Re: [PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind

["Maíra Canal" <mcanal@igalia.com>]

Hi Gregor,

On 20/07/26 14:20, Gregor Herburger wrote:
> The hvs and v3d drivers use dev_get_drvdata(master) in their unbind
> functions. Since the vc4-drm gets removed before its dependent drivers
> (vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to
> get drvdata of its master and fails with a null dereference error.
> 
> Use the data pointer passed to the unbind functions directly instead of
> dev_get_drvdata(master). This avoids using potentially freed memory.
> 

Shouldn't this patch have a "Fixes:" tag?

Best regards,
- Maíra

> Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
> ---
>   drivers/gpu/drm/vc4/vc4_hvs.c | 2 +-
>   drivers/gpu/drm/vc4/vc4_v3d.c | 2 +-
>   2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
> index 184d51ea3fa5..e715147d091c 100644
> --- a/drivers/gpu/drm/vc4/vc4_hvs.c
> +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
> @@ -1752,7 +1752,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
>   static void vc4_hvs_unbind(struct device *dev, struct device *master,
>   			   void *data)
>   {
> -	struct drm_device *drm = dev_get_drvdata(master);
> +	struct drm_device *drm = data;
>   	struct vc4_dev *vc4 = to_vc4_dev(drm);
>   	struct vc4_hvs *hvs = vc4->hvs;
>   	struct drm_mm_node *node, *next;
> diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c
> index d31b906cb8e7..f32410420d3e 100644
> --- a/drivers/gpu/drm/vc4/vc4_v3d.c
> +++ b/drivers/gpu/drm/vc4/vc4_v3d.c
> @@ -494,7 +494,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
>   static void vc4_v3d_unbind(struct device *dev, struct device *master,
>   			   void *data)
>   {
> -	struct drm_device *drm = dev_get_drvdata(master);
> +	struct drm_device *drm = data;
>   	struct vc4_dev *vc4 = to_vc4_dev(drm);
>   
>   	vc4_irq_uninstall(drm);
> 
> ---
> base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb
> change-id: 20260715-rpi-vc4-fix-d93513b05425
> 
> Best regards,
> --
> Gregor Herburger <gregor.herburger@linutronix.de>
>