drm/i915: fix use after free during eDP encoder destroying

ideak · danvet · commit c8bd0e49519c · 2014-12-16T10:38:55.000+01:00
After commit a18c0af uthor: Thierry Reding <treding@nvidia.com> Date: Wed Dec 10 11:38:49 2014 +0100 drm: Zero out DRM object memory upon cleanup we will use the eDP encoder during destroying it. Fix this by calling drm_encoder_cleanup() at a point when the encoder is not used any more. This caused a NULL pointer dereference in pps_lock(), I can't see that it caused any other problem. All the other encoders seem to call drm_encoder_cleanup() at a safe place. Signed-off-by: Imre Deak <imre.deak@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
@@ -4310,7 +4310,6 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
 
 	drm_dp_aux_unregister(&intel_dp->aux);
 	intel_dp_mst_encoder_cleanup(intel_dig_port);
-	drm_encoder_cleanup(encoder);
 	if (is_edp(intel_dp)) {
 		cancel_delayed_work_sync(&intel_dp->panel_vdd_work);
 		/*
@@ -4326,6 +4325,7 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
 			intel_dp->edp_notifier.notifier_call = NULL;
 		}
 	}
+	drm_encoder_cleanup(encoder);
 	kfree(intel_dig_port);
 }
 

Original file line number	Diff line number	Diff line change
`@@ -4310,7 +4310,6 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)`
`4310`	`4310`
`4311`	`4311`	`drm_dp_aux_unregister(&intel_dp->aux);`
`4312`	`4312`	`intel_dp_mst_encoder_cleanup(intel_dig_port);`
`4313`		`- drm_encoder_cleanup(encoder);`
`4314`	`4313`	`if (is_edp(intel_dp)) {`
`4315`	`4314`	`cancel_delayed_work_sync(&intel_dp->panel_vdd_work);`
`4316`	`4315`	`/*`
`@@ -4326,6 +4325,7 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)`
`4326`	`4325`	`intel_dp->edp_notifier.notifier_call = NULL;`
`4327`	`4326`	`}`
`4328`	`4327`	`}`
	`4328`	`+ drm_encoder_cleanup(encoder);`
`4329`	`4329`	`kfree(intel_dig_port);`
`4330`	`4330`	`}`
`4331`	`4331`