On Tue, Dec 31, 2024 at 11:40:03AM +0100, Luca Ceresoli wrote:
> Refcount the out_bridge to avoid a use-after-free in case it is
> hot-unplugged.
>
> Signed-off-by: Luca Ceresoli <luca.ceresoli@xxxxxxxxxxx>
>
> ---
>
> This patch was added in v5.
> ---
> drivers/gpu/drm/bridge/samsung-dsim.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c
> index c4d1563fd32019efde523dfc0863be044c05a826..4d32c453265931b5aecdc125623368fecacf4be3 100644
> --- a/drivers/gpu/drm/bridge/samsung-dsim.c
> +++ b/drivers/gpu/drm/bridge/samsung-dsim.c
> @@ -1756,6 +1756,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
> return ret;
> }
>
> + drm_bridge_get(out_bridge);
Well... out_bridge might already be gone now. You got the pointer, but
it is not protected in any way. Gone.
> dsi->out_bridge = out_bridge;
>
> DRM_DEV_INFO(dev, "Attached %s device (lanes:%d bpp:%d mode-flags:0x%lx)\n",
> @@ -1774,13 +1775,13 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
> if (!(device->mode_flags & MIPI_DSI_MODE_VIDEO)) {
> ret = samsung_dsim_register_te_irq(dsi, &device->dev);
> if (ret)
> - return ret;
> + goto err_put_bridge;
> }
>
> if (pdata->host_ops && pdata->host_ops->attach) {
> ret = pdata->host_ops->attach(dsi, device);
> if (ret)
> - return ret;
> + goto err_put_bridge;
> }
>
> dsi->lanes = device->lanes;
> @@ -1788,6 +1789,10 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
> dsi->mode_flags = device->mode_flags;
>
> return 0;
> +
> +err_put_bridge:
> + drm_bridge_put_and_clear(dsi->out_bridge);
> + return ret;
> }
>
> static void samsung_dsim_unregister_te_irq(struct samsung_dsim *dsi)
> @@ -1804,7 +1809,7 @@ static int samsung_dsim_host_detach(struct mipi_dsi_host *host,
> struct samsung_dsim *dsi = host_to_dsi(host);
> const struct samsung_dsim_plat_data *pdata = dsi->plat_data;
>
> - dsi->out_bridge = NULL;
> + drm_bridge_put_and_clear(dsi->out_bridge);
>
> if (pdata->host_ops && pdata->host_ops->detach)
> pdata->host_ops->detach(dsi, device);
>
> --
> 2.34.1
>
--
With best wishes
Dmitry
