kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/include/drm/display
History
Imre Deak be826b4451 drm/dp_mst: Fix resetting msg rx state after topology removal 
commit a6fa67d26d upstream.

If the MST topology is removed during the reception of an MST down reply
or MST up request sideband message, the
drm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset
from one thread via drm_dp_mst_topology_mgr_set_mst(false), racing with
the reading/parsing of the message from another thread via
drm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req(). The race is
possible since the reader/parser doesn't hold any lock while accessing
the reception state. This in turn can lead to a memory corruption in the
reader/parser as described by commit bd2fccac61 ("drm/dp_mst: Fix MST
sideband message body length check").

Fix the above by resetting the message reception state if needed before
reading/parsing a message. Another solution would be to hold the
drm_dp_mst_topology_mgr::lock for the whole duration of the message
reception/parsing in drm_dp_mst_handle_down_rep() and
drm_dp_mst_handle_up_req(), however this would require a bigger change.
Since the fix is also needed for stable, opting for the simpler solution
in this patch.

Cc: Lyude Paul <lyude@redhat.com>
Cc: <stable@vger.kernel.org>
Fixes: 1d082618bb ("drm/display/dp_mst: Fix down/up message handling after sink disconnect")
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13056
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241203160223.2926014-2-imre.deak@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-12-14 20:03:28 +01:00
..
drm_dp.h Merge drm/drm-next into drm-misc-next 2024-07-29 09:35:54 +02:00
drm_dp_aux_bus.h drm/dp: Add callbacks to make using DP AUX bus properly easier 2022-06-02 15:14:16 -07:00
drm_dp_dual_mode_helper.h drm: Rename dp/ to display/ 2022-04-25 11:17:45 +02:00
drm_dp_helper.h drm/dp: Describe target_rr_divider in struct drm_dp_as_sdp 2024-07-31 13:13:28 +02:00
drm_dp_mst_helper.h drm/dp_mst: Fix resetting msg rx state after topology removal 2024-12-14 20:03:28 +01:00
drm_dp_tunnel.h drm/dp: Add support for DP tunneling 2024-02-27 17:34:10 +02:00
drm_dsc.h drm/i915/dp: Fix DSC line buffer depth programming 2024-04-19 17:05:35 +03:00
drm_dsc_helper.h drm/display/dsc: Add a helper to dump the DSC configuration 2024-07-03 18:05:12 +03:00
drm_hdcp.h drm/display: Move HDCP helpers into display-helper module 2022-04-25 11:19:36 +02:00
drm_hdcp_helper.h drm/display: Move HDCP helpers into display-helper module 2022-04-25 11:19:36 +02:00
drm_hdmi_helper.h drm/display: hdmi: Add HDMI compute clock helper 2024-05-28 10:12:25 +02:00
drm_hdmi_state_helper.h drm/connector: hdmi: shorten too long function name 2024-06-25 15:09:56 +03:00
drm_scdc.h drm/display: Move SCDC helpers into display-helper library 2022-04-25 11:19:37 +02:00
drm_scdc_helper.h drm/scdc-helper: Pimp SCDC debugs 2023-04-06 01:30:12 +03:00