From nobody Wed Dec 17 09:47:59 2025
Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84])
	(using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F1201292D3
	for <linux-kernel@vger.kernel.org>; Fri, 16 Feb 2024 12:59:11 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
 arc=none smtp.client-ip=83.149.199.84
ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1708088355; cv=none;
 b=Wp8ovbMZ4nkEcEWJF1FwwPouLmiGYZOaGEq37P2owiZ5i+fncojcP/PcXQo/Bdovjb0bcjZdJV/L1DWZfIVTo6BVWwQ3SlUPLqgVLJXY4k0LbEoPMG2LUAAD2N+3uBma9wzD1dNVPy+GRCyfw3qo+XnC8HGMIPOadLFyKzub1XM=
ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1708088355; c=relaxed/simple;
	bh=ztukOrv72pACnLN/LBb1pjlApd0Wuv5E3PPbJyRaPJE=;
	h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:
	 MIME-Version;
 b=J7FNg2wM3cUrYWJrKj2qYU1/yTfk16qbQmwc2eQz1eK2Co3xSo64bEitmxz+G1fosbMmjShSWYDYHWjZ0OAoWFOSF/Yiz+c4UhCbhVpYn0vD4CoZLbI2fukf5t7hXN3iaA3u9pj3mOstJgc6gR1gKIq6z2RY+sbZrWJcF6PndTM=
ARC-Authentication-Results: i=1; smtp.subspace.kernel.org;
 dmarc=pass (p=none dis=none) header.from=ispras.ru;
 spf=pass smtp.mailfrom=ispras.ru;
 dkim=pass (1024-bit key) header.d=ispras.ru header.i=@ispras.ru
 header.b=l530KQlS; arc=none smtp.client-ip=83.149.199.84
Authentication-Results: smtp.subspace.kernel.org;
 dmarc=pass (p=none dis=none) header.from=ispras.ru
Authentication-Results: smtp.subspace.kernel.org;
 spf=pass smtp.mailfrom=ispras.ru
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=ispras.ru header.i=@ispras.ru
 header.b="l530KQlS"
Received: from lvc-arm12.ispras.local (unknown [83.149.199.78])
	by mail.ispras.ru (Postfix) with ESMTPSA id BE57B40241B8;
	Fri, 16 Feb 2024 12:51:18 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru BE57B40241B8
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru;
	s=default; t=1708087878;
	bh=S1r8Mq3qgF/963ARXbA2g2vgUJ1UOzD2+uwWm8hvuMU=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=l530KQlS2F9fEvWEyHl8g2mcEv5y1S8LDqebs9zWqV1IBJoQpJB2NWVvHu1/byxMK
	 /7f0bxZaBr3BjfVZmVEoS2lzkVSq2rYwDfOsAO4nmCgr7cbEofREBynkQkJM808RiS
	 lqUSHobGdoN8Dl115yt8N6JYyQeh5nLP3fKFt1YY=
From: Katya Orlova <e.orlova@ispras.ru>
To: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
Cc: Katya Orlova <e.orlova@ispras.ru>,
	Yannick Fertre <yannick.fertre@foss.st.com>,
	Philippe Cornu <philippe.cornu@foss.st.com>,
	David Airlie <airlied@gmail.com>,
	Daniel Vetter <daniel@ffwll.ch>,
	Maxime Coquelin <mcoquelin.stm32@gmail.com>,
	Alexandre Torgue <alexandre.torgue@foss.st.com>,
	Philipp Zabel <p.zabel@pengutronix.de>,
	dri-devel@lists.freedesktop.org,
	linux-stm32@st-md-mailman.stormreply.com,
	linux-arm-kernel@lists.infradead.org,
	linux-kernel@vger.kernel.org,
	lvc-project@linuxtesting.org
Subject: [PATCH v4] drm/stm: Avoid use-after-free issues with crtc and plane
Date: Fri, 16 Feb 2024 15:50:40 +0300
Message-Id: <20240216125040.8968-1-e.orlova@ispras.ru>
X-Mailer: git-send-email 2.30.2
In-Reply-To: <20240122111128.10852-1-e.orlova@ispras.ru>
References: 
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"

ltdc_load() calls functions drm_crtc_init_with_planes(),
drm_universal_plane_init() and drm_encoder_init(). These functions
should not be called with parameters allocated with devm_kzalloc()
to avoid use-after-free issues [1].

Use allocations managed by the DRM framework.

Found by Linux Verification Center (linuxtesting.org).

[1]
https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhu=
xzli@diujon4h7qwb/

Signed-off-by: Katya Orlova <e.orlova@ispras.ru>
Acked-by: Rapha=C3=ABl Gallais-Pou <raphael.gallais-pou@foss.st.com>
---
v4: rebase on the drm-misc
v3: style problems
v2: use allocations managed by the DRM as
Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com> suggested.
Also add a fix for encoder.
 drivers/gpu/drm/stm/drv.c  |  3 +-
 drivers/gpu/drm/stm/ltdc.c | 73 ++++++++++----------------------------
 2 files changed, 20 insertions(+), 56 deletions(-)

diff --git a/drivers/gpu/drm/stm/drv.c b/drivers/gpu/drm/stm/drv.c
index e8523abef27a..152bec2c0238 100644
--- a/drivers/gpu/drm/stm/drv.c
+++ b/drivers/gpu/drm/stm/drv.c
@@ -25,6 +25,7 @@
 #include <drm/drm_module.h>
 #include <drm/drm_probe_helper.h>
 #include <drm/drm_vblank.h>
+#include <drm/drm_managed.h>
=20
 #include "ltdc.h"
=20
@@ -75,7 +76,7 @@ static int drv_load(struct drm_device *ddev)
=20
 	DRM_DEBUG("%s\n", __func__);
=20
-	ldev =3D devm_kzalloc(ddev->dev, sizeof(*ldev), GFP_KERNEL);
+	ldev =3D drmm_kzalloc(ddev, sizeof(*ldev), GFP_KERNEL);
 	if (!ldev)
 		return -ENOMEM;
=20
diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c
index 5576fdae4962..eeaabb4e10d3 100644
--- a/drivers/gpu/drm/stm/ltdc.c
+++ b/drivers/gpu/drm/stm/ltdc.c
@@ -36,6 +36,7 @@
 #include <drm/drm_probe_helper.h>
 #include <drm/drm_simple_kms_helper.h>
 #include <drm/drm_vblank.h>
+#include <drm/drm_managed.h>
=20
 #include <video/videomode.h>
=20
@@ -1199,7 +1200,6 @@ static void ltdc_crtc_atomic_print_state(struct drm_p=
rinter *p,
 }
=20
 static const struct drm_crtc_funcs ltdc_crtc_funcs =3D {
-	.destroy =3D drm_crtc_cleanup,
 	.set_config =3D drm_atomic_helper_set_config,
 	.page_flip =3D drm_atomic_helper_page_flip,
 	.reset =3D drm_atomic_helper_crtc_reset,
@@ -1212,7 +1212,6 @@ static const struct drm_crtc_funcs ltdc_crtc_funcs =
=3D {
 };
=20
 static const struct drm_crtc_funcs ltdc_crtc_with_crc_support_funcs =3D {
-	.destroy =3D drm_crtc_cleanup,
 	.set_config =3D drm_atomic_helper_set_config,
 	.page_flip =3D drm_atomic_helper_page_flip,
 	.reset =3D drm_atomic_helper_crtc_reset,
@@ -1545,7 +1544,6 @@ static void ltdc_plane_atomic_print_state(struct drm_=
printer *p,
 static const struct drm_plane_funcs ltdc_plane_funcs =3D {
 	.update_plane =3D drm_atomic_helper_update_plane,
 	.disable_plane =3D drm_atomic_helper_disable_plane,
-	.destroy =3D drm_plane_cleanup,
 	.reset =3D drm_atomic_helper_plane_reset,
 	.atomic_duplicate_state =3D drm_atomic_helper_plane_duplicate_state,
 	.atomic_destroy_state =3D drm_atomic_helper_plane_destroy_state,
@@ -1572,7 +1570,6 @@ static struct drm_plane *ltdc_plane_create(struct drm=
_device *ddev,
 	const u64 *modifiers =3D ltdc_format_modifiers;
 	u32 lofs =3D index * LAY_OFS;
 	u32 val;
-	int ret;
=20
 	/* Allocate the biggest size according to supported color formats */
 	formats =3D devm_kzalloc(dev, (ldev->caps.pix_fmt_nb +
@@ -1613,14 +1610,10 @@ static struct drm_plane *ltdc_plane_create(struct d=
rm_device *ddev,
 		}
 	}
=20
-	plane =3D devm_kzalloc(dev, sizeof(*plane), GFP_KERNEL);
-	if (!plane)
-		return NULL;
-
-	ret =3D drm_universal_plane_init(ddev, plane, possible_crtcs,
-				       &ltdc_plane_funcs, formats, nb_fmt,
-				       modifiers, type, NULL);
-	if (ret < 0)
+	plane =3D drmm_universal_plane_alloc(ddev, struct drm_plane, dev,
+					   possible_crtcs, &ltdc_plane_funcs, formats,
+					   nb_fmt, modifiers, type, NULL);
+	if (IS_ERR(plane))
 		return NULL;
=20
 	if (ldev->caps.ycbcr_input) {
@@ -1643,15 +1636,6 @@ static struct drm_plane *ltdc_plane_create(struct dr=
m_device *ddev,
 	return plane;
 }
=20
-static void ltdc_plane_destroy_all(struct drm_device *ddev)
-{
-	struct drm_plane *plane, *plane_temp;
-
-	list_for_each_entry_safe(plane, plane_temp,
-				 &ddev->mode_config.plane_list, head)
-		drm_plane_cleanup(plane);
-}
-
 static int ltdc_crtc_init(struct drm_device *ddev, struct drm_crtc *crtc)
 {
 	struct ltdc_device *ldev =3D ddev->dev_private;
@@ -1677,14 +1661,14 @@ static int ltdc_crtc_init(struct drm_device *ddev, =
struct drm_crtc *crtc)
=20
 	/* Init CRTC according to its hardware features */
 	if (ldev->caps.crc)
-		ret =3D drm_crtc_init_with_planes(ddev, crtc, primary, NULL,
-						&ltdc_crtc_with_crc_support_funcs, NULL);
+		ret =3D drmm_crtc_init_with_planes(ddev, crtc, primary, NULL,
+						 &ltdc_crtc_with_crc_support_funcs, NULL);
 	else
-		ret =3D drm_crtc_init_with_planes(ddev, crtc, primary, NULL,
-						&ltdc_crtc_funcs, NULL);
+		ret =3D drmm_crtc_init_with_planes(ddev, crtc, primary, NULL,
+						 &ltdc_crtc_funcs, NULL);
 	if (ret) {
 		DRM_ERROR("Can not initialize CRTC\n");
-		goto cleanup;
+		return ret;
 	}
=20
 	drm_crtc_helper_add(crtc, &ltdc_crtc_helper_funcs);
@@ -1698,9 +1682,8 @@ static int ltdc_crtc_init(struct drm_device *ddev, st=
ruct drm_crtc *crtc)
 	for (i =3D 1; i < ldev->caps.nb_layers; i++) {
 		overlay =3D ltdc_plane_create(ddev, DRM_PLANE_TYPE_OVERLAY, i);
 		if (!overlay) {
-			ret =3D -ENOMEM;
 			DRM_ERROR("Can not create overlay plane %d\n", i);
-			goto cleanup;
+			return -ENOMEM;
 		}
 		if (ldev->caps.dynamic_zorder)
 			drm_plane_create_zpos_property(overlay, i, 0, ldev->caps.nb_layers - 1);
@@ -1713,10 +1696,6 @@ static int ltdc_crtc_init(struct drm_device *ddev, s=
truct drm_crtc *crtc)
 	}
=20
 	return 0;
-
-cleanup:
-	ltdc_plane_destroy_all(ddev);
-	return ret;
 }
=20
 static void ltdc_encoder_disable(struct drm_encoder *encoder)
@@ -1776,23 +1755,19 @@ static int ltdc_encoder_init(struct drm_device *dde=
v, struct drm_bridge *bridge)
 	struct drm_encoder *encoder;
 	int ret;
=20
-	encoder =3D devm_kzalloc(ddev->dev, sizeof(*encoder), GFP_KERNEL);
-	if (!encoder)
-		return -ENOMEM;
+	encoder =3D drmm_simple_encoder_alloc(ddev, struct drm_encoder, dev,
+					    DRM_MODE_ENCODER_DPI);
+	if (IS_ERR(encoder))
+		return PTR_ERR(encoder);
=20
 	encoder->possible_crtcs =3D CRTC_MASK;
 	encoder->possible_clones =3D 0;	/* No cloning support */
=20
-	drm_simple_encoder_init(ddev, encoder, DRM_MODE_ENCODER_DPI);
-
 	drm_encoder_helper_add(encoder, &ltdc_encoder_helper_funcs);
=20
 	ret =3D drm_bridge_attach(encoder, bridge, NULL, 0);
-	if (ret) {
-		if (ret !=3D -EPROBE_DEFER)
-			drm_encoder_cleanup(encoder);
+	if (ret)
 		return ret;
-	}
=20
 	DRM_DEBUG_DRIVER("Bridge encoder:%d created\n", encoder->base.id);
=20
@@ -1962,8 +1937,7 @@ int ltdc_load(struct drm_device *ddev)
 			goto err;
=20
 		if (panel) {
-			bridge =3D drm_panel_bridge_add_typed(panel,
-							    DRM_MODE_CONNECTOR_DPI);
+			bridge =3D drmm_panel_bridge_add(ddev, panel);
 			if (IS_ERR(bridge)) {
 				DRM_ERROR("panel-bridge endpoint %d\n", i);
 				ret =3D PTR_ERR(bridge);
@@ -2045,7 +2019,7 @@ int ltdc_load(struct drm_device *ddev)
 		}
 	}
=20
-	crtc =3D devm_kzalloc(dev, sizeof(*crtc), GFP_KERNEL);
+	crtc =3D drmm_kzalloc(ddev, sizeof(*crtc), GFP_KERNEL);
 	if (!crtc) {
 		DRM_ERROR("Failed to allocate crtc\n");
 		ret =3D -ENOMEM;
@@ -2072,9 +2046,6 @@ int ltdc_load(struct drm_device *ddev)
=20
 	return 0;
 err:
-	for (i =3D 0; i < nb_endpoints; i++)
-		drm_of_panel_bridge_remove(ddev->dev->of_node, 0, i);
-
 	clk_disable_unprepare(ldev->pixel_clk);
=20
 	return ret;
@@ -2082,16 +2053,8 @@ int ltdc_load(struct drm_device *ddev)
=20
 void ltdc_unload(struct drm_device *ddev)
 {
-	struct device *dev =3D ddev->dev;
-	int nb_endpoints, i;
-
 	DRM_DEBUG_DRIVER("\n");
=20
-	nb_endpoints =3D of_graph_get_endpoint_count(dev->of_node);
-
-	for (i =3D 0; i < nb_endpoints; i++)
-		drm_of_panel_bridge_remove(ddev->dev->of_node, 0, i);
-
 	pm_runtime_disable(ddev->dev);
 }
=20
--=20
2.30.2