin, * because this is only called on the primary plane. @@ -1252,12 +1261,17 @@ void vc4_plane_async_set_fb(struct drm_plane *plane= , struct drm_framebuffer *fb) WARN_ON_ONCE(plane->state->crtc_x < 0 || plane->state->crtc_y < 0); addr =3D bo->dma_addr + fb->offsets[0]; =20 + if (!drm_dev_enter(plane->dev, &idx)) + return; + /* Write the new address into the hardware immediately. The * scanout will start from this address as soon as the FIFO * needs to refill with pixels. */ writel(addr, &vc4_state->hw_dlist[vc4_state->ptr0_offset]); =20 + drm_dev_exit(idx); + /* Also update the CPU-side dlist copy, so that any later * atomic updates that don't do a new modeset on our plane * also use our updated address. @@ -1271,6 +1285,10 @@ static void vc4_plane_atomic_async_update(struct drm= _plane *plane, struct drm_plane_state *new_plane_state =3D drm_atomic_get_new_plane_stat= e(state, plane); struct vc4_plane_state *vc4_state, *new_vc4_state; + int idx; + + if (!drm_dev_enter(plane->dev, &idx)) + return; =20 swap(plane->state->fb, new_plane_state->fb); plane->state->crtc_x =3D new_plane_state->crtc_x; @@ -1333,6 +1351,8 @@ static void vc4_plane_atomic_async_update(struct drm_= plane *plane, &vc4_state->hw_dlist[vc4_state->pos2_offset]); writel(vc4_state->dlist[vc4_state->ptr0_offset], &vc4_state->hw_dlist[vc4_state->ptr0_offset]); + + drm_dev_exit(idx); } =20 static int vc4_plane_atomic_async_check(struct drm_plane *plane, --=20 2.37.2 From nobody Fri Apr 10 20:17:13 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B23FC32772 for ; Fri, 19 Aug 2022 11:09:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348667AbiHSLJO (ORCPT ); Fri, 19 Aug 2022 07:09:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59060 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348638AbiHSLJB (ORCPT ); Fri, 19 Aug 2022 07:09:01 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A9EF2EF011 for ; Fri, 19 Aug 2022 04:09:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1660907339; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jFR3xFdwN9i2Cd3/9jTqWPHspBtbjbbUfilDsWbGEig=; b=PM7j39a/jnMTptnA689DVQG9kuSzs2jxNc59T9g6IMEQQlJFzxL0vgIKhCO0Qz2B/jWr9G G/fgrBOpLHEKd/6Xo7/NfJh4TvSXoxgmKyDnccFd07eVDpZN4kQS4KuH9qcY7ZReObZDRo WqcA/tiH+o/YgCwlW4ofWDUkU5b2cWo= Received: from mail-ed1-f69.google.com (mail-ed1-f69.google.com [209.85.208.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-631-TC5KqJcqMfuFvqAU0H-sCg-1; Fri, 19 Aug 2022 07:08:58 -0400 X-MC-Unique: TC5KqJcqMfuFvqAU0H-sCg-1 Received: by mail-ed1-f69.google.com with SMTP id m18-20020a056402511200b0043d601a8035so2699030edd.20 for ; Fri, 19 Aug 2022 04:08:58 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc; bh=jFR3xFdwN9i2Cd3/9jTqWPHspBtbjbbUfilDsWbGEig=; b=avKyMQs5jTNuRoWwE+Q2ld6Mrxa23AVKcyuJD9F7Yb3PfQ0vK0ZUe3JOWiqglYQ6oo rtnpsgMEiV5Egt4FGmKakxJax6bfiN55ovjDG+wfNtnsrVWML1ZEXcWQS+erLGHeahHq ERSyuESyMB3x9OLa+kFk7dpDXDnfBti1+yoR6b9V2SIeepn/u7reV6SWWZ79XLo50mnG fUhCHPe0AZ0Tk3bxWXj9sud1TvgEeluLRQxWUIqzwruobEVeVHL53blUDUjqKEQfiE35 F1mIgJYTK7bwjqhjqU5Oio7LERz/6n39nmaba5pNxg2x36aIRgIYd3f+TPvcJ7T5Wo4g 12RA== X-Gm-Message-State: ACgBeo2itiGhQXmrNYqtcnQ5XuW30XtmF2NoaH4Ze2Dsax62UW1UUfwu 76cXNnGWi/CIr1i8m4/SUnxhCkBUldHpXdhV0xkaLc9d4Ady13oFWhrBrOL99jFITzx5IDLG/O5 ktVk/ROvS6zZyvWXLxze30L7h X-Received: by 2002:a05:6402:496:b0:443:a5f5:d3b with SMTP id k22-20020a056402049600b00443a5f50d3bmr5841563edv.331.1660907337411; Fri, 19 Aug 2022 04:08:57 -0700 (PDT) X-Google-Smtp-Source: AA6agR4S7vK3sAEYZ/N6o0dg6PHuk/70e8T70gYOtV0g+o5w19DGgJIB+Ww/rSrXeaZs3FvLKkdEBg== X-Received: by 2002:a05:6402:496:b0:443:a5f5:d3b with SMTP id k22-20020a056402049600b00443a5f50d3bmr5841545edv.331.1660907337216; Fri, 19 Aug 2022 04:08:57 -0700 (PDT) Received: from pollux.redhat.com ([2a02:810d:4b40:2ee8:642:1aff:fe31:a15c]) by smtp.gmail.com with ESMTPSA id l17-20020a1709060cd100b007308fab3eb7sm2167827ejh.195.2022.08.19.04.08.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 19 Aug 2022 04:08:56 -0700 (PDT) From: Danilo Krummrich To: daniel@ffwll.ch, airlied@linux.ie, tzimmermann@suse.de, mripard@kernel.org Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Danilo Krummrich Subject: [PATCH drm-misc-next v2 3/4] drm/vc4: crtc: protect device resources after removal Date: Fri, 19 Aug 2022 13:08:48 +0200 Message-Id: <20220819110849.192037-4-dakr@redhat.com> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220819110849.192037-1-dakr@redhat.com> References: <20220819110849.192037-1-dakr@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" (Hardware) resources which are bound to the driver and device lifecycle must not be accessed after the device and driver are unbound. However, the DRM device isn't freed as long as the last user closed it, hence userspace can still call into the driver. Therefore protect the critical sections which are accessing those resources with drm_dev_enter() and drm_dev_exit(). Fixes: 7cc4214c27cf ("drm/vc4: crtc: Switch to drmm_kzalloc") Signed-off-by: Danilo Krummrich --- drivers/gpu/drm/vc4/vc4_crtc.c | 41 +++++++++++++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c index 2def6e2ad6f0..0108613e79d5 100644 --- a/drivers/gpu/drm/vc4/vc4_crtc.c +++ b/drivers/gpu/drm/vc4/vc4_crtc.c @@ -39,6 +39,7 @@ #include #include #include +#include #include #include #include @@ -295,10 +296,17 @@ struct drm_encoder *vc4_get_crtc_encoder(struct drm_c= rtc *crtc, static void vc4_crtc_pixelvalve_reset(struct drm_crtc *crtc) { struct vc4_crtc *vc4_crtc =3D to_vc4_crtc(crtc); + struct drm_device *dev =3D crtc->dev; + int idx; + + if (!drm_dev_enter(dev, &idx)) + return; =20 /* The PV needs to be disabled before it can be flushed */ CRTC_WRITE(PV_CONTROL, CRTC_READ(PV_CONTROL) & ~PV_CONTROL_EN); CRTC_WRITE(PV_CONTROL, CRTC_READ(PV_CONTROL) | PV_CONTROL_FIFO_CLR); + + drm_dev_exit(idx); } =20 static void vc4_crtc_config_pv(struct drm_crtc *crtc, struct drm_encoder *= encoder, @@ -321,6 +329,10 @@ static void vc4_crtc_config_pv(struct drm_crtc *crtc, = struct drm_encoder *encode u32 format =3D is_dsi1 ? PV_CONTROL_FORMAT_DSIV_24 : PV_CONTROL_FORMAT_24; u8 ppc =3D pv_data->pixels_per_clock; bool debug_dump_regs =3D false; + int idx; + + if (!drm_dev_enter(dev, &idx)) + return; =20 if (debug_dump_regs) { struct drm_printer p =3D drm_info_printer(&vc4_crtc->pdev->dev); @@ -410,6 +422,8 @@ static void vc4_crtc_config_pv(struct drm_crtc *crtc, s= truct drm_encoder *encode drm_crtc_index(crtc)); drm_print_regset32(&p, &vc4_crtc->regset); } + + drm_dev_exit(idx); } =20 static void require_hvs_enabled(struct drm_device *dev) @@ -430,7 +444,10 @@ static int vc4_crtc_disable(struct drm_crtc *crtc, struct vc4_crtc *vc4_crtc =3D to_vc4_crtc(crtc); struct drm_device *dev =3D crtc->dev; struct vc4_dev *vc4 =3D to_vc4_dev(dev); - int ret; + int idx, ret; + + if (!drm_dev_enter(dev, &idx)) + return -ENODEV; =20 CRTC_WRITE(PV_V_CONTROL, CRTC_READ(PV_V_CONTROL) & ~PV_VCONTROL_VIDEN); @@ -464,6 +481,8 @@ static int vc4_crtc_disable(struct drm_crtc *crtc, if (vc4_encoder && vc4_encoder->post_crtc_powerdown) vc4_encoder->post_crtc_powerdown(encoder, state); =20 + drm_dev_exit(idx); + return 0; } =20 @@ -588,10 +607,14 @@ static void vc4_crtc_atomic_enable(struct drm_crtc *c= rtc, struct vc4_crtc *vc4_crtc =3D to_vc4_crtc(crtc); struct drm_encoder *encoder =3D vc4_get_crtc_encoder(crtc, new_state); struct vc4_encoder *vc4_encoder =3D to_vc4_encoder(encoder); + int idx; =20 drm_dbg(dev, "Enabling CRTC %s (%u) connected to Encoder %s (%u)", crtc->name, crtc->base.id, encoder->name, encoder->base.id); =20 + if (!drm_dev_enter(dev, &idx)) + return; + require_hvs_enabled(dev); =20 /* Enable vblank irq handling before crtc is started otherwise @@ -619,6 +642,8 @@ static void vc4_crtc_atomic_enable(struct drm_crtc *crt= c, =20 if (vc4_encoder->post_crtc_enable) vc4_encoder->post_crtc_enable(encoder, state); + + drm_dev_exit(idx); } =20 static enum drm_mode_status vc4_crtc_mode_valid(struct drm_crtc *crtc, @@ -711,17 +736,31 @@ static int vc4_crtc_atomic_check(struct drm_crtc *crt= c, static int vc4_enable_vblank(struct drm_crtc *crtc) { struct vc4_crtc *vc4_crtc =3D to_vc4_crtc(crtc); + struct drm_device *dev =3D crtc->dev; + int idx; + + if (!drm_dev_enter(dev, &idx)) + return -ENODEV; =20 CRTC_WRITE(PV_INTEN, PV_INT_VFP_START); =20 + drm_dev_exit(idx); + return 0; } =20 static void vc4_disable_vblank(struct drm_crtc *crtc) { struct vc4_crtc *vc4_crtc =3D to_vc4_crtc(crtc); + struct drm_device *dev =3D crtc->dev; + int idx; + + if (!drm_dev_enter(dev, &idx)) + return; =20 CRTC_WRITE(PV_INTEN, 0); + + drm_dev_exit(idx); } =20 static void vc4_crtc_handle_page_flip(struct vc4_crtc *vc4_crtc) --=20 2.37.2 From nobody Fri Apr 10 20:17:13 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08836C32771 for ; Fri, 19 Aug 2022 11:09:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348680AbiHSLJR (ORCPT ); Fri, 19 Aug 2022 07:09:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59196 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348647AbiHSLJD (ORCPT ); Fri, 19 Aug 2022 07:09:03 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE1D4EEF29 for ; Fri, 19 Aug 2022 04:09:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1660907341; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xeNvcv3iZHDY3QjzCkS4zy97GwENP8IMr7bik18mtU0=; b=Gln7bXqrcbCIqhdBa/susbfo05myEyPHCUJe/Xl4+J5OsemjA3V93GzgBL7+AOT5FmSzju lAloRTbw2/8agFsPO4sKi32OOUIvSQ8ebgWHgJ0bKY6IW6S+lw6zzwuv4Hvpps8P4kRKdo SkVqbHdEB50cQKhpVzdmn6Dw5TI3vrg= Received: from mail-ej1-f72.google.com (mail-ej1-f72.google.com [209.85.218.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-609-Tpu2x3-yOcqoLf6nmKL_2g-1; Fri, 19 Aug 2022 07:08:59 -0400 X-MC-Unique: Tpu2x3-yOcqoLf6nmKL_2g-1 Received: by mail-ej1-f72.google.com with SMTP id gb41-20020a170907962900b00730961131a7so1388531ejc.1 for ; Fri, 19 Aug 2022 04:08:59 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc; bh=xeNvcv3iZHDY3QjzCkS4zy97GwENP8IMr7bik18mtU0=; b=PX08sWFhB7cxhokWkz4YhQl3JWa2NUonWUY1IHo+UEaxg4H3u/7FWvCOvj7bdwD4I7 oD92tAb0RBHuuosjxx+gB5X8Hx9+r0CQvQ0I2qfajhxtzH+r3pm0OL6xdeHJYQlbxu2A nmOLuwi1e2adLOT4qzOGry5ZRCVAatIbdcbdvGjYw22bmsXNUz/9ZBfyUre311QEMN4A kZVQOeIBpnJmYXyADn6w1I1+JfWUZoZBP4FmxPtTUvoczho/UbTs7RW7aHJz9YBppr2E 3DoeQeoxqD4ZyerdJju4Z11jg4NWvXen6Kd9lZte5tAnvOsjKSPVvtUtCOBz9mJrvSvu PyCw== X-Gm-Message-State: ACgBeo0RLHyJlGAhdxNGSxwr8OsGdurVpqiH4AUQBJ7BC6LN4wZmnT6b TYN/Pww5l1i9shd/ZaElNDXsu5QgokD0/HrCfFOSh/lBAmNAIHq1kspU5KTDnY6Z2rdu+78zmn6 Ux2rScLaV3SYL3v/zFiRwxJ6b X-Received: by 2002:a05:6402:1603:b0:446:5617:55dd with SMTP id f3-20020a056402160300b00446561755ddmr537911edv.170.1660907338838; Fri, 19 Aug 2022 04:08:58 -0700 (PDT) X-Google-Smtp-Source: AA6agR4JCMLkkgfrx66zUb5RMS4kd93el/Xb9OFRWhrYuzNFFkdMFyxj+rXOpo1fErhN9Ev0M+lasA== X-Received: by 2002:a05:6402:1603:b0:446:5617:55dd with SMTP id f3-20020a056402160300b00446561755ddmr537899edv.170.1660907338647; Fri, 19 Aug 2022 04:08:58 -0700 (PDT) Received: from pollux.redhat.com ([2a02:810d:4b40:2ee8:642:1aff:fe31:a15c]) by smtp.gmail.com with ESMTPSA id l17-20020a1709060cd100b007308fab3eb7sm2167827ejh.195.2022.08.19.04.08.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 19 Aug 2022 04:08:58 -0700 (PDT) From: Danilo Krummrich To: daniel@ffwll.ch, airlied@linux.ie, tzimmermann@suse.de, mripard@kernel.org Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Danilo Krummrich Subject: [PATCH drm-misc-next v2 4/4] drm/vc4: hvs: protect drm_print_regset32() Date: Fri, 19 Aug 2022 13:08:49 +0200 Message-Id: <20220819110849.192037-5-dakr@redhat.com> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220819110849.192037-1-dakr@redhat.com> References: <20220819110849.192037-1-dakr@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In vc4_hvs_dump_state() potentially freed resources are protected from being accessed with drm_dev_enter()/drm_dev_exit(). Also include drm_print_regset32() in the protected section, since drm_print_regset32() does access memory that is typically mapped via devm_* calls. Fixes: 969cfae1f01d ("drm/vc4: hvs: Protect device resources after removal") Signed-off-by: Danilo Krummrich --- drivers/gpu/drm/vc4/vc4_hvs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c index 9e823e0de197..4ac9f5a2d5f9 100644 --- a/drivers/gpu/drm/vc4/vc4_hvs.c +++ b/drivers/gpu/drm/vc4/vc4_hvs.c @@ -71,11 +71,11 @@ void vc4_hvs_dump_state(struct vc4_hvs *hvs) struct drm_printer p =3D drm_info_printer(&hvs->pdev->dev); int idx, i; =20 - drm_print_regset32(&p, &hvs->regset); - if (!drm_dev_enter(drm, &idx)) return; =20 + drm_print_regset32(&p, &hvs->regset); + DRM_INFO("HVS ctx:\n"); for (i =3D 0; i < 64; i +=3D 4) { DRM_INFO("0x%08x (%s): 0x%08x 0x%08x 0x%08x 0x%08x\n", --=20 2.37.2