| Message ID | 20181113094914.22353-1-boris.brezillon@bootlin.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/2] drm/vc4: Fix NULL pointer dereference in the async update path | expand |
Boris Brezillon <boris.brezillon@bootlin.com> writes: > vc4_plane_atomic_async_update() calls vc4_plane_atomic_check() > which in turn calls vc4_plane_setup_clipping_and_scaling(), and since > commit 58a6a36fe8e0 ("drm/vc4: Use > drm_atomic_helper_check_plane_state() to simplify the logic"), this > function accesses plane_state->state which will be NULL when called > from the async update path since we're passing previous plane state, > and plane_state->state has been assigned to NULL in > drm_atomic_helper_swap_state(). > > Assign plane->state->state to new_plane_state->state before calling > vc4_plane_atomic_check() and reset it to NULL after > vc4_plane_atomic_check() as returned. > > Fixes: 58a6a36fe8e0 ("drm/vc4: Use drm_atomic_helper_check_plane_state() to simplify the logic") > Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> Hmm. Could we pass in the new state instead, and then pick the dlist items out of the new state's dlist to write into both our dlist copy and the hw dlist?
On Tue, 13 Nov 2018 13:24:07 -0800 Eric Anholt <eric@anholt.net> wrote: > Boris Brezillon <boris.brezillon@bootlin.com> writes: > > > vc4_plane_atomic_async_update() calls vc4_plane_atomic_check() > > which in turn calls vc4_plane_setup_clipping_and_scaling(), and since > > commit 58a6a36fe8e0 ("drm/vc4: Use > > drm_atomic_helper_check_plane_state() to simplify the logic"), this > > function accesses plane_state->state which will be NULL when called > > from the async update path since we're passing previous plane state, > > and plane_state->state has been assigned to NULL in > > drm_atomic_helper_swap_state(). > > > > Assign plane->state->state to new_plane_state->state before calling > > vc4_plane_atomic_check() and reset it to NULL after > > vc4_plane_atomic_check() as returned. > > > > Fixes: 58a6a36fe8e0 ("drm/vc4: Use drm_atomic_helper_check_plane_state() to simplify the logic") > > Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> > > Hmm. Could we pass in the new state instead, and then pick the dlist > items out of the new state's dlist to write into both our dlist copy and > the hw dlist? I considered doing that, but other fields in vc4_plane_state might be updated too, and since we have to update things in place it was just simpler to pass plane->state directly instead copying the updated fields one by one (with the risk of missing one of them).
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c index 9dc3fcbd290b..c33c7dc2119d 100644 --- a/drivers/gpu/drm/vc4/vc4_plane.c +++ b/drivers/gpu/drm/vc4/vc4_plane.c @@ -827,8 +827,13 @@ static void vc4_plane_atomic_async_update(struct drm_plane *plane, plane->state->src_x = state->src_x; plane->state->src_y = state->src_y; - /* Update the display list based on the new crtc_x/y. */ + /* Update the display list based on the new crtc_x/y. + * The plane->state->state update dance is needed to avoid NULL pointer + * dereference in vc4_plane_setup_clipping_and_scaling(). + */ + plane->state->state = state->state; vc4_plane_atomic_check(plane, plane->state); + plane->state->state = NULL; /* Note that we can't just call vc4_plane_write_dlist() * because that would smash the context data that the HVS is
vc4_plane_atomic_async_update() calls vc4_plane_atomic_check() which in turn calls vc4_plane_setup_clipping_and_scaling(), and since commit 58a6a36fe8e0 ("drm/vc4: Use drm_atomic_helper_check_plane_state() to simplify the logic"), this function accesses plane_state->state which will be NULL when called from the async update path since we're passing previous plane state, and plane_state->state has been assigned to NULL in drm_atomic_helper_swap_state(). Assign plane->state->state to new_plane_state->state before calling vc4_plane_atomic_check() and reset it to NULL after vc4_plane_atomic_check() as returned. Fixes: 58a6a36fe8e0 ("drm/vc4: Use drm_atomic_helper_check_plane_state() to simplify the logic") Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com> --- drivers/gpu/drm/vc4/vc4_plane.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)