From patchwork Mon Jun 12 22:01:06 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bjorn Andersson X-Patchwork-Id: 106908 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp158288vqr; Mon, 12 Jun 2023 15:04:55 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6iFDeFlQgvSAs8E25FMh2C+PLptLgpLZ7WAL0yeXj/xbvKSCDWKKEhq9mYGSease6X+qBc X-Received: by 2002:aa7:cf02:0:b0:514:ae18:1637 with SMTP id a2-20020aa7cf02000000b00514ae181637mr5572037edy.23.1686607495403; Mon, 12 Jun 2023 15:04:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686607495; cv=none; d=google.com; s=arc-20160816; b=Ffmupxfn6xPRGscG84X1ke8dd8ODWG3puEVDnA6E6hipCgR7pUj79BF5jTDpD+ALqy b4PF0y0+ggud8Wif8dyrBvCQSBwrEEauZJNIsB7CNLEX5g7a9Ih190vqr+936lPLp480 +5zjxQXEp2ogZy42ccxCjjrUuSRF8MJrf7zSJoQK9MlruVmFJZpNmnmmK5BZS0tZSl00 eGoPr/LvBb8o/dfru+DieGG45yokzQqTl0v0QD0s6G/aO6Cs8dtcYE18Wlu8EcaclZ+N fwEeFj85P9mFlBpbu3GV6QkakIdKh+PxkxIuWermZJWiuzWqUSSDpLOTPAGb+L9IfSrV HI3w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=zzS5BmfcuP5aqBLpojqEFxLb3/1RxRnELQhcDh6o1Zg=; b=O/AGYntKQn5PtmSc0tN1igjRGGXZyOtkMFEAOhHh2rh3/zoEAYvsboutfYeu+FBJcY bGBcHbsbTzOuUD1BUpshx+2ra/K7aJH5lQuo4Ot6KXA/qswrThrtSPzX/GXDsrvE3TA4 f8FHYVuQmlOIEhahohoHcb3+QJOcSf02IRgWjqKiEZzLB2J3YUm6psBLhXKamoQQ1CwH eH8m6Zdkn5UutjuwhE/BiYCzcYIRbmhZKQ9GL8sg7NafvbE1CruurfzXhiuxI8mqU1jS apn5xr9Su7+MlWu2H6edtnN/hLoEnd8U1ECqPx3ANpgv52+cJu1mdcwOS0k3GDHOY9pT 36rw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@quicinc.com header.s=qcppdkim1 header.b=gcdWm56J; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=quicinc.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id l13-20020aa7c30d000000b0051640beba70si6479106edq.559.2023.06.12.15.04.31; Mon, 12 Jun 2023 15:04:55 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@quicinc.com header.s=qcppdkim1 header.b=gcdWm56J; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=quicinc.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238171AbjFLWBe (ORCPT + 99 others); Mon, 12 Jun 2023 18:01:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60394 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233166AbjFLWBb (ORCPT ); Mon, 12 Jun 2023 18:01:31 -0400 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CB316E57; Mon, 12 Jun 2023 15:01:30 -0700 (PDT) Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 35CLcn01029870; Mon, 12 Jun 2023 22:01:20 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; h=from : to : cc : subject : date : message-id : mime-version : content-transfer-encoding : content-type; s=qcppdkim1; bh=zzS5BmfcuP5aqBLpojqEFxLb3/1RxRnELQhcDh6o1Zg=; b=gcdWm56JKuJbQumhp3jioYyyo856VElaNlsD7VVWeK4+UanFDjDqRj7O5+c49iuZWSye G2fb1ynIA/smiyXfoinXulHdCQidsqC0g/7ssWMvMz6zJLBoY9cUhsah6ULz7vWq1Bjz CPKXr5bU1pF4Z837X/Y+N1Fa1lIjiIu+IgQDQ76HkmOPrwrpaEkis69LKK6oL6b7a8si STP8Vmju/2xiPUtJmjitDOEBb3UiRCXYJQxSDVrVPmNL1p7tA5jr4M4++MArID9zxk72 lUS9BV6fVPgwAC7N2tRODH/D4Dd2IBAcInn0nnOeLjmVRLw3pgrIZjGWmGmATAEtTmi9 rw== Received: from nalasppmta04.qualcomm.com (Global_NAT1.qualcomm.com [129.46.96.20]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 3r690q08h5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 12 Jun 2023 22:01:20 +0000 Received: from nalasex01c.na.qualcomm.com (nalasex01c.na.qualcomm.com [10.47.97.35]) by NALASPPMTA04.qualcomm.com (8.17.1.5/8.17.1.5) with ESMTPS id 35CM1Bxk025305 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 12 Jun 2023 22:01:11 GMT Received: from hu-bjorande-lv.qualcomm.com (10.49.16.6) by nalasex01c.na.qualcomm.com (10.47.97.35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.42; Mon, 12 Jun 2023 15:01:11 -0700 From: Bjorn Andersson To: Rob Clark , Abhinav Kumar , Dmitry Baryshkov , Marijn Suijten , Kuogee Hsieh , Johan Hovold CC: Sean Paul , David Airlie , "Daniel Vetter" , Stephen Boyd , Vinod Polimera , Douglas Anderson , , , , Subject: [PATCH] drm/msm/dp: Drop aux devices together with DP controller Date: Mon, 12 Jun 2023 15:01:06 -0700 Message-ID: <20230612220106.1884039-1-quic_bjorande@quicinc.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.49.16.6] X-ClientProxiedBy: nalasex01c.na.qualcomm.com (10.47.97.35) To nalasex01c.na.qualcomm.com (10.47.97.35) X-QCInternal: smtphost X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-ORIG-GUID: 9OWbfKAYFf0vB3CrdO9IuQqsQ1M4MrFE X-Proofpoint-GUID: 9OWbfKAYFf0vB3CrdO9IuQqsQ1M4MrFE X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.573,FMLib:17.11.176.26 definitions=2023-06-12_16,2023-06-12_02,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 mlxlogscore=999 priorityscore=1501 spamscore=0 lowpriorityscore=0 suspectscore=0 clxscore=1011 bulkscore=0 adultscore=0 phishscore=0 malwarescore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2305260000 definitions=main-2306120189 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1768536141132596770?= X-GMAIL-MSGID: =?utf-8?q?1768536141132596770?= Using devres to depopulate the aux bus made sure that upon a probe deferral the EDP panel device would be destroyed and recreated upon next attempt. But the struct device which the devres is tied to is the DPUs (drm_dev->dev), which may be happen after the DP controller is torn down. Indications of this can be seen in the commonly seen EDID-hexdump full of zeros in the log, or the occasional/rare KASAN fault where the panel's attempt to read the EDID information causes a use after free on DP resources. It's tempting to move the devres to the DP controller's struct device, but the resources used by the device(s) on the aux bus are explicitly torn down in the error path. The KASAN-reported use-after-free also remains, as the DP aux "module" explicitly frees its devres-allocated memory in this code path. As such, explicitly depopulate the aux bus in the error path, and in the component unbind path, to avoid these issues. Fixes: 2b57f726611e ("drm/msm/dp: fix aux-bus EP lifetime") Signed-off-by: Bjorn Andersson Reviewed-by: Dmitry Baryshkov Reviewed-by: Douglas Anderson Reviewed-by: Johan Hovold Tested-by: Johan Hovold --- drivers/gpu/drm/msm/dp/dp_display.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c index 3d8fa2e73583..bbb0550a022b 100644 --- a/drivers/gpu/drm/msm/dp/dp_display.c +++ b/drivers/gpu/drm/msm/dp/dp_display.c @@ -322,6 +322,8 @@ static void dp_display_unbind(struct device *dev, struct device *master, kthread_stop(dp->ev_tsk); + of_dp_aux_depopulate_bus(dp->aux); + dp_power_client_deinit(dp->power); dp_unregister_audio_driver(dev, dp->audio); dp_aux_unregister(dp->aux); @@ -1521,11 +1523,6 @@ void msm_dp_debugfs_init(struct msm_dp *dp_display, struct drm_minor *minor) } } -static void of_dp_aux_depopulate_bus_void(void *data) -{ - of_dp_aux_depopulate_bus(data); -} - static int dp_display_get_next_bridge(struct msm_dp *dp) { int rc; @@ -1554,12 +1551,6 @@ static int dp_display_get_next_bridge(struct msm_dp *dp) of_node_put(aux_bus); if (rc) goto error; - - rc = devm_add_action_or_reset(dp->drm_dev->dev, - of_dp_aux_depopulate_bus_void, - dp_priv->aux); - if (rc) - goto error; } else if (dp->is_edp) { DRM_ERROR("eDP aux_bus not found\n"); return -ENODEV; @@ -1583,6 +1574,7 @@ static int dp_display_get_next_bridge(struct msm_dp *dp) error: if (dp->is_edp) { + of_dp_aux_depopulate_bus(dp_priv->aux); disable_irq(dp_priv->irq); dp_display_host_phy_exit(dp_priv); dp_display_host_deinit(dp_priv);