This is a note to let you know that I've just added the patch titled drm/msm: fix use-after-free on probe deferral to the 6.0-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: drm-msm-fix-use-after-free-on-probe-deferral.patch and it can be found in the queue-6.0 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 6808abdb33bf90330e70a687d29f038507e06ebb Mon Sep 17 00:00:00 2001 From: Johan Hovold <johan+linaro@xxxxxxxxxx> Date: Tue, 13 Sep 2022 10:53:11 +0200 Subject: drm/msm: fix use-after-free on probe deferral From: Johan Hovold <johan+linaro@xxxxxxxxxx> commit 6808abdb33bf90330e70a687d29f038507e06ebb upstream. The bridge counter was never reset when tearing down the DRM device so that stale pointers to deallocated structures would be accessed on the next tear down (e.g. after a second late bind deferral). Given enough bridges and a few probe deferrals this could currently also lead to data beyond the bridge array being corrupted. Fixes: d28ea556267c ("drm/msm: properly add and remove internal bridges") Fixes: a3376e3ec81c ("drm/msm: convert to drm_bridge") Cc: stable@xxxxxxxxxxxxxxx # 3.12 Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxx> Signed-off-by: Johan Hovold <johan+linaro@xxxxxxxxxx> Tested-by: Kuogee Hsieh <quic_khsieh@xxxxxxxxxxx> Reviewed-by: Kuogee Hsieh <quic_khsieh@xxxxxxxxxxx> Patchwork: https://patchwork.freedesktop.org/patch/502665/ Link: https://lore.kernel.org/r/20220913085320.8577-2-johan+linaro@xxxxxxxxxx Signed-off-by: Abhinav Kumar <quic_abhinavk@xxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/gpu/drm/msm/msm_drv.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/gpu/drm/msm/msm_drv.c +++ b/drivers/gpu/drm/msm/msm_drv.c @@ -241,6 +241,7 @@ static int msm_drm_uninit(struct device for (i = 0; i < priv->num_bridges; i++) drm_bridge_remove(priv->bridges[i]); + priv->num_bridges = 0; pm_runtime_get_sync(dev); msm_irq_uninstall(ddev); Patches currently in stable-queue which might be from johan+linaro@xxxxxxxxxx are queue-6.0/drm-msm-dp-fix-memory-corruption-with-too-many-bridges.patch queue-6.0/drm-msm-dp-fix-aux-bus-ep-lifetime.patch queue-6.0/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch queue-6.0/drm-msm-fix-use-after-free-on-probe-deferral.patch queue-6.0/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch queue-6.0/drm-msm-dp-fix-bridge-lifetime.patch queue-6.0/drm-msm-dp-fix-irq-lifetime.patch queue-6.0/drm-msm-hdmi-fix-irq-lifetime.patch