Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 12 Apr 2018 16:47:27 +0100
From:   Russell King - ARM Linux <linux@armlinux.org.uk>
To:     Ayan Kumar Halder <ayan.halder@arm.com>
Cc:     liviu.dudau@arm.com, brian.starkey@arm.com, airlied@linux.ie,
        dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
        alexandru-cosmin.gheorghe@arm.com, nd@arm.com
Subject: Re: [PATCH] tda998x: Check ref count before invoking
 drm_connector_cleanup in unbind
Message-ID: <20180412154727.GJ16141@n2100.armlinux.org.uk>
References: <1523544152-15241-1-git-send-email-ayan.halder@arm.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1523544152-15241-1-git-send-email-ayan.halder@arm.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, Apr 12, 2018 at 03:42:32PM +0100, Ayan Kumar Halder wrote:
> In a situation when the reference count of the drm connector is greater than 1,
> the unbind function should not invoke drm_connector_cleanup as this will lead
> to an inconsistent state where the drm_crtc_state->connector_mask still has
> a bitmask referring to the stale connector. Later, when drm driver invokes
> drm_atomic_helper_shutdown() which invokes ---> drm_atomic_helper_disable_all()
>  ---> drm_atomic_commit() --> drm_atomic_check_only() -->
> drm_atomic_helper_check() --> drm_atomic_helper_check_modeset(). This returns
> an error due to enabled/connectors mismatch.
> 
> In such a scenario, one should just return from _unbind() and let the drm driver
> subsequently invoke drm_atomic_helper_shutdown. This will reset the
> drm_crtc_state->connector_mask and will shutdown the crtcs. It will also decrement
> the reference count of the connectors to 1. Subsequently, drm_mode_config_cleanup
> will get invoked which will do the following :-

If the device is still in-use after unbind() has been called, that is
_very_ bad news, and probably means that the "host" driver is not
calling component_unbind() at the right point.

Any resources claimed in the bind() callback using devm functions
will be freed, which will include (eg) the drm_encoder structure and
in fact the drm_connector.  So what you have here is a use-after-free
bug, and your change does nothing for that.

Please fix the "host" driver instead.

-- 
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 8.8Mbps down 630kbps up
According to speedtest.net: 8.21Mbps down 510kbps up