From: Sean Anderson sean.anderson@linux.dev

mainline inclusion from mainline-v6.13-rc1 commit 2e07c88914fc5289c21820b1aa94f058feb38197 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAE5 CVE: CVE-2024-56538

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

--------------------------------

Prevent userspace accesses to the DRM device from causing use-after-frees by unplugging the device before we remove it. This causes any further userspace accesses to result in an error without further calls into this driver's internals.

Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem") Closes: https://lore.kernel.org/dri-devel/4d8f4c9b-2efb-4774-9a37-2f257f79b2c9@linux... Signed-off-by: Sean Anderson sean.anderson@linux.dev Signed-off-by: Tomi Valkeinen tomi.valkeinen@ideasonboard.com Link: https://patchwork.freedesktop.org/patch/msgid/20240809193600.3360015-2-sean....

Conflicts: drivers/gpu/drm/xlnx/zynqmp_kms.c [The conflict is due to the commit 074ef0ce9f83 ("drm: xlnx: zynqmp_dpsub: Move all DRM init and cleanup to zynqmp_kms.c") not being merged.] Signed-off-by: Zheng Qixing zhengqixing@huawei.com --- drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c index 5f6eea81f3cc..2f69e2671e79 100644 --- a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c +++ b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c @@ -264,7 +264,7 @@ static int zynqmp_dpsub_remove(struct platform_device *pdev) struct zynqmp_dpsub *dpsub = platform_get_drvdata(pdev); struct drm_device *drm = &dpsub->drm;

- drm_dev_unregister(drm); + drm_dev_unplug(drm); drm_atomic_helper_shutdown(drm); drm_kms_helper_poll_fini(drm);