Imre Deak d834d20d2e drm/dp_mst: Fix resetting msg rx state after topology removal ... commit a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7 upstream. If the MST topology is removed during the reception of an MST down reply or MST up request sideband message, the drm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset from one thread via drm_dp_mst_topology_mgr_set_mst(false), racing with the reading/parsing of the message from another thread via drm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req(). The race is possible since the reader/parser doesn't hold any lock while accessing the reception state. This in turn can lead to a memory corruption in the reader/parser as described by commit bd2fccac61b4 ("drm/dp_mst: Fix MST sideband message body length check"). Fix the above by resetting the message reception state if needed before reading/parsing a message. Another solution would be to hold the drm_dp_mst_topology_mgr::lock for the whole duration of the message reception/parsing in drm_dp_mst_handle_down_rep() and drm_dp_mst_handle_up_req(), however this would require a bigger change. Since the fix is also needed for stable, opting for the simpler solution in this patch. Cc: Lyude Paul <lyude@redhat.com> Cc: <stable@vger.kernel.org> Fixes: 1d082618bbf3 ("drm/display/dp_mst: Fix down/up message handling after sink disconnect") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13056 Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241203160223.2926014-2-imre.deak@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-12-14 19:59:55 +01:00
..
bridge	drm: bridge: samsung-dsim: Fix waiting for empty cmd transfer FIFO on older Exynos	2023-11-20 11:59:08 +01:00
display	drm/dp_mst: Fix resetting msg rx state after topology removal	2024-12-14 19:59:55 +01:00
i2c
ttm	mm, treewide: introduce NR_PAGE_ORDERS	2024-05-02 16:32:41 +02:00
amd_asic_type.h
drm_accel.h	accel: Use XArray instead of IDR for minors	2024-09-30 16:25:13 +02:00
drm_aperture.h	drm/aperture: Remove primary argument	2023-04-16 14:17:41 +02:00
drm_atomic_helper.h	drm/atomic-helpers: Invoke end_fb_access while owning plane state	2023-12-13 18:45:25 +01:00
drm_atomic_state_helper.h	drm/atomic-helper: Add an analog TV atomic_check implementation	2022-11-24 12:42:40 +01:00
drm_atomic_uapi.h
drm_atomic.h	drm: add helper functions to retrieve old and new crtc	2023-03-13 04:43:49 +03:00
drm_audio_component.h	drm/audio: make drm_audio_component.h self-contained	2022-11-29 14:14:51 +02:00
drm_auth.h
drm_blend.h
drm_bridge_connector.h	drm/bridge_connector: drop drm_bridge_connector_en/disable_hpd()	2023-01-05 15:08:10 +01:00
drm_bridge.h	drm/bridge: add ->edid_read hook and drm_bridge_edid_read()	2024-04-03 15:28:38 +02:00
drm_buddy.h
drm_cache.h
drm_client.h	drm next for 6.3-rc1	2023-02-22 18:28:03 -08:00
drm_color_mgmt.h	drm: using mul_u32_u32() requires linux/math64.h	2024-02-05 20:14:34 +00:00
drm_connector.h	Merge tag 'amd-drm-next-6.5-2023-06-09' of https://gitlab.freedesktop.org/agd5f/linux into drm-next	2023-06-15 14:11:22 +10:00
drm_crtc_helper.h	drm/crtc-helper: Remove most include statements from drm_crtc_helper.h	2023-01-18 09:25:32 +01:00
drm_crtc.h	drm: Remove references to removed transitional helpers	2023-07-29 21:25:16 +02:00
drm_damage_helper.h
drm_debugfs_crc.h
drm_debugfs.h	drm: debugfs: provide infrastructure to dump a DRM GPU VA space	2023-07-20 05:16:21 +02:00
drm_device.h	drm-misc-next for v6.3:	2023-01-16 15:33:28 +10:00
drm_displayid.h	drm/edid: Parse topology block for all DispID structure v1.x	2024-06-12 11:12:05 +02:00
drm_drv.h	drm: Disable the cursor plane on atomic contexts with virtualized drivers	2024-01-31 16:19:08 -08:00
drm_edid.h	Revert "drm/edid: Fix csync detailed mode parsing"	2023-08-17 14:39:12 +03:00
drm_encoder_slave.h
drm_encoder.h
drm_exec.h	drm/drm_exec: Work around a WW mutex lockdep oddity	2023-09-07 10:30:12 +02:00
drm_fb_dma_helper.h
drm_fb_helper.h	drm/fb-helper: Remove unused inline function drm_fb_helper_defio_init()	2023-07-25 20:38:37 +02:00
drm_fbdev_dma.h	drm/fbdev-dma: Implement fbdev emulation for GEM DMA helpers	2023-03-14 17:07:47 +01:00
drm_fbdev_generic.h
drm_file.h	accel: Use XArray instead of IDR for minors	2024-09-30 16:25:13 +02:00
drm_fixed.h	drm: Fix drm_fixp2int_round() making it add 0.5	2024-03-26 18:20:10 -04:00
drm_flip_work.h
drm_format_helper.h	drm/format-helper: Simplify drm_fb_build_fourcc_list()	2023-01-03 14:27:39 +01:00
drm_fourcc.h
drm_framebuffer.h
drm_gem_atomic_helper.h	drm/simple-kms: Remove drm_gem_simple_display_pipe_prepare_fb()	2022-12-05 13:35:37 +01:00
drm_gem_dma_helper.h	drm: Clear fd/handle callbacks in struct drm_driver	2023-06-26 11:08:41 +02:00
drm_gem_framebuffer_helper.h
drm_gem_shmem_helper.h	drm: Clear fd/handle callbacks in struct drm_driver	2023-06-26 11:08:41 +02:00
drm_gem_ttm_helper.h	drm/ttm: merge ttm_bo_api.h and ttm_bo_driver.h v2	2022-12-06 12:54:14 +01:00
drm_gem_vram_helper.h	drm: Clear fd/handle callbacks in struct drm_driver	2023-06-26 11:08:41 +02:00
drm_gem.h	drm: add drm_gem_object_is_shared_for_memory_stats() helper	2024-05-02 16:32:41 +02:00
drm_gpuva_mgr.h	drm: manager to keep track of GPUs VA mappings	2023-07-20 05:15:53 +02:00
drm_ioctl.h
drm_kunit_helpers.h	drm/tests: helpers: Include missing drm_drv header	2024-03-26 18:19:53 -04:00
drm_lease.h
drm_legacy.h
drm_managed.h	drm: fix drmm_mutex_init()	2023-05-22 12:23:50 +02:00
drm_mipi_dbi.h	drm/mipi-dbi: Support separate I/O regulator	2022-12-14 14:57:09 +01:00
drm_mipi_dsi.h	drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_generic_write_seq()	2024-08-03 08:53:45 +02:00
drm_mm.h
drm_mode_config.h	drm/fbdev-generic: Remove unused prefer_shadow_fbdev flag	2023-03-22 13:32:47 +01:00
drm_mode_object.h
drm_modes.h	drm/modes: Add a function to generate analog display modes	2022-11-24 12:42:39 +01:00
drm_modeset_helper_vtables.h	drm/probe-helper: warn about negative .get_modes()	2024-04-03 15:28:32 +02:00
drm_modeset_helper.h
drm_modeset_lock.h
drm_module.h
drm_of.h	drm: of: Add drm_of_get_dsi_bus helper function	2023-01-27 09:39:21 +01:00
drm_panel.h	drm/panel: Fix kernel-doc typo for follower_lock	2023-08-03 10:21:27 +02:00
drm_pciids.h	drm: Remove some obsolete drm pciids(tdfx, mga, i810, savage, r128, sis, via)	2023-01-13 09:44:56 +01:00
drm_plane_helper.h	drm/plane-helper: Add the missing declaration of drm_atomic_state	2022-12-16 10:23:11 +01:00
drm_plane.h	drm: Allow drivers to indicate the damage helpers to ignore damage clips	2024-01-31 16:19:08 -08:00
drm_prime.h	Revert "drm/prime: Unexport helpers for fd/handle conversion"	2024-01-20 11:51:39 +01:00
drm_print.h	drm/printer: Allow NULL data in devcoredump printer	2024-10-10 11:57:36 +02:00
drm_privacy_screen_consumer.h
drm_privacy_screen_driver.h
drm_privacy_screen_machine.h
drm_probe_helper.h	drm: Add an HPD poll helper to reschedule the poll work	2023-08-23 17:14:37 -04:00
drm_property.h
drm_rect.h
drm_self_refresh_helper.h
drm_simple_kms_helper.h	drm/simple-kms: Remove drm_gem_simple_display_pipe_prepare_fb()	2022-12-05 13:35:37 +01:00
drm_suballoc.h	drm/suballoc: Extract amdgpu_sa.c as generic suballocation helper	2023-03-01 17:18:19 +01:00
drm_syncobj.h	drm/syncobj: add IOCTL to register an eventfd	2023-07-20 12:01:03 +02:00
drm_sysfs.h	drm/sysfs: rename drm_sysfs_connector_status_event()	2023-06-23 15:54:00 +02:00
drm_util.h
drm_utils.h
drm_vblank_work.h
drm_vblank.h	drm/vblank: Add helper to get next vblank time	2023-03-28 14:52:59 -07:00
drm_vma_manager.h	drm/drm_vma_manager: Add drm_vma_node_allow_once()	2023-01-19 14:16:55 +01:00
drm_writeback.h
gma_drm.h
gpu_scheduler.h	gpu/drm: Eliminate DRM_SCHED_PRIORITY_UNSET	2023-10-17 20:35:38 -04:00
gud.h
i915_component.h	drm/i915/mtl: Define GSC Proxy component interface	2023-05-04 02:57:28 -07:00
i915_drm.h	drm/i915_drm.h: fix a typo	2023-06-02 20:05:45 +03:00
i915_gsc_proxy_mei_interface.h	drm/i915/mtl: Define GSC Proxy component interface	2023-05-04 02:57:28 -07:00
i915_hdcp_interface.h	drm/i915/hdcp: Move away from master naming to arbiter	2023-05-31 10:22:13 +05:30
i915_pciids.h	drm/i915: Add RPL-U sub platform	2023-02-16 12:29:51 +02:00
i915_pxp_tee_interface.h
intel_lpe_audio.h
intel-gtt.h
spsc_queue.h
task_barrier.h	drm: Spelling s/randevouz/rendez-vous/	2023-07-29 21:11:54 +02:00