diff options
| author | Imre Deak <imre.deak@intel.com> | 2024-12-03 19:46:32 +0200 |
|---|---|---|
| committer | Imre Deak <imre.deak@intel.com> | 2024-12-05 16:19:09 +0200 |
| commit | 3f611855031f94385c2eeb32b1f99dd7a9fa566b (patch) | |
| tree | b8d8e88a9f600e10e2f3007c85ed907f5f3be18f /CREDITS | |
| parent | b559b68d2761739b7c2e44d6fa59092b0d03e9ed (diff) | |
| download | lwn-3f611855031f94385c2eeb32b1f99dd7a9fa566b.tar.gz lwn-3f611855031f94385c2eeb32b1f99dd7a9fa566b.zip | |
drm/dp_mst: Fix down request message timeout handling
If receiving a reply for an MST down request message times out, the
thread receiving the reply in drm_dp_mst_handle_down_rep() could try to
dereference the drm_dp_sideband_msg_tx txmsg request message after the
thread waiting for the reply - calling drm_dp_mst_wait_tx_reply() - has
timed out and freed txmsg, hence leading to a use-after-free in
drm_dp_mst_handle_down_rep().
Prevent the above by holding the drm_dp_mst_topology_mgr::qlock in
drm_dp_mst_handle_down_rep() for the whole duration txmsg is looked up
from the request list and dereferenced.
v2: Fix unlocking mgr->qlock after verify_rx_request_type() fails.
Cc: Lyude Paul <lyude@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241203174632.2941402-1-imre.deak@intel.com
Diffstat (limited to 'CREDITS')
0 files changed, 0 insertions, 0 deletions