diff options
| author | Mark Menzynski <mmenzyns@redhat.com> | 2022-05-23 13:35:41 +0200 |
|---|---|---|
| committer | Lyude Paul <lyude@redhat.com> | 2022-05-23 14:37:27 -0400 |
| commit | 6b03816f869529393b37d03e5d75b68f7365a7a4 (patch) | |
| tree | 69a2ab0ae1dd409b70f42df2e779dbd5b0c2aadd | |
| parent | 8e71a4a8156a9f3fa27088dc59e852693713d94f (diff) | |
| download | lwn-6b03816f869529393b37d03e5d75b68f7365a7a4.tar.gz lwn-6b03816f869529393b37d03e5d75b68f7365a7a4.zip | |
drm/nouveau: clear output poll workers before nouveau_fbcon_destroy()
Resources needed for output poll workers are destroyed in
nouveau_fbcon_fini() before output poll workers are cleared in
nouveau_display_fini(). This means there is a time between fbcon_fini()
and display_fini(), where if output poll happens, it crashes.
This patch introduces another output poll clearing before fbcon
resources are destroyed.
BUG: KASAN: use-after-free in
__drm_fb_helper_initial_config_and_unlock.cold+0x1f3/0x291
[drm_kms_helper]
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: Karol Herbst <kherbst@redhat.com>
Cc: Lyude Paul <lyude@redhat.com>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: dri-devel@lists.freedesktop.org
Cc: nouveau@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Mark Menzynski <mmenzyns@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220523113541.10562-1-mmenzyns@redhat.com
| -rw-r--r-- | drivers/gpu/drm/nouveau/nouveau_fbcon.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c index 4f9b3aa5deda..5226323e55d3 100644 --- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c +++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c @@ -39,6 +39,7 @@ #include <drm/drm_crtc.h> #include <drm/drm_crtc_helper.h> +#include <drm/drm_probe_helper.h> #include <drm/drm_fb_helper.h> #include <drm/drm_fourcc.h> #include <drm/drm_atomic.h> @@ -605,6 +606,7 @@ nouveau_fbcon_fini(struct drm_device *dev) if (!drm->fbcon) return; + drm_kms_helper_poll_fini(dev); nouveau_fbcon_accel_fini(dev); nouveau_fbcon_destroy(dev, drm->fbcon); kfree(drm->fbcon); |