On Thu, Apr 04, 2024 at 11:33:25PM +0300, Ville Syrjala wrote: > From: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx> > > The modes[] array contains pointers to modes on the connectors' > mode lists, which are protected by dev->mode_config.mutex. > Thus we need to extend modes[] the same protection or by the > time we use it the elements may already be pointing to > freed/reused memory. > > Cc: stable@xxxxxxxxxxxxxxx > Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/10583 > Signed-off-by: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxx> I tried looking for the proper Fixes tag, but it looks like it might be something like 386516744ba4 ("drm/fb: fix fbdev object model + cleanup properly.") > --- > drivers/gpu/drm/drm_client_modeset.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c > index 871e4e2129d6..0683a129b362 100644 > --- a/drivers/gpu/drm/drm_client_modeset.c > +++ b/drivers/gpu/drm/drm_client_modeset.c > @@ -777,6 +777,7 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, > unsigned int total_modes_count = 0; > struct drm_client_offset *offsets; > unsigned int connector_count = 0; > + /* points to modes protected by mode_config.mutex */ > struct drm_display_mode **modes; > struct drm_crtc **crtcs; > int i, ret = 0; > @@ -845,7 +846,6 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, > drm_client_pick_crtcs(client, connectors, connector_count, > crtcs, modes, 0, width, height); > } > - mutex_unlock(&dev->mode_config.mutex); > > drm_client_modeset_release(client); > > @@ -875,6 +875,7 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, > modeset->y = offset->y; > } > } > + mutex_unlock(&dev->mode_config.mutex); > > mutex_unlock(&client->modeset_mutex); > out: > -- > 2.43.2 > -- With best wishes Dmitry
