Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux/include/drm/display
History
Imre Deak a6fa67d26d drm/dp_mst: Fix resetting msg rx state after topology removal 
If the MST topology is removed during the reception of an MST down reply
or MST up request sideband message, the
drm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset
from one thread via drm_dp_mst_topology_mgr_set_mst(false), racing with
the reading/parsing of the message from another thread via
drm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req(). The race is
possible since the reader/parser doesn't hold any lock while accessing
the reception state. This in turn can lead to a memory corruption in the
reader/parser as described by commit bd2fccac61 ("drm/dp_mst: Fix MST
sideband message body length check").

Fix the above by resetting the message reception state if needed before
reading/parsing a message. Another solution would be to hold the
drm_dp_mst_topology_mgr::lock for the whole duration of the message
reception/parsing in drm_dp_mst_handle_down_rep() and
drm_dp_mst_handle_up_req(), however this would require a bigger change.
Since the fix is also needed for stable, opting for the simpler solution
in this patch.

Cc: Lyude Paul <lyude@redhat.com>
Cc: <stable@vger.kernel.org>
Fixes: 1d082618bb ("drm/display/dp_mst: Fix down/up message handling after sink disconnect")
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13056
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241203160223.2926014-2-imre.deak@intel.com
 		2024-12-05 16:18:07 +02:00
..
drm_dp.h Merge drm/drm-next into drm-misc-next 2024-07-29 09:35:54 +02:00
drm_dp_aux_bus.h drm/dp: Add callbacks to make using DP AUX bus properly easier 2022-06-02 15:14:16 -07:00
drm_dp_dual_mode_helper.h
…
drm_dp_helper.h drm/dp: Describe target_rr_divider in struct drm_dp_as_sdp 2024-07-31 13:13:28 +02:00
drm_dp_mst_helper.h drm/dp_mst: Fix resetting msg rx state after topology removal 2024-12-05 16:18:07 +02:00
drm_dp_tunnel.h drm/dp: Add support for DP tunneling 2024-02-27 17:34:10 +02:00
drm_dsc.h drm/i915/dp: Fix DSC line buffer depth programming 2024-04-19 17:05:35 +03:00
drm_dsc_helper.h drm/display/dsc: Add a helper to dump the DSC configuration 2024-07-03 18:05:12 +03:00
drm_hdcp.h
…
drm_hdcp_helper.h
…
drm_hdmi_helper.h drm/display: hdmi: Add HDMI compute clock helper 2024-05-28 10:12:25 +02:00
drm_hdmi_state_helper.h drm/connector: hdmi: shorten too long function name 2024-06-25 15:09:56 +03:00
drm_scdc.h
…
drm_scdc_helper.h drm/scdc-helper: Pimp SCDC debugs 2023-04-06 01:30:12 +03:00