diff options
| author | Chris Wilson | 2016-06-20 10:29:17 +0200 |
|---|---|---|
| committer | Daniel Vetter | 2016-06-20 15:21:43 +0200 |
| commit | 996818869c9cc25581e81ff809d790651129cb4a (patch) | |
| tree | 94a66a5845516f343fad0515d828a401953fb899 /drivers/gpu/drm/i915/intel_dp.c | |
| parent | drm/i915: Move backlight unregistration to connector unregistration (diff) | |
| download | kernel-qcow2-linux-996818869c9cc25581e81ff809d790651129cb4a.tar.gz kernel-qcow2-linux-996818869c9cc25581e81ff809d790651129cb4a.tar.xz kernel-qcow2-linux-996818869c9cc25581e81ff809d790651129cb4a.zip | |
drm/i915: Avoid use-after-free of intel_encoder in intel_dp_connector_destrpy
The drm_dp_aux is associated with the intel_dp encoder and not the
connector. Since the encoder is destroyed before the connector,
attempting to free the drm_dp_aux from inside the connector cleanup
causes a use-after-free.
This was applied to the patch that CI was happy with, but in the
confusion of so many series trying to make CI happy, the unready
patch was plucked.
Fixes: c191eca110a3 ("drm/i915: Move intel_connector->unregister to connector->early_unregister")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1466411357-730-1-git-send-email-chris@chris-wilson.co.uk
Diffstat (limited to 'drivers/gpu/drm/i915/intel_dp.c')
| -rw-r--r-- | drivers/gpu/drm/i915/intel_dp.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c index 2e4b66c9ee3e..0b84f8e5df50 100644 --- a/drivers/gpu/drm/i915/intel_dp.c +++ b/drivers/gpu/drm/i915/intel_dp.c @@ -4463,8 +4463,6 @@ intel_dp_connector_destroy(struct drm_connector *connector) if (!IS_ERR_OR_NULL(intel_connector->edid)) kfree(intel_connector->edid); - intel_dp_aux_fini(intel_attached_dp(connector)); - /* Can't call is_edp() since the encoder may have been destroyed * already. */ if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) @@ -4495,6 +4493,9 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder) intel_dp->edp_notifier.notifier_call = NULL; } } + + intel_dp_aux_fini(intel_dp); + drm_encoder_cleanup(encoder); kfree(intel_dig_port); } |