From: Maarten Lankhorst <maarten.lankhorst@xxxxxxxxxxxxxxx> We enable the DP aux channel during probe, but may free the connector soon afterwards. Ensure the DP aux display power put (and any other async put for that matter) is completed before everything is freed, to prevent a use-after-free in icl_aux_pw_to_phy(), called from icl_combo_phy_aux_power_well_disable. v2 by Jani: - do a regular flush before freeing dig_port Cc: Imre Deak <imre.deak@xxxxxxxxx> Signed-off-by: Maarten Lankhorst <maarten.lankhorst@xxxxxxxxxxxxxxx> Signed-off-by: Jani Nikula <jani.nikula@xxxxxxxxx> --- v2 of https://patchwork.freedesktop.org/patch/msgid/20221220094618.207126-1-maarten.lankhorst@xxxxxxxxxxxxxxx The encoder cleanup paths could use some cleanup and unification, but do what's needed here. --- drivers/gpu/drm/i915/display/g4x_dp.c | 2 ++ drivers/gpu/drm/i915/display/intel_ddi.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/drivers/gpu/drm/i915/display/g4x_dp.c b/drivers/gpu/drm/i915/display/g4x_dp.c index 112d91d81fdc..e8147c18fa93 100644 --- a/drivers/gpu/drm/i915/display/g4x_dp.c +++ b/drivers/gpu/drm/i915/display/g4x_dp.c @@ -1379,6 +1379,8 @@ bool g4x_dp_init(struct drm_i915_private *dev_priv, return true; err_init_connector: + /* aync put accesses the dig_port, ensure it's done before free */ + intel_display_power_flush_work(dev_priv); drm_encoder_cleanup(encoder); err_encoder_init: kfree(intel_connector); diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c index d1a9a3cf94b5..dfa1c44dc442 100644 --- a/drivers/gpu/drm/i915/display/intel_ddi.c +++ b/drivers/gpu/drm/i915/display/intel_ddi.c @@ -4971,6 +4971,8 @@ void intel_ddi_init(struct drm_i915_private *dev_priv, enum port port) return; err: + /* aync put accesses the dig_port, ensure it's done before free */ + intel_display_power_flush_work(dev_priv); drm_encoder_cleanup(&encoder->base); kfree(dig_port); } -- 2.39.2
