target/linux/bcm27xx/patches-5.10/950-0682-drm-Document-use-after-free-gotcha-with-private-obje.patch

   1 From c417eda92ac1a1a89c160826eb2068fbdf1895ab Mon Sep 17 00:00:00 2001
   2 From: Maxime Ripard <maxime@cerno.tech>
   3 Date: Fri, 4 Dec 2020 16:11:33 +0100
   4 Subject: [PATCH] drm: Document use-after-free gotcha with private
   5  objects
   6
   7 The private objects have a gotcha that could result in a use-after-free,
   8 make sure it's properly documented.
   9
  10 Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
  11 Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  12 ---
  13  include/drm/drm_atomic.h | 20 ++++++++++++++++++++
  14  1 file changed, 20 insertions(+)
  15
  16 --- a/include/drm/drm_atomic.h
  17 +++ b/include/drm/drm_atomic.h
  18 @@ -248,6 +248,26 @@ struct drm_private_state_funcs {
  19   *    drm_dev_register()
  20   * 2/ all calls to drm_atomic_private_obj_fini() must be done after calling
  21   *    drm_dev_unregister()
  22 + *
  23 + * If that private object is used to store a state shared by multiple
  24 + * CRTCs, proper care must be taken to ensure that non-blocking commits are
  25 + * properly ordered to avoid a use-after-free issue.
  26 + *
  27 + * Indeed, assuming a sequence of two non-blocking &drm_atomic_commit on two
  28 + * different &drm_crtc using different &drm_plane and &drm_connector, so with no
  29 + * resources shared, there's no guarantee on which commit is going to happen
  30 + * first. However, the second &drm_atomic_commit will consider the first
  31 + * &drm_private_obj its old state, and will be in charge of freeing it whenever
  32 + * the second &drm_atomic_commit is done.
  33 + *
  34 + * If the first &drm_atomic_commit happens after it, it will consider its
  35 + * &drm_private_obj the new state and will be likely to access it, resulting in
  36 + * an access to a freed memory region. Drivers should store (and get a reference
  37 + * to) the &drm_crtc_commit structure in our private state in
  38 + * &drm_mode_config_helper_funcs.atomic_commit_setup, and then wait for that
  39 + * commit to complete as the first step of
  40 + * &drm_mode_config_helper_funcs.atomic_commit_tail, similar to
  41 + * drm_atomic_helper_wait_for_dependencies().
  42   */
  43  struct drm_private_obj {
  44         /**