drm/dp_mst: Fix resetting msg rx state after topology removal

If the MST topology is removed during the reception of an MST down reply
or MST up request sideband message, the
drm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset
from one thread via drm_dp_mst_topology_mgr_set_mst(false), racing with
the reading/parsing of the message from another thread via
drm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req(). The race is
possible since the reader/parser doesn't hold any lock while accessing
the reception state. This in turn can lead to a memory corruption in the
reader/parser as described by commit bd2fccac61b4 ("drm/dp_mst: Fix MST
sideband message body length check").

Fix the above by resetting the message reception state if needed before
reading/parsing a message. Another solution would be to hold the
drm_dp_mst_topology_mgr::lock for the whole duration of the message
reception/parsing in drm_dp_mst_handle_down_rep() and
drm_dp_mst_handle_up_req(), however this would require a bigger change.
Since the fix is also needed for stable, opting for the simpler solution
in this patch.

Cc: Lyude Paul <lyude@redhat.com>
Cc: <stable@vger.kernel.org>
Fixes: 1d082618bbf3 ("drm/display/dp_mst: Fix down/up message handling after sink disconnect")
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13056
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241203160223.2926014-2-imre.deak@intel.com

diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
index e6ee180815b208570cf4c34047a1931346d72b3c..1475aa95ab6b2b82c7c05f050ddbe3c8dc3b1c0d 100644 (file)
--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
@@ -3700,8 +3700,7 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms
                ret = 0;
                mgr->payload_id_table_cleared = false;
 
-               memset(&mgr->down_rep_recv, 0, sizeof(mgr->down_rep_recv));
-               memset(&mgr->up_req_recv, 0, sizeof(mgr->up_req_recv));
+               mgr->reset_rx_state = true;
        }
 
 out_unlock:
@@ -3859,6 +3858,11 @@ out_fail:
 }
 EXPORT_SYMBOL(drm_dp_mst_topology_mgr_resume);
 
+static void reset_msg_rx_state(struct drm_dp_sideband_msg_rx *msg)
+{
+       memset(msg, 0, sizeof(*msg));
+}
+
 static bool
 drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up,
                      struct drm_dp_mst_branch **mstb)
@@ -4141,6 +4145,17 @@ out:
        return 0;
 }
 
+static void update_msg_rx_state(struct drm_dp_mst_topology_mgr *mgr)
+{
+       mutex_lock(&mgr->lock);
+       if (mgr->reset_rx_state) {
+               mgr->reset_rx_state = false;
+               reset_msg_rx_state(&mgr->down_rep_recv);
+               reset_msg_rx_state(&mgr->up_req_recv);
+       }
+       mutex_unlock(&mgr->lock);
+}
+
 /**
  * drm_dp_mst_hpd_irq_handle_event() - MST hotplug IRQ handle MST event
  * @mgr: manager to notify irq for.
@@ -4175,6 +4190,8 @@ int drm_dp_mst_hpd_irq_handle_event(struct drm_dp_mst_topology_mgr *mgr, const u
                *handled = true;
        }
 
+       update_msg_rx_state(mgr);
+
        if (esi[1] & DP_DOWN_REP_MSG_RDY) {
                ret = drm_dp_mst_handle_down_rep(mgr);
                *handled = true;

diff --git a/include/drm/display/drm_dp_mst_helper.h b/include/drm/display/drm_dp_mst_helper.h
index f6a1cbb0f600faa96358c8785271bc1f62b30c09..a80ba457a858f36ac2110a6fdd91d8a1570b58e1 100644 (file)
--- a/include/drm/display/drm_dp_mst_helper.h
+++ b/include/drm/display/drm_dp_mst_helper.h
@@ -699,6 +699,13 @@ struct drm_dp_mst_topology_mgr {
         */
        bool payload_id_table_cleared : 1;
 
+       /**
+        * @reset_rx_state: The down request's reply and up request message
+        * receiver state must be reset, after the topology manager got
+        * removed. Protected by @lock.
+        */
+       bool reset_rx_state : 1;
+
        /**
         * @payload_count: The number of currently active payloads in hardware. This value is only
         * intended to be used internally by MST helpers for payload tracking, and is only safe to