From patchwork Tue Oct 9 21:30:49 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Agner X-Patchwork-Id: 10633297 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8867D933 for ; Tue, 9 Oct 2018 21:30:57 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7A3C729943 for ; Tue, 9 Oct 2018 21:30:57 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 786C2299FD; Tue, 9 Oct 2018 21:30:57 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id A630E29954 for ; Tue, 9 Oct 2018 21:30:56 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 31A1C6E31C; Tue, 9 Oct 2018 21:30:55 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail.kmu-office.ch (mail.kmu-office.ch [IPv6:2a02:418:6a02::a2]) by gabe.freedesktop.org (Postfix) with ESMTPS id 0BBA46E31C for ; Tue, 9 Oct 2018 21:30:54 +0000 (UTC) Received: from allenwind.lan (unknown [37.17.239.109]) by mail.kmu-office.ch (Postfix) with ESMTPSA id 300D15C097A; Tue, 9 Oct 2018 23:30:51 +0200 (CEST) From: Stefan Agner To: p.zabel@pengutronix.de, airlied@linux.ie, gregkh@linuxfoundation.org Subject: [PATCH 2/2] drm/imx: make sure to cleanup DRM before unbinding components Date: Tue, 9 Oct 2018 23:30:49 +0200 Message-Id: X-Mailer: git-send-email 2.19.1 In-Reply-To: <83a28282a3f745a4cd4ca77d0593ad2e61359a5d.1539120077.git.stefan@agner.ch> References: <83a28282a3f745a4cd4ca77d0593ad2e61359a5d.1539120077.git.stefan@agner.ch> MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-kernel@vger.kernel.org, linux@armlinux.org.uk, dri-devel@lists.freedesktop.org, rafael@kernel.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP In situations where a component fails to bind, a previously successfully bound component might already registered itself with the DRM framework (e.g. an encoder). When the master component then calls drm_mode_config_cleanup, we end up in a use after free sitution. Use the cleanup callback to make sure all framework level cleanup is done by the time we unbind components. Signed-off-by: Stefan Agner --- drivers/gpu/drm/imx/imx-drm-core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c index 5ea0c82f9957..b174a0ca9acb 100644 --- a/drivers/gpu/drm/imx/imx-drm-core.c +++ b/drivers/gpu/drm/imx/imx-drm-core.c @@ -288,8 +288,8 @@ static int imx_drm_bind(struct device *dev) err_unbind: #endif component_unbind_all(drm->dev, drm); -err_kms: drm_mode_config_cleanup(drm); +err_kms: drm_dev_put(drm); return ret; @@ -313,9 +313,17 @@ static void imx_drm_unbind(struct device *dev) drm_dev_put(drm); } +static void imx_drm_cleanup(struct device *dev) +{ + struct drm_device *drm = dev_get_drvdata(dev); + + drm_mode_config_cleanup(drm); +} + static const struct component_master_ops imx_drm_ops = { .bind = imx_drm_bind, .unbind = imx_drm_unbind, + .cleanup = imx_drm_cleanup, }; static int imx_drm_platform_probe(struct platform_device *pdev)