summaryrefslogtreecommitdiff
path: root/fs/qnx4
diff options
context:
space:
mode:
authorMazin Rezk <mnrzk@protonmail.com>2020-07-27 08:40:46 +0300
committerAlex Deucher <alexander.deucher@amd.com>2020-07-30 18:02:10 +0300
commitfde9f39ac7f1ffd799a96ffa1e06b2051f0898f1 (patch)
tree5b042a4d4ec57c6c3a2f3be163a4ed7b0adad9fa /fs/qnx4
parent543e8669ed9bfb30545fd52bc0e047ca4df7fb31 (diff)
downloadlinux-fde9f39ac7f1ffd799a96ffa1e06b2051f0898f1.tar.xz
drm/amd/display: Clear dm_state for fast updates
This patch fixes a race condition that causes a use-after-free during amdgpu_dm_atomic_commit_tail. This can occur when 2 non-blocking commits are requested and the second one finishes before the first. Essentially, this bug occurs when the following sequence of events happens: 1. Non-blocking commit #1 is requested w/ a new dm_state #1 and is deferred to the workqueue. 2. Non-blocking commit #2 is requested w/ a new dm_state #2 and is deferred to the workqueue. 3. Commit #2 starts before commit #1, dm_state #1 is used in the commit_tail and commit #2 completes, freeing dm_state #1. 4. Commit #1 starts after commit #2 completes, uses the freed dm_state 1 and dereferences a freelist pointer while setting the context. Since this bug has only been spotted with fast commits, this patch fixes the bug by clearing the dm_state instead of using the old dc_state for fast updates. In addition, since dm_state is only used for its dc_state and amdgpu_dm_atomic_commit_tail will retain the dc_state if none is found, removing the dm_state should not have any consequences in fast updates. This use-after-free bug has existed for a while now, but only caused a noticeable issue starting from 5.7-rc1 due to 3202fa62f ("slub: relocate freelist pointer to middle of object") moving the freelist pointer from dm_state->base (which was unused) to dm_state->context (which is dereferenced). Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=207383 Fixes: bd200d190f45 ("drm/amd/display: Don't replace the dc_state for fast updates") Reported-by: Duncan <1i5t5.duncan@cox.net> Signed-off-by: Mazin Rezk <mnrzk@protonmail.com> Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
Diffstat (limited to 'fs/qnx4')
0 files changed, 0 insertions, 0 deletions