Commit c54c7374 authored by Lyude Paul's avatar Lyude Paul Committed by Sean Paul

drm/dp_mst: Skip validating ports during destruction, just ref

Jerry Zuo pointed out a rather obscure hotplugging issue that it seems I
accidentally introduced into DRM two years ago.

Pretend we have a topology like this:

|- DP-1: mst_primary
   |- DP-4: active display
   |- DP-5: disconnected
   |- DP-6: active hub
      |- DP-7: active display
      |- DP-8: disconnected
      |- DP-9: disconnected

If we unplug DP-6, the topology starting at DP-7 will be destroyed but
it's payloads will live on in DP-1's VCPI allocations and thus require
removal. However, this removal currently fails because
drm_dp_update_payload_part1() will (rightly so) try to validate the port
before accessing it, fail then abort. If we keep going, eventually we
run the MST hub out of bandwidth and all new allocations will start to
fail (or in my case; all new displays just start flickering a ton).

We could just teach drm_dp_update_payload_part1() not to drop the port
ref in this case, but then we also need to teach
drm_dp_destroy_payload_step1() to do the same thing, then hope no one
ever adds anything to the that requires a validated port reference in
drm_dp_destroy_connector_work(). Kind of sketchy.

So let's go with a more clever solution: any port that
drm_dp_destroy_connector_work() interacts with is guaranteed to still
exist in memory until we say so. While said port might not be valid we
don't really care: that's the whole reason we're destroying it in the
first place! So, teach drm_dp_get_validated_port_ref() to use the all
mighty current_work() function to avoid attempting to validate ports
from the context of mgr->destroy_connector_work. I can't see any
situation where this wouldn't be safe, and this avoids having to play
whack-a-mole in the future of trying to work around port validation.
Signed-off-by: Lyude Paul's avatarLyude Paul <>
Fixes: 263efde3 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()")
Reported-by: default avatarJerry Zuo <>
Cc: Jerry Zuo <>
Cc: Harry Wentland <>
Cc: <> # v4.6+
Reviewed-by: default avatarDave Airlie <>
Link: Sean Paul's avatarSean Paul <>
parent 2e6e902d
......@@ -1023,9 +1023,20 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
struct drm_dp_mst_port *rport = NULL;
if (mgr->mst_primary)
rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
* Port may or may not be 'valid' but we don't care about that when
* destroying the port and we are guaranteed that the port pointer
* will be valid until we've finished
if (current_work() == &mgr->destroy_connector_work) {
rport = port;
} else if (mgr->mst_primary) {
rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
return rport;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment