tree 53fc0d2e37d9c733362f7a48dd0699c914c5a74e
parent 049cfff8d53a30cae3349ff71a4c01b7d9981bc2
author Maxime Ripard <maxime@cerno.tech> 1637142325 +0100
committer Maxime Ripard <maxime@cerno.tech> 1638195477 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRcEzekXsqa64kGDp7j7w1vZxhRxQUCYaThGAAKCRDj7w1vZxhR
 xV7XAP40J/NoOPX5+8hvbFId4lK0wqub3CdyFhtG8Te0K43QUgD/VnvUVzAoA+9C
 Ok7vp9H0x6PxfwtOsk865v1BdqxW/AA=
 =LNOC
 -----END PGP SIGNATURE-----

drm/vc4: kms: Clear the HVS FIFO commit pointer once done

Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a
commit") introduced a wait on the previous commit done on a given HVS
FIFO.

However, we never cleared that pointer once done. Since
drm_crtc_commit_put can free the drm_crtc_commit structure directly if
we were the last user, this means that it can lead to a use-after free
if we were to duplicate the state, and that stale pointer would even be
copied to the new state.

Set the pointer to NULL once we're done with the wait so that we don't
carry over a pointer to a free'd structure.

Fixes: 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Tested-by: Jian-Hong Pan <jhp@endlessos.org>
Link: https://lore.kernel.org/r/20211117094527.146275-5-maxime@cerno.tech