[v1] drm/vc4: hvs/v3d: Fix null dereference in unbind

[PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind

Posted by Gregor Herburger 4 days, 8 hours ago

The hvs and v3d drivers use dev_get_drvdata(master) in their unbind
functions. Since the vc4-drm gets removed before its dependent drivers
(vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to
get drvdata of its master and fails with a null dereference error.

Use the data pointer passed to the unbind functions directly instead of
dev_get_drvdata(master). This avoids using potentially freed memory.

Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
---
 drivers/gpu/drm/vc4/vc4_hvs.c | 2 +-
 drivers/gpu/drm/vc4/vc4_v3d.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
index 184d51ea3fa5..e715147d091c 100644
--- a/drivers/gpu/drm/vc4/vc4_hvs.c
+++ b/drivers/gpu/drm/vc4/vc4_hvs.c
@@ -1752,7 +1752,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
 static void vc4_hvs_unbind(struct device *dev, struct device *master,
 			   void *data)
 {
-	struct drm_device *drm = dev_get_drvdata(master);
+	struct drm_device *drm = data;
 	struct vc4_dev *vc4 = to_vc4_dev(drm);
 	struct vc4_hvs *hvs = vc4->hvs;
 	struct drm_mm_node *node, *next;
diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c
index d31b906cb8e7..f32410420d3e 100644
--- a/drivers/gpu/drm/vc4/vc4_v3d.c
+++ b/drivers/gpu/drm/vc4/vc4_v3d.c
@@ -494,7 +494,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
 static void vc4_v3d_unbind(struct device *dev, struct device *master,
 			   void *data)
 {
-	struct drm_device *drm = dev_get_drvdata(master);
+	struct drm_device *drm = data;
 	struct vc4_dev *vc4 = to_vc4_dev(drm);
 
 	vc4_irq_uninstall(drm);

---
base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb
change-id: 20260715-rpi-vc4-fix-d93513b05425

Best regards,
--  
Gregor Herburger <gregor.herburger@linutronix.de>

Re: [PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind

Posted by Maíra Canal 3 days, 13 hours ago

Hi Gregor,

On 20/07/26 14:20, Gregor Herburger wrote:
> The hvs and v3d drivers use dev_get_drvdata(master) in their unbind
> functions. Since the vc4-drm gets removed before its dependent drivers
> (vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to
> get drvdata of its master and fails with a null dereference error.
> 
> Use the data pointer passed to the unbind functions directly instead of
> dev_get_drvdata(master). This avoids using potentially freed memory.
> 

Shouldn't this patch have a "Fixes:" tag?

Best regards,
- Maíra

> Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
> ---
>   drivers/gpu/drm/vc4/vc4_hvs.c | 2 +-
>   drivers/gpu/drm/vc4/vc4_v3d.c | 2 +-
>   2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
> index 184d51ea3fa5..e715147d091c 100644
> --- a/drivers/gpu/drm/vc4/vc4_hvs.c
> +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
> @@ -1752,7 +1752,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
>   static void vc4_hvs_unbind(struct device *dev, struct device *master,
>   			   void *data)
>   {
> -	struct drm_device *drm = dev_get_drvdata(master);
> +	struct drm_device *drm = data;
>   	struct vc4_dev *vc4 = to_vc4_dev(drm);
>   	struct vc4_hvs *hvs = vc4->hvs;
>   	struct drm_mm_node *node, *next;
> diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c
> index d31b906cb8e7..f32410420d3e 100644
> --- a/drivers/gpu/drm/vc4/vc4_v3d.c
> +++ b/drivers/gpu/drm/vc4/vc4_v3d.c
> @@ -494,7 +494,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
>   static void vc4_v3d_unbind(struct device *dev, struct device *master,
>   			   void *data)
>   {
> -	struct drm_device *drm = dev_get_drvdata(master);
> +	struct drm_device *drm = data;
>   	struct vc4_dev *vc4 = to_vc4_dev(drm);
>   
>   	vc4_irq_uninstall(drm);
> 
> ---
> base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb
> change-id: 20260715-rpi-vc4-fix-d93513b05425
> 
> Best regards,
> --
> Gregor Herburger <gregor.herburger@linutronix.de>
>

Re: [PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind

Posted by Gregor Herburger 3 days, 11 hours ago

On Tue, Jul 21, 2026 at 09:28:51AM -0300, Maíra Canal wrote:
> Hi Gregor,
> 
> On 20/07/26 14:20, Gregor Herburger wrote:
> > The hvs and v3d drivers use dev_get_drvdata(master) in their unbind
> > functions. Since the vc4-drm gets removed before its dependent drivers
> > (vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to
> > get drvdata of its master and fails with a null dereference error.
> > 
> > Use the data pointer passed to the unbind functions directly instead of
> > dev_get_drvdata(master). This avoids using potentially freed memory.
> > 
> 
> Shouldn't this patch have a "Fixes:" tag?
Right, will send a v2 with Fixes tags. 
> 
> Best regards,
> - Maíra
> 
> > Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
> > ---
> >   drivers/gpu/drm/vc4/vc4_hvs.c | 2 +-
> >   drivers/gpu/drm/vc4/vc4_v3d.c | 2 +-
> >   2 files changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
> > index 184d51ea3fa5..e715147d091c 100644
> > --- a/drivers/gpu/drm/vc4/vc4_hvs.c
> > +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
> > @@ -1752,7 +1752,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
> >   static void vc4_hvs_unbind(struct device *dev, struct device *master,
> >   			   void *data)
> >   {
> > -	struct drm_device *drm = dev_get_drvdata(master);
> > +	struct drm_device *drm = data;
> >   	struct vc4_dev *vc4 = to_vc4_dev(drm);
> >   	struct vc4_hvs *hvs = vc4->hvs;
> >   	struct drm_mm_node *node, *next;
> > diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c
> > index d31b906cb8e7..f32410420d3e 100644
> > --- a/drivers/gpu/drm/vc4/vc4_v3d.c
> > +++ b/drivers/gpu/drm/vc4/vc4_v3d.c
> > @@ -494,7 +494,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
> >   static void vc4_v3d_unbind(struct device *dev, struct device *master,
> >   			   void *data)
> >   {
> > -	struct drm_device *drm = dev_get_drvdata(master);
> > +	struct drm_device *drm = data;
> >   	struct vc4_dev *vc4 = to_vc4_dev(drm);
> >   	vc4_irq_uninstall(drm);
> > 
> > ---
> > base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb
> > change-id: 20260715-rpi-vc4-fix-d93513b05425
> > 
> > Best regards,
> > --
> > Gregor Herburger <gregor.herburger@linutronix.de>
> > 
> 

-- 
Gregor Herburger
Linutronix GmbH | Bahnhofstrasse 3 | D-88690 Uhldingen-Mühlhofen
Phone: +49 7556 25 999 35; Fax.: +49 7556 25 999 99

Hinweise zum Datenschutz finden Sie hier (Informations on data privacy 
can be found here): https://linutronix.de/legal/data-protection.php

Linutronix GmbH | Firmensitz (Registered Office): Uhldingen-Mühlhofen | 
Registergericht (Registration Court): Amtsgericht Freiburg i.Br., HRB700 
806 | Geschäftsführer (Managing Directors): Dr. Wilfried Wessner, 
Katharina Kopp, Alexander Gieringer