Commit 5d498f24 authored by Vinod Polimera's avatar Vinod Polimera Committed by Liu Chuang
Browse files

drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free... 

drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume

stable inclusion
from stable-v4.19.247
commit aa4cb188988dc6f1b3f4917d4dbc452150a5d871
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP4BH
CVE: CVE-2022-49489

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aa4cb188988dc6f1b3f4917d4dbc452150a5d871



--------------------------------

[ Upstream commit fa5186b2 ]

BUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3

Call trace:
  dpu_vbif_init_memtypes+0x40/0xb8
  dpu_runtime_resume+0xcc/0x1c0
  pm_generic_runtime_resume+0x30/0x44
  __genpd_runtime_resume+0x68/0x7c
  genpd_runtime_resume+0x134/0x258
  __rpm_callback+0x98/0x138
  rpm_callback+0x30/0x88
  rpm_resume+0x36c/0x49c
  __pm_runtime_resume+0x80/0xb0
  dpu_core_irq_uninstall+0x30/0xb0
  dpu_irq_uninstall+0x18/0x24
  msm_drm_uninit+0xd8/0x16c

Fixes: 25fdd593 ("drm/msm: Add SDM845 DPU support")
Signed-off-by: default avatarVinod Polimera <quic_vpolimer@quicinc.com>
Reviewed-by: default avatarDmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/483255/
Link: https://lore.kernel.org/r/1650857213-30075-1-git-send-email-quic_vpolimer@quicinc.com


[DB: fixed Fixes tag]
Signed-off-by: default avatarDmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Chuang <liuchuang40@huawei.com>
parent 9b569f9f

drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c

+3 −1
Original line number Diff line number Diff line
@@ -657,8 +657,10 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms) 
		for (i = 0; i < dpu_kms->catalog->vbif_count; i++) {

			u32 vbif_idx = dpu_kms->catalog->vbif[i].id;



			if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx])

			if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) {

				dpu_hw_vbif_destroy(dpu_kms->hw_vbif[vbif_idx]);

				dpu_kms->hw_vbif[vbif_idx] = NULL;

			}

		}

	}