From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from fanzine2.igalia.com (fanzine2.igalia.com [213.97.179.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4BB8E2F7EE0 for ; Tue, 21 Jul 2026 12:29:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=213.97.179.56 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784636971; cv=none; b=h82RjzvDqFmEA6s3lcqDKo0zl0IuzwUgB/UhdE5oG/TV9QakfuBZkStWZvYdQ2E9NaDZJMCvfhLVIQRIsf2XOTooNjeViv6aMueq4v/ELmVD64LHK0RPne+tF1ieCdODZpzM6GE1rA24JyHdA1IF6c5eZ7bm9iyhS4CjEF+St50= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784636971; c=relaxed/simple; bh=T3mULuzXKogD32OHIEK1wA2LmQTMseaCxtiPcsTekaQ=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=ZyxhLZO+Z8BVIMgdvk1ucVocKAGsD4R0KErSCnSC4/N6dDKiqCZioL/EWhlST9o93Z6DUrWb+O2ig4UvWFpr2zVovYACqUCXEoy/q7VJa7ViQDqOYyTeOa0avxdTlmPJJKq7dXCF6/MzfXgi5dSWTt0uiSsrpZqDKv1SCx1YkFM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=igalia.com; spf=pass smtp.mailfrom=igalia.com; dkim=pass (2048-bit key) header.d=igalia.com header.i=@igalia.com header.b=GlBWq1sJ; arc=none smtp.client-ip=213.97.179.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=igalia.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=igalia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=igalia.com header.i=@igalia.com header.b="GlBWq1sJ" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=igalia.com; s=20170329; h=Content-Transfer-Encoding:Content-Type:From:Cc:To:Subject: MIME-Version:Date:Message-ID:From:Reply-To; bh=O/wzW4ExL4ykGy3oMCH1mdkSWbMdByhaD6cZ+Z44ybs=; b=GlBWq1sJ2HZBlJkHszyF7XX4h+ 0mS+/yHyLzuohCY7VI3d2xSXFZfAsA5nqOXI2lV7ijsCmTyyduCIzo5FFaCL8ef6QUz0GEX+WLATq 0AOWh5aWfVx6WCyP691NDJ/1r3PhuiYmHzAMu3Ej6FA0etwU9bhXuBwUWk4lzP5TDKKgGTMHPQo0X W+8y1Qj+PFWC8oakSKAb2T+qqY1NXygu0ChgLdAnBLzeX+gOhB1H0wgJa+hSeMxOWiOwHEwWRSaoj FBE2QzvnueZaz/haRy6I4ESoAEifpyMbX3x5OcDQdB/QzZK+IVzCRcJH1rbbXBlvZvXVXaJDw45rt tmKyyvBg==; Received: from [187.36.208.132] (helo=[192.168.1.103]) by fanzine2.igalia.com with esmtpsa (Cipher TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim) id 1wm9ak-001bEm-6s; Tue, 21 Jul 2026 14:28:58 +0200 Message-ID: Date: Tue, 21 Jul 2026 09:28:51 -0300 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind To: Gregor Herburger , Maxime Ripard , Dave Stevenson , Raspberry Pi Kernel Maintenance , Maarten Lankhorst , Thomas Zimmermann , David Airlie , Simona Vetter , Douglas Anderson Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org References: <20260720-rpi-vc4-fix-v1-1-6073a96a5773@linutronix.de> From: =?UTF-8?Q?Ma=C3=ADra_Canal?= Content-Language: en-US Autocrypt: addr=mcanal@igalia.com; keydata= xsBNBGcCwywBCADgTji02Sv9zjHo26LXKdCaumcSWglfnJ93rwOCNkHfPIBll85LL9G0J7H8 /PmEL9y0LPo9/B3fhIpbD8VhSy9Sqz8qVl1oeqSe/rh3M+GceZbFUPpMSk5pNY9wr5raZ63d gJc1cs8XBhuj1EzeE8qbP6JAmsL+NMEmtkkNPfjhX14yqzHDVSqmAFEsh4Vmw6oaTMXvwQ40 SkFjtl3sr20y07cJMDe++tFet2fsfKqQNxwiGBZJsjEMO2T+mW7DuV2pKHr9aifWjABY5EPw G7qbrh+hXgfT+njAVg5+BcLz7w9Ju/7iwDMiIY1hx64Ogrpwykj9bXav35GKobicCAwHABEB AAHNIE1hw61yYSBDYW5hbCA8bWNhbmFsQGlnYWxpYS5jb20+wsCRBBMBCAA7FiEE+ORdfQEW dwcppnfRP/MOinaI+qoFAmcCwywCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQ P/MOinaI+qoUBQgAqz2gzUP7K3EBI24+a5FwFlruQGtim85GAJZXToBtzsfGLLVUSCL3aF/5 O335Bh6ViSBgxmowIwVJlS/e+L95CkTGzIIMHgyUZfNefR2L3aZA6cgc9z8cfow62Wu8eXnq GM/+WWvrFQb/dBKKuohfBlpThqDWXxhozazCcJYYHradIuOM8zyMtCLDYwPW7Vqmewa+w994 7Lo4CgOhUXVI2jJSBq3sgHEPxiUBOGxvOt1YBg7H9C37BeZYZxFmU8vh7fbOsvhx7Aqu5xV7 FG+1ZMfDkv+PixCuGtR5yPPaqU2XdjDC/9mlRWWQTPzg74RLEw5sz/tIHQPPm6ROCACFls7A TQRnAsMsAQgAxTU8dnqzK6vgODTCW2A6SAzcvKztxae4YjRwN1SuGhJR2isJgQHoOH6oCItW Xc1CGAWnci6doh1DJvbbB7uvkQlbeNxeIz0OzHSiB+pb1ssuT31Hz6QZFbX4q+crregPIhr+ 0xeDi6Mtu+paYprI7USGFFjDUvJUf36kK0yuF2XUOBlF0beCQ7Jhc+UoI9Akmvl4sHUrZJzX LMeajARnSBXTcig6h6/NFVkr1mi1uuZfIRNCkxCE8QRYebZLSWxBVr3h7dtOUkq2CzL2kRCK T2rKkmYrvBJTqSvfK3Ba7QrDg3szEe+fENpL3gHtH6h/XQF92EOulm5S5o0I+ceREwARAQAB wsB2BBgBCAAgFiEE+ORdfQEWdwcppnfRP/MOinaI+qoFAmcCwywCGwwACgkQP/MOinaI+qpI zQf+NAcNDBXWHGA3lgvYvOU31+ik9bb30xZ7IqK9MIi6TpZqL7cxNwZ+FAK2GbUWhy+/gPkX it2gCAJsjo/QEKJi7Zh8IgHN+jfim942QZOkU+p/YEcvqBvXa0zqW0sYfyAxkrf/OZfTnNNE Tr+uBKNaQGO2vkn5AX5l8zMl9LCH3/Ieaboni35qEhoD/aM0Kpf93PhCvJGbD4n1DnRhrxm1 uEdQ6HUjWghEjC+Jh9xUvJco2tUTepw4OwuPxOvtuPTUa1kgixYyG1Jck/67reJzMigeuYFt raV3P8t/6cmtawVjurhnCDuURyhUrjpRhgFp+lW8OGr6pepHol/WFIOQEg== In-Reply-To: <20260720-rpi-vc4-fix-v1-1-6073a96a5773@linutronix.de> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Hi Gregor, On 20/07/26 14:20, Gregor Herburger wrote: > The hvs and v3d drivers use dev_get_drvdata(master) in their unbind > functions. Since the vc4-drm gets removed before its dependent drivers > (vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to > get drvdata of its master and fails with a null dereference error. > > Use the data pointer passed to the unbind functions directly instead of > dev_get_drvdata(master). This avoids using potentially freed memory. > Shouldn't this patch have a "Fixes:" tag? Best regards, - Maíra > Signed-off-by: Gregor Herburger > --- > drivers/gpu/drm/vc4/vc4_hvs.c | 2 +- > drivers/gpu/drm/vc4/vc4_v3d.c | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c > index 184d51ea3fa5..e715147d091c 100644 > --- a/drivers/gpu/drm/vc4/vc4_hvs.c > +++ b/drivers/gpu/drm/vc4/vc4_hvs.c > @@ -1752,7 +1752,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) > static void vc4_hvs_unbind(struct device *dev, struct device *master, > void *data) > { > - struct drm_device *drm = dev_get_drvdata(master); > + struct drm_device *drm = data; > struct vc4_dev *vc4 = to_vc4_dev(drm); > struct vc4_hvs *hvs = vc4->hvs; > struct drm_mm_node *node, *next; > diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c > index d31b906cb8e7..f32410420d3e 100644 > --- a/drivers/gpu/drm/vc4/vc4_v3d.c > +++ b/drivers/gpu/drm/vc4/vc4_v3d.c > @@ -494,7 +494,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data) > static void vc4_v3d_unbind(struct device *dev, struct device *master, > void *data) > { > - struct drm_device *drm = dev_get_drvdata(master); > + struct drm_device *drm = data; > struct vc4_dev *vc4 = to_vc4_dev(drm); > > vc4_irq_uninstall(drm); > > --- > base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb > change-id: 20260715-rpi-vc4-fix-d93513b05425 > > Best regards, > -- > Gregor Herburger >