From: Maarten Lankhorst Date: Wed, 11 Nov 2015 10:29:08 +0000 (+0100) Subject: drm/core: Fix old_fb handling in drm_mode_atomic_ioctl. X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=4572372847680ee04f184df916d5cf007c94ff7e;p=GitHub%2Fexynos8895%2Fandroid_kernel_samsung_universal8895.git drm/core: Fix old_fb handling in drm_mode_atomic_ioctl. plane_mask should be cleared inside the retry loop, because it gets reset on every retry. Without this fix the plane->fb refcounting might get out of sync on retries, resulting in either leaked memory or use-after-free. Signed-off-by: Maarten Lankhorst Cc: stable@vger.kernel.org #v4.3 Reviewed-by: Daniel Vetter Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/1447237751-9663-3-git-send-email-maarten.lankhorst@ubuntu.com --- diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 7bb3845d9974..0ac31b1ecb67 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -1446,7 +1446,7 @@ int drm_mode_atomic_ioctl(struct drm_device *dev, struct drm_plane *plane; struct drm_crtc *crtc; struct drm_crtc_state *crtc_state; - unsigned plane_mask = 0; + unsigned plane_mask; int ret = 0; unsigned int i, j; @@ -1486,6 +1486,7 @@ int drm_mode_atomic_ioctl(struct drm_device *dev, state->allow_modeset = !!(arg->flags & DRM_MODE_ATOMIC_ALLOW_MODESET); retry: + plane_mask = 0; copied_objs = 0; copied_props = 0;