Skip to content

Fix usb c displayport samsung gemini3#603

Open
rockowitz wants to merge 3 commits into
rockowitz:2.2.7-devfrom
hkskoglund:fix_usb_c_displayport_samsung_gemini3
Open

Fix usb c displayport samsung gemini3#603
rockowitz wants to merge 3 commits into
rockowitz:2.2.7-devfrom
hkskoglund:fix_usb_c_displayport_samsung_gemini3

Conversation

@rockowitz

Copy link
Copy Markdown
Owner

No description provided.

…y redetection

It appears that the crash in org_kde_powerdevil is related to several issues in libddcutil, including a potential Use-After-Free (UAF) in the display watch thread management, a lack of synchronization during display redetection, and a reachable assert(false) in the polling loop that could cause a crash in debug builds.

The provided stack trace shows the main PowerDevil thread waiting to join a thread (likely the watch thread) that has crashed with a segmentation fault. The crash location suggests issues during thread termination and cleanup.

Analysis of the Issues
Use-After-Free in dw_main.c: In dw_stop_watch_displays(), the code accesses global_wdd->watch_mode and global_wdd->evdata before joining the thread. However, the thread function dw_watch_display_connections() (in dw_poll.c) calls dw_free_watch_displays_data(wdd) at the very end of its execution. If the thread finishes just as it's being stopped, global_wdd (which points to the same memory as wdd) may be freed while dw_stop_watch_displays() is still trying to access it.
Missing Synchronization in dw_redetect_displays(): Display redetection discards all current display references. If callback threads are still running and accessing these references, a crash occurs. Furthermore, there is no guard against multiple concurrent redetection calls, which can happen during system resume when multiple display events are fired.
Thread Termination Leaks and Logic Errors: In dw_recheck.c, queue entries are leaked when the thread terminates, and the wrong free function is used for thread data. In dw_poll.c, an assert(false) is present at the end of the thread function, which will cause a crash if the thread ever reaches that point (which it does upon termination).
The following changes address these issues by fixing the UAF, adding a redetection mutex and callback thread synchronization, and cleaning up thread termination logic.
…msung monitor) (gemini3)

aiprompt: Apr 09 08:12:17 jupiter org_kde_powerdevil[28197]: [116077] (i2c_check_open_bus_alive) Retrying i2c_check_edid_exists_by_dh() tryctr=1, dh=Display_Handle[i2c-9: fd=24]: Sleeping for 100 milliseconds Apr 09 08:12:17 jupiter org_kde_powerdevil[28197]: [116077] /dev/i2c-9, Checking EDID failed after 2 tries (B) Apr 09 08:12:17 jupiter org_kde_powerdevil[28197]: [116077] (check_supported_feature) busno=9, sleep-multiplier = 2.00. Testing for supported feature 0x10 returned Error_Info[DDCRC_DISCONNECTED in i2c_check_open_bus_alive]
aiprompt: Apr 09 08:12:17 jupiter org_kde_powerdevil[28197]: [116077] (i2c_check_open_bus_alive) Retrying i2c_check_edid_exists_by_dh() tryctr=1, dh=Display_Handle[i2c-9: fd=24]: Sleeping for 100 milliseconds Apr 09 08:12:17 jupiter org_kde_powerdevil[28197]: [116077] /dev/i2c-9, Checking EDID failed after 2 tries (B) Apr 09 08:12:17 jupiter org_kde_powerdevil[28197]: [116077] (check_supported_feature) busno=9, sleep-multiplier = 2.00. Testing for supported feature 0x10 returned Error_Info[DDCRC_DISCONNECTED in i2c_check_open_bus_alive]
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants