Commit f8170d68 authored by Jessica Zhang's avatar Jessica Zhang Committed by Liu Shixin
Browse files

drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected 

stable inclusion
from stable-v4.19.247
commit 1a5d1474026ea4f1a6f931075ca2adb884af39cf
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP48W
CVE: CVE-2022-49488

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1a5d1474026ea4f1a6f931075ca2adb884af39cf



--------------------------------

[ Upstream commit ca75f6f7 ]

There is a possibility for mdp5_get_global_state to return
-EDEADLK when acquiring the modeset lock, but currently global_state in
mdp5_mixer_release doesn't check for if an error is returned.

To avoid a NULL dereference error, let's have mdp5_mixer_release
check if an error is returned and propagate that error.

Reported-by: default avatarTomeu Vizoso <tomeu.vizoso@collabora.com>
Signed-off-by: default avatarJessica Zhang <quic_jesszhan@quicinc.com>
Fixes: 7907a0d7 ("drm/msm/mdp5: Use the new private_obj state")
Reviewed-by: default avatarRob Clark <robdclark@gmail.com>
Reviewed-by: default avatarDmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/485181/
Link: https://lore.kernel.org/r/20220505214051.155-2-quic_jesszhan@quicinc.com


Signed-off-by: default avatarDmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Shixin <liushixin2@huawei.com>
parent 72481518

drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c

+8 −2
Original line number Diff line number Diff line
@@ -537,9 +537,15 @@ int mdp5_crtc_setup_pipeline(struct drm_crtc *crtc, 
		if (ret)

			return ret;



		mdp5_mixer_release(new_crtc_state->state, old_mixer);

		ret = mdp5_mixer_release(new_crtc_state->state, old_mixer);

		if (ret)

			return ret;



		if (old_r_mixer) {

			mdp5_mixer_release(new_crtc_state->state, old_r_mixer);

			ret = mdp5_mixer_release(new_crtc_state->state, old_r_mixer);

			if (ret)

				return ret;



			if (!need_right_mixer)

				pipeline->r_mixer = NULL;

		}

drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c

+11 −4
Original line number Diff line number Diff line
@@ -127,21 +127,28 @@ int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc, 
	return 0;

}



void mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer)

int mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer)

{

	struct mdp5_global_state *global_state = mdp5_get_global_state(s);

	struct mdp5_hw_mixer_state *new_state = &global_state->hwmixer;

	struct mdp5_hw_mixer_state *new_state;



	if (!mixer)

		return;

		return 0;



	if (IS_ERR(global_state))

		return PTR_ERR(global_state);



	new_state = &global_state->hwmixer;



	if (WARN_ON(!new_state->hwmixer_to_crtc[mixer->idx]))

		return;

		return -EINVAL;



	DBG("%s: release from crtc %s", mixer->name,

	    new_state->hwmixer_to_crtc[mixer->idx]->name);



	new_state->hwmixer_to_crtc[mixer->idx] = NULL;



	return 0;

}



void mdp5_mixer_destroy(struct mdp5_hw_mixer *mixer)

drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h

+2 −2
Original line number Diff line number Diff line
@@ -41,7 +41,7 @@ void mdp5_mixer_destroy(struct mdp5_hw_mixer *lm); 
int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc,

		      uint32_t caps, struct mdp5_hw_mixer **mixer,

		      struct mdp5_hw_mixer **r_mixer);

void mdp5_mixer_release(struct drm_atomic_state *s,

int mdp5_mixer_release(struct drm_atomic_state *s,

		       struct mdp5_hw_mixer *mixer);



#endif /* __MDP5_LM_H__ */