evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
android_kernel_oneplus_msm8998/drivers/gpu/drm/i915
History
Andrey Ryabinin 5b0465dd4a drm/i915: fix use-after-free in page_flip_completed() 
commit 5351fbb1bf1413f6024892093528280769ca852f upstream.

page_flip_completed() dereferences 'work' variable after executing
queue_work(). This is not safe as the 'work' item might be already freed
by queued work:

    BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490 at addr ffff8803dc010f90
    Call Trace:
     __asan_report_load8_noabort+0x59/0x80
     page_flip_completed+0x3ff/0x490
     intel_finish_page_flip_mmio+0xe3/0x130
     intel_pipe_handle_vblank+0x2d/0x40
     gen8_irq_handler+0x4a7/0xed0
     __handle_irq_event_percpu+0xf6/0x860
     handle_irq_event_percpu+0x6b/0x160
     handle_irq_event+0xc7/0x1b0
     handle_edge_irq+0x1f4/0xa50
     handle_irq+0x41/0x70
     do_IRQ+0x9a/0x200
     common_interrupt+0x89/0x89

    Freed:
     kfree+0x113/0x4d0
     intel_unpin_work_fn+0x29a/0x3b0
     process_one_work+0x79e/0x1b70
     worker_thread+0x611/0x1460
     kthread+0x241/0x3a0
     ret_from_fork+0x27/0x40

Move queue_work() after	trace_i915_flip_complete() to fix this.

Fixes: e5510fac98 ("drm/i915: add tracepoints for flip requests & completions")
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20170126143211.24013-1-aryabinin@virtuozzo.com
(cherry picked from commit 05c41f926fcc7ef838c80a6a99d84f67b4e0b824)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-02-14 15:22:52 -08:00
..
dvo.h drm/i915: Constify adjusted_mode 2015-09-30 10:20:11 +02:00
dvo_ch7xxx.c drm/i915: Constify adjusted_mode 2015-09-30 10:20:11 +02:00
dvo_ch7017.c drm/i915: Constify adjusted_mode 2015-09-30 10:20:11 +02:00
dvo_ivch.c drm/i915: Constify adjusted_mode 2015-09-30 10:20:11 +02:00
dvo_ns2501.c drm/i915: Constify adjusted_mode 2015-09-30 10:20:11 +02:00
dvo_sil164.c drm/i915: Constify adjusted_mode 2015-09-30 10:20:11 +02:00
dvo_tfp410.c drm/i915: Constify adjusted_mode 2015-09-30 10:20:11 +02:00
i915_cmd_parser.c drm/i915: Add GEN7_GPGPU_DISPATCHDIMX/Y/Z to the register whitelist 2015-10-06 10:40:22 +02:00
i915_debugfs.c drm/i915: Introduce a gmbus power domain 2015-12-02 16:42:46 +02:00
i915_dma.c drm/i915: Init power domains early in driver load 2016-03-03 15:07:22 -08:00
i915_drv.c drm/i915: refine qemu south bridge detection 2016-03-09 15:34:56 -08:00
i915_drv.h drm/i915: Unalias obj->phys_handle and obj->userptr 2016-10-31 04:13:58 -06:00
i915_gem.c drm/i915: Only spin whilst waiting on the current request 2015-12-22 12:56:58 +02:00
i915_gem_batch_pool.c
i915_gem_batch_pool.h
i915_gem_context.c drm/i915: Restore inhibiting the load of the default context 2016-03-03 15:07:22 -08:00
i915_gem_debug.c
i915_gem_dmabuf.c
i915_gem_evict.c drm/i915: Remove dead i915_gem_evict_everything() 2015-10-07 16:05:40 +02:00
i915_gem_execbuffer.c drm/i915: Kill DRI1 cliprects 2015-10-07 16:05:41 +02:00
i915_gem_fence.c drm/i915: Mark uneven memory banks on gen4 desktop as unknown swizzling 2015-11-23 16:42:33 +02:00
i915_gem_gtt.c drm/i915: fix aliasing_ppgtt leak 2016-09-07 08:32:42 +02:00
i915_gem_gtt.h drm/i915: prevent out of range pt in the PDE macros (take 3) 2015-10-06 14:15:29 +02:00
i915_gem_render_state.c
i915_gem_render_state.h
i915_gem_shrinker.c drm/i915: Update ifdeffery for mutex->owner 2016-07-27 09:47:34 -07:00
i915_gem_stolen.c drm/i915: Account for TSEG size when determining 865G stolen base 2016-10-31 04:13:58 -06:00
i915_gem_tiling.c
i915_gem_userptr.c Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 2015-11-10 09:33:06 -08:00
i915_gpu_error.c drm/i915: rename INSTDONE1 to GEN4_INSTDONE1 2015-10-02 14:25:19 +02:00
i915_guc_reg.h drm/i915: Parametrize UOS_RSA_SCRATCH 2015-09-30 10:20:13 +02:00
i915_guc_submission.c drm/i915/guc: Add host2guc notification for suspend and resume 2015-10-06 10:32:22 +02:00
i915_ioc32.c
i915_irq.c drm/i915: shut up gen8+ SDE irq dmesg noise 2016-03-03 15:07:10 -08:00
i915_params.c Revert "drm/i915: skip modeset if compatible for everyone." 2015-11-19 10:38:09 +02:00
i915_reg.h drm/i915: Fix hpd live status bits for g4x 2016-09-15 08:27:44 +02:00
i915_suspend.c drm/i915: Parametrize and fix SWF registers 2015-10-13 13:20:38 +02:00
i915_sysfs.c drm/i915/bxt: fix RC6 residency time calculation 2015-09-30 17:15:13 +02:00
i915_trace.h drm/i915: Add a tracepoint for the shrinker 2015-10-07 16:05:38 +02:00
i915_trace_points.c
i915_vgpu.c
i915_vgpu.h
intel_acpi.c drm/i915: Drop unnecessary #include <linux/vga_switcheroo.h> 2015-10-13 10:18:38 +02:00
intel_atomic.c drm/i915: revert a few more watermark commits 2015-10-13 13:59:55 +02:00
intel_atomic_plane.c
intel_audio.c drm/i915: Use round to closest when computing the CEA 1.001 pixel clocks 2015-10-19 17:56:02 +02:00
intel_bios.c drm/i915: Check VBT for port presence in addition to the strap on VLV/CHV 2016-09-15 08:27:48 +02:00
intel_bios.h drm/i915: Ignore "digital output" and "not HDMI output" bits for eDP detection 2015-09-23 16:58:29 +02:00
intel_crt.c drm/i915: Don't leak edid in intel_crt_detect_ddc() 2017-02-01 08:30:53 +01:00
intel_csr.c drm/i915/skl: Fix DMC load on Skylake J0 and K0 2016-05-11 11:21:27 +02:00
intel_ddi.c drm/i915: Fix eDP low vswing for Broadwell 2016-05-11 11:21:24 +02:00
intel_display.c drm/i915: fix use-after-free in page_flip_completed() 2017-02-14 15:22:52 -08:00
intel_dp.c Revert "drm/i915: Check live status before reading edid" 2016-10-31 04:13:58 -06:00
intel_dp_mst.c drm/i915: Fix race condition in intel_dp_destroy_mst_connector() 2016-05-04 14:48:43 -07:00
intel_drv.h Revert "drm/i915: Check live status before reading edid" 2016-10-31 04:13:58 -06:00
intel_dsi.c drm/i915/bxt: get DSI pixelclock 2015-10-02 14:45:51 +02:00
intel_dsi.h drm/i915/bxt: get DSI pixelclock 2015-10-02 14:45:51 +02:00
intel_dsi_panel_vbt.c drm/i915/dsi: don't pass arbitrary data to sideband 2016-03-03 15:07:22 -08:00
intel_dsi_pll.c drm/i915/bxt: vlv_dsi_reset_clocks() can be static 2015-10-06 10:57:06 +02:00
intel_dvo.c drm/i915: Constify adjusted_mode 2015-09-30 10:20:11 +02:00
intel_fbc.c drm/i915: fix FBC buffer size checks 2015-10-09 09:35:50 +02:00
intel_fbdev.c drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config() 2016-06-07 18:14:36 -07:00
intel_fifo_underrun.c
intel_frontbuffer.c
intel_guc.h drm/i915/guc: Add host2guc notification for suspend and resume 2015-10-06 10:32:22 +02:00
intel_guc_fwif.h drm/i915/guc: Add host2guc notification for suspend and resume 2015-10-06 10:32:22 +02:00
intel_guc_loader.c drm/i915: Fix locking around GuC firmware load 2015-11-04 13:23:15 +10:00
intel_hdmi.c drm/i915: Respect alternate_ddc_pin for all DDI ports 2016-11-18 10:48:36 +01:00
intel_hotplug.c drm/i915: intel_hpd_init(): Fix suspend/resume reprobing 2016-03-03 15:07:22 -08:00
intel_i2c.c drm/i915: fix error path in intel_setup_gmbus() 2016-03-03 15:07:23 -08:00
intel_lrc.c drm/i915: Fixup the free space logic in ring_prepare 2016-05-04 14:48:47 -07:00
intel_lrc.h Merge commit '06d1ee32a4d25356a710b49d5e95dbdd68bdf505' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into drm-next 2015-10-16 10:25:28 +10:00
intel_lvds.c drm/i915: Clean up LVDS register handling 2015-10-13 13:21:15 +02:00
intel_mocs.c
intel_mocs.h
intel_modes.c drm/i915: Add HDMI aspect ratio property for SDVO 2015-09-30 10:20:12 +02:00
intel_opregion.c drm/i915: Don't complain about lack of ACPI video bios 2016-08-20 18:09:21 +02:00
intel_overlay.c
intel_panel.c drm/i915: disable CPU PWM also on LPT/SPT backlight disable 2015-10-28 19:10:37 +02:00
intel_pm.c drm/i915/gen9: fix the WaWmMemoryReadLatency implementation 2016-10-31 04:13:58 -06:00
intel_psr.c drm/i915: Parametrize HSW video DIP data registers 2015-10-13 13:15:50 +02:00
intel_renderstate.h
intel_renderstate_gen6.c
intel_renderstate_gen7.c
intel_renderstate_gen8.c
intel_renderstate_gen9.c
intel_ringbuffer.c drm/i915: Fixup the free space logic in ring_prepare 2016-05-04 14:48:47 -07:00
intel_ringbuffer.h
intel_runtime_pm.c drm/i915: Introduce a gmbus power domain 2015-12-02 16:42:46 +02:00
intel_sdvo.c Revert "drm/i915: Call encoder hotplug for init and resume cases" 2015-10-08 21:51:57 +02:00
intel_sdvo_regs.h
intel_sideband.c
intel_sprite.c drm/i915: Avoid pointer arithmetic in calculating plane surface offset 2016-09-24 10:07:42 +02:00
intel_tv.c Merge remote-tracking branch 'airlied/drm-next' into drm-intel-next 2015-09-30 08:47:41 +02:00
intel_uncore.c drm/i915: Use fw_domains_put_with_fifo() on HSW 2016-05-04 14:48:47 -07:00
Kconfig
Makefile