From nobody Sat Jul 25 02:13:30 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B15E2391838 for ; Mon, 20 Jul 2026 17:20:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784568060; cv=none; b=BdPvtU5fPZJ2zrxQS46EVLltLm9+doOEa+7YzyECsLTsuLgeGsVICx8LnsBlCC03LpUMfj2qiXXxdriLp0yl5KHLKuW5mHyUBVD1/Z4PaVL40CURz892lKRg6rwpK0keazrr+8QP614/ec5Hmvc6rdOSaC/DzWljtVdGauyTXe8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784568060; c=relaxed/simple; bh=rgKMaikcnyYgqwLELlkEBZrPTGaoKIum3hhFD20sO2E=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=Tn94lFCSzSC1y58sf76Z3w75biDf8gClTKeED5LPcNvGdJMLaFtRPBQVXvAdY/VXy96RVMYyOSBEQ8jNTxE10qpwIum/vOdjZ0FrJ0llWzTnsskpniKkIX+IvF6UjVSRvlbuEdQTm+DrxFEw5rwuB2pLrVGQw3ldVpj7H19+bs8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=FiCbGMQm; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=W39M6Jay; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="FiCbGMQm"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="W39M6Jay" From: Gregor Herburger DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1784568055; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gpk28iHPO7PC05304UxcoPudPVrzlTV8S79O5pVRZfI=; b=FiCbGMQms4RcsDVNUsTN51j76nNj8HOPwjC41O5KuWK+oEsHEb4uEvMAWT6AqtIJZg/Z8R udp1dikrBomMVcgDOgxVIk3EVgxjNIUWY/dRN6FIN3Vb2iH9KJMrXPmjDOzYe5ouaPfwN0 FeQ2+V7bs32Sf3YXK9vFUWgZBFODle1UjUDXy839ahPaNxge94c1CCOYPQueaMKDJlGgSb v4Zp7Oxva7vQVgYfrNuHrVKyXIKKvJcYXNqSud28EHU6WY8V1IkU5+Zh3TPDLW11Zg2fPl EX3QFrIFNLSCDiW8YXhBhSNzX00C4j3MW2dr/v2tl4bdJLuF0mtEOYgEwhinBQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1784568055; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gpk28iHPO7PC05304UxcoPudPVrzlTV8S79O5pVRZfI=; b=W39M6JaymblcVCFinem2pr2nBeAKTlsnQK1sENnAIBsKYRTD/IHR+vXn8GZ3NxS6Ww8V4E mV0Q5tEkW+C4M7Cw== Date: Mon, 20 Jul 2026 19:20:37 +0200 Subject: [PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260720-rpi-vc4-fix-v1-1-6073a96a5773@linutronix.de> X-B4-Tracking: v=1; b=H4sIAORYXmoC/yXMQQ5AMBCF4avIrE3SVku4ilhQg7FAWkQivbti+ b3k/Td4ckwequQGRyd7XpcImSZgp3YZCbmPBiVULgpp0G2Mp9U48IV9mRmZdcJoZSA+Nkdx/mp 189sf3Ux2fxMQwgMo3gGYbwAAAA== X-Change-ID: 20260715-rpi-vc4-fix-d93513b05425 To: Maxime Ripard , Dave Stevenson , =?utf-8?q?Ma=C3=ADra_Canal?= , Raspberry Pi Kernel Maintenance , Maarten Lankhorst , Thomas Zimmermann , David Airlie , Simona Vetter , Douglas Anderson Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Gregor Herburger X-Developer-Signature: v=1; a=ed25519-sha256; t=1784568054; l=1945; i=gregor.herburger@linutronix.de; s=20260226; h=from:subject:message-id; bh=rgKMaikcnyYgqwLELlkEBZrPTGaoKIum3hhFD20sO2E=; b=wm08g+zCxUBIOnZya9Ew232hQOHQrCbUStR2valI6eUGZrvftuSIKbifX1+ptfWKgRiCT1cmW wE9JIb7k1EFAE9IZ7aLCTfL3VAaBoMbfsO6+RhkgrcnqlAiJdn+gyK2 X-Developer-Key: i=gregor.herburger@linutronix.de; a=ed25519; pk=u72Lv7+/lS5CC1hmSrb17lv/6CK7HBh4Lvz77PHA5LM= The hvs and v3d drivers use dev_get_drvdata(master) in their unbind functions. Since the vc4-drm gets removed before its dependent drivers (vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to get drvdata of its master and fails with a null dereference error. Use the data pointer passed to the unbind functions directly instead of dev_get_drvdata(master). This avoids using potentially freed memory. Signed-off-by: Gregor Herburger --- drivers/gpu/drm/vc4/vc4_hvs.c | 2 +- drivers/gpu/drm/vc4/vc4_v3d.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c index 184d51ea3fa5..e715147d091c 100644 --- a/drivers/gpu/drm/vc4/vc4_hvs.c +++ b/drivers/gpu/drm/vc4/vc4_hvs.c @@ -1752,7 +1752,7 @@ static int vc4_hvs_bind(struct device *dev, struct de= vice *master, void *data) static void vc4_hvs_unbind(struct device *dev, struct device *master, void *data) { - struct drm_device *drm =3D dev_get_drvdata(master); + struct drm_device *drm =3D data; struct vc4_dev *vc4 =3D to_vc4_dev(drm); struct vc4_hvs *hvs =3D vc4->hvs; struct drm_mm_node *node, *next; diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c index d31b906cb8e7..f32410420d3e 100644 --- a/drivers/gpu/drm/vc4/vc4_v3d.c +++ b/drivers/gpu/drm/vc4/vc4_v3d.c @@ -494,7 +494,7 @@ static int vc4_v3d_bind(struct device *dev, struct devi= ce *master, void *data) static void vc4_v3d_unbind(struct device *dev, struct device *master, void *data) { - struct drm_device *drm =3D dev_get_drvdata(master); + struct drm_device *drm =3D data; struct vc4_dev *vc4 =3D to_vc4_dev(drm); =20 vc4_irq_uninstall(drm); --- base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb change-id: 20260715-rpi-vc4-fix-d93513b05425 Best regards, -- =20 Gregor Herburger