From: Paul Cercueil <paul@crapouillou.net> To: David Airlie <airlied@linux.ie>, Daniel Vetter <daniel@ffwll.ch> Cc: Sam Ravnborg <sam@ravnborg.org>, od@zcrc.me, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Paul Cercueil <paul@crapouillou.net>, stable@vger.kernel.org Subject: [PATCH 2/3] drm/ingenic: Register devm action to cleanup encoders Date: Sun, 17 Jan 2021 11:26:45 +0000 [thread overview] Message-ID: <20210117112646.98353-3-paul@crapouillou.net> (raw) In-Reply-To: <20210117112646.98353-1-paul@crapouillou.net> Since the encoders have been devm-allocated, they will be freed way before drm_mode_config_cleanup() is called. To avoid use-after-free conditions, we then must ensure that drm_encoder_cleanup() is called before the encoders are freed. Fixes: c369cb27c267 ("drm/ingenic: Support multiple panels/bridges") Cc: <stable@vger.kernel.org> # 5.8+ Signed-off-by: Paul Cercueil <paul@crapouillou.net> --- drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c index 368bfef8b340..d23a3292a0e0 100644 --- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c +++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c @@ -803,6 +803,11 @@ static void __maybe_unused ingenic_drm_release_rmem(void *d) of_reserved_mem_device_release(d); } +static void ingenic_drm_encoder_cleanup(void *encoder) +{ + drm_encoder_cleanup(encoder); +} + static int ingenic_drm_bind(struct device *dev, bool has_components) { struct platform_device *pdev = to_platform_device(dev); @@ -1011,6 +1016,11 @@ static int ingenic_drm_bind(struct device *dev, bool has_components) return ret; } + ret = devm_add_action_or_reset(dev, ingenic_drm_encoder_cleanup, + encoder); + if (ret) + return ret; + ret = drm_bridge_attach(encoder, bridge, NULL, 0); if (ret) { dev_err(dev, "Unable to attach bridge\n"); -- 2.29.2
WARNING: multiple messages have this Message-ID (diff)
From: Paul Cercueil <paul@crapouillou.net> To: David Airlie <airlied@linux.ie>, Daniel Vetter <daniel@ffwll.ch> Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, Paul Cercueil <paul@crapouillou.net>, od@zcrc.me, dri-devel@lists.freedesktop.org, Sam Ravnborg <sam@ravnborg.org> Subject: [PATCH 2/3] drm/ingenic: Register devm action to cleanup encoders Date: Sun, 17 Jan 2021 11:26:45 +0000 [thread overview] Message-ID: <20210117112646.98353-3-paul@crapouillou.net> (raw) In-Reply-To: <20210117112646.98353-1-paul@crapouillou.net> Since the encoders have been devm-allocated, they will be freed way before drm_mode_config_cleanup() is called. To avoid use-after-free conditions, we then must ensure that drm_encoder_cleanup() is called before the encoders are freed. Fixes: c369cb27c267 ("drm/ingenic: Support multiple panels/bridges") Cc: <stable@vger.kernel.org> # 5.8+ Signed-off-by: Paul Cercueil <paul@crapouillou.net> --- drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c index 368bfef8b340..d23a3292a0e0 100644 --- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c +++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c @@ -803,6 +803,11 @@ static void __maybe_unused ingenic_drm_release_rmem(void *d) of_reserved_mem_device_release(d); } +static void ingenic_drm_encoder_cleanup(void *encoder) +{ + drm_encoder_cleanup(encoder); +} + static int ingenic_drm_bind(struct device *dev, bool has_components) { struct platform_device *pdev = to_platform_device(dev); @@ -1011,6 +1016,11 @@ static int ingenic_drm_bind(struct device *dev, bool has_components) return ret; } + ret = devm_add_action_or_reset(dev, ingenic_drm_encoder_cleanup, + encoder); + if (ret) + return ret; + ret = drm_bridge_attach(encoder, bridge, NULL, 0); if (ret) { dev_err(dev, "Unable to attach bridge\n"); -- 2.29.2 _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2021-01-17 11:29 UTC|newest] Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-01-17 11:26 [PATCH 0/3] Fixes to bridge/panel and ingenic-drm Paul Cercueil 2021-01-17 11:26 ` Paul Cercueil 2021-01-17 11:26 ` [PATCH 1/3] drm: bridge/panel: Cleanup connector on bridge detach Paul Cercueil 2021-01-17 11:26 ` Paul Cercueil 2021-01-18 9:43 ` Laurent Pinchart 2021-01-18 9:43 ` Laurent Pinchart 2021-01-17 11:26 ` Paul Cercueil [this message] 2021-01-17 11:26 ` [PATCH 2/3] drm/ingenic: Register devm action to cleanup encoders Paul Cercueil 2021-01-18 9:43 ` Laurent Pinchart 2021-01-18 9:43 ` Laurent Pinchart 2021-01-18 11:37 ` Paul Cercueil 2021-01-18 11:37 ` Paul Cercueil 2021-01-18 12:52 ` Daniel Vetter 2021-01-18 12:52 ` Daniel Vetter 2021-01-17 11:26 ` [PATCH 3/3] drm/ingenic: Fix non-OSD mode Paul Cercueil 2021-01-17 11:26 ` Paul Cercueil
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210117112646.98353-3-paul@crapouillou.net \ --to=paul@crapouillou.net \ --cc=airlied@linux.ie \ --cc=daniel@ffwll.ch \ --cc=dri-devel@lists.freedesktop.org \ --cc=linux-kernel@vger.kernel.org \ --cc=od@zcrc.me \ --cc=sam@ravnborg.org \ --cc=stable@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.