On Fri, Jun 19, 2015 at 10:53:10AM +1000, Dave Airlie wrote:

From: Dave Airlie airlied@redhat.com

We should validate the passed in mstb under the lock this should stop us getting an invalid mstb here.

(first attempt with cancelling work has lockdep issues).

Yeah cancel_work_sync is nasty that way ;-)

Btw random bikeshed, but mgr->work would look nice as mgr->probe_work.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=89366

Bugzilla: https://bugs.archlinux.org/task/45369

seems the more accurate one, the fdo one is a mess.

Signed-off-by: Dave Airlie airlied@redhat.com

drivers/gpu/drm/drm_dp_mst_topology.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index fb65f5d..ad0d1bf 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -1198,9 +1198,14 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_ }

static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *mgr,

• 			       struct drm_dp_mst_branch *mstb)
  

• 			       struct drm_dp_mst_branch *mstb_in)
  

{ struct drm_dp_mst_port *port;

• struct drm_dp_mst_branch *mstb;

• mstb = drm_dp_get_validated_mstb_ref(mgr, mstb_in);

• if (!mstb)

• return;
  
  

  if (!mstb->link_address_sent) { drm_dp_send_link_address(mgr, mstb);

@@ -1219,6 +1224,7 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m if (port->mstb) drm_dp_check_and_send_link_address(mgr, port->mstb); }

• drm_dp_put_mst_branch_device(mstb);

}

I am a bit concerned about the lifetime rules of the mgr->mst_primary pointer. port->mstb is controlled by the lifetime of the port and that by the parent mst branch, so I think we're covered dereferencing that one.

But mgr->mst_primary seems to be protected only by mgr->lock, and you're not holding that in the probe work. I did review drm_dp_mst_topology_mgr_set_mst and that does seem to clean up ->mst_primary correctly but might be helped with a comment. But we do need the locking I think.

Assuming the added locking doesn't piss off lockdep this is Reviewed-by: Daniel Vetter daniel.vetter@ffwll.ch -Daniel --- diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index 132581ca4ad8..08c3c65e7d08 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -1213,7 +1213,9 @@ static void drm_dp_mst_link_probe_work(struct work_struct *work) { struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, work);

+ mutex_lock(&mgr->lock); drm_dp_check_and_send_link_address(mgr, mgr->mst_primary); + mutex_unlock(&mgr->lock);

}

@@ -1921,6 +1923,8 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms } else { /* disable MST on the device */ mstb = mgr->mst_primary; + /* inherit reference from ->mst_primary, will be cleaned up + * at the end. */ mgr->mst_primary = NULL; /* this can fail if the device is gone */ drm_dp_dpcd_writeb(mgr->aux, DP_MSTM_CTRL, 0);