mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2025-01-01 18:55:12 +00:00
a6fa67d26d
If the MST topology is removed during the reception of an MST down reply or MST up request sideband message, the drm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset from one thread via drm_dp_mst_topology_mgr_set_mst(false), racing with the reading/parsing of the message from another thread via drm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req(). The race is possible since the reader/parser doesn't hold any lock while accessing the reception state. This in turn can lead to a memory corruption in the reader/parser as described by commit |
||
---|---|---|
.. | ||
drm_dp_aux_bus.h | ||
drm_dp_dual_mode_helper.h | ||
drm_dp_helper.h | ||
drm_dp_mst_helper.h | ||
drm_dp_tunnel.h | ||
drm_dp.h | ||
drm_dsc_helper.h | ||
drm_dsc.h | ||
drm_hdcp_helper.h | ||
drm_hdcp.h | ||
drm_hdmi_helper.h | ||
drm_hdmi_state_helper.h | ||
drm_scdc_helper.h | ||
drm_scdc.h |