Skip to content

Commit e65e7be

Browse files
superm1alexdeucher
authored andcommitted
drm/amd/display: Fix slab-use-after-free on hdcp_work
[Why] A slab-use-after-free is reported when HDCP is destroyed but the property_validate_dwork queue is still running. [How] Cancel the delayed work when destroying workqueue. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4006 Fixes: da3fd7a ("drm/amd/display: Update CP property based on HW query") Cc: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 725a04b) Cc: stable@vger.kernel.org
1 parent 79e3139 commit e65e7be

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -455,6 +455,7 @@ void hdcp_destroy(struct kobject *kobj, struct hdcp_workqueue *hdcp_work)
455455
for (i = 0; i < hdcp_work->max_link; i++) {
456456
cancel_delayed_work_sync(&hdcp_work[i].callback_dwork);
457457
cancel_delayed_work_sync(&hdcp_work[i].watchdog_timer_dwork);
458+
cancel_delayed_work_sync(&hdcp_work[i].property_validate_dwork);
458459
}
459460

460461
sysfs_remove_bin_file(kobj, &hdcp_work[0].attr);

0 commit comments

Comments
 (0)