Re: [PATCH] tda998x: Check ref count before invoking drm_connector_cleanup in unbind

[Russell King - ARM Linux <linux@armlinux.org.uk>]

On Thu, Apr 12, 2018 at 03:42:32PM +0100, Ayan Kumar Halder wrote:
> In a situation when the reference count of the drm connector is greater than 1,
> the unbind function should not invoke drm_connector_cleanup as this will lead
> to an inconsistent state where the drm_crtc_state->connector_mask still has
> a bitmask referring to the stale connector. Later, when drm driver invokes
> drm_atomic_helper_shutdown() which invokes ---> drm_atomic_helper_disable_all()
>  ---> drm_atomic_commit() --> drm_atomic_check_only() -->
> drm_atomic_helper_check() --> drm_atomic_helper_check_modeset(). This returns
> an error due to enabled/connectors mismatch.
> 
> In such a scenario, one should just return from _unbind() and let the drm driver
> subsequently invoke drm_atomic_helper_shutdown. This will reset the
> drm_crtc_state->connector_mask and will shutdown the crtcs. It will also decrement
> the reference count of the connectors to 1. Subsequently, drm_mode_config_cleanup
> will get invoked which will do the following :-

If the device is still in-use after unbind() has been called, that is
_very_ bad news, and probably means that the "host" driver is not
calling component_unbind() at the right point.

Any resources claimed in the bind() callback using devm functions
will be freed, which will include (eg) the drm_encoder structure and
in fact the drm_connector.  So what you have here is a use-after-free
bug, and your change does nothing for that.

Please fix the "host" driver instead.

-- 
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 8.8Mbps down 630kbps up
According to speedtest.net: 8.21Mbps down 510kbps up