- Fix potential use-after-free issue in suspend/resume

by cleanning up drvdata at unbind.
 - Fix potential NULL pointer dereference issue in suspend/resume
   by setting drm_dev after checking if drm_dev is null or not.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJZ4+dwAAoJEFc4NIkMQxK4GigP/1Cy6ih8F7sKBQrPYGqkJ8zY
 BX2ldNCw7mAH2YEpJGeworgM41Xl9dHnb2+WArW95aMq+9/Dn+UeO05LrOFtjsTT
 B/ayrSb2u5ct3S18s7JpzZtcdpj7N4cRRp4Bi5+MJObLJvESKZmyqilv94lnBlsA
 RnCcVhjidiNHGLKBIAPGj7dVGy7rqVzUI01gxXAFspp1p87GOoglEilHxIJxuu39
 675u9UF/FgPD26hY3url1itd1nkffSAiPkQdbL090fMPfMzc1TzwDd6+ZqkYi/7B
 wmuELIAA+Mt3/b460cXM1Q2EpmECiUfqmAEIBW43Kqz7RxKxL87wXcRxtsRy5C6J
 1qZjK3v+HiWDmlyN65UeUhT/0M2L3WWMqQR9Vip9VDmM1GLi7HU7yzfGV8ceHzCf
 3O+OhurLbIRMtWTM6ixZrGnmV2djvMgOJC96ttmrFEbVSPmOo1yCmGIkWSShk4as
 eGDnzRFWRKNlTAMY/xucuP6ru+Z8GeDC4n9zYykVObRvf7OuMbnEJgq8XXYkHUB7
 LyzmQAxall80ebf/nipTP2lAvpiNbXUruXgS+2BdidjC6sv2gBXDJXLQwEITtNxi
 cbHTZWJT7k3ateKlwSBACPhn4rxudpFPHluxqH5MbXkdf5yhiZYs8jBXnm12BLPi
 aRz7e72/448taJTYoqDI
 =POct
 -----END PGP SIGNATURE-----

Merge tag 'exynos-drm-fixes-for-v4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes

- Fix potential use-after-free issue in suspend/resume
  by cleanning up drvdata at unbind.
- Fix potential NULL pointer dereference issue in suspend/resume
  by setting drm_dev after checking if drm_dev is null or not.

* tag 'exynos-drm-fixes-for-v4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
  drm/exynos: Clear drvdata after component unbind
  drm/exynos: Fix potential NULL pointer dereference in suspend/resume paths
This commit is contained in:
Dave Airlie 2017-10-17 10:14:56 +10:00
commit 2de0307323
1 changed files with 6 additions and 2 deletions

View File

@ -168,11 +168,13 @@ static struct drm_driver exynos_drm_driver = {
static int exynos_drm_suspend(struct device *dev)
{
struct drm_device *drm_dev = dev_get_drvdata(dev);
struct exynos_drm_private *private = drm_dev->dev_private;
struct exynos_drm_private *private;
if (pm_runtime_suspended(dev) || !drm_dev)
return 0;
private = drm_dev->dev_private;
drm_kms_helper_poll_disable(drm_dev);
exynos_drm_fbdev_suspend(drm_dev);
private->suspend_state = drm_atomic_helper_suspend(drm_dev);
@ -188,11 +190,12 @@ static int exynos_drm_suspend(struct device *dev)
static int exynos_drm_resume(struct device *dev)
{
struct drm_device *drm_dev = dev_get_drvdata(dev);
struct exynos_drm_private *private = drm_dev->dev_private;
struct exynos_drm_private *private;
if (pm_runtime_suspended(dev) || !drm_dev)
return 0;
private = drm_dev->dev_private;
drm_atomic_helper_resume(drm_dev, private->suspend_state);
exynos_drm_fbdev_resume(drm_dev);
drm_kms_helper_poll_enable(drm_dev);
@ -427,6 +430,7 @@ static void exynos_drm_unbind(struct device *dev)
kfree(drm->dev_private);
drm->dev_private = NULL;
dev_set_drvdata(dev, NULL);
drm_dev_unref(drm);
}