From nobody Sat Jul 25 00:48:14 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9AC0F46AA6B for ; Tue, 21 Jul 2026 15:38:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784648316; cv=none; b=Ys6mxZ14/DkwabarQ28LQHVlMCcduPaRuBDMDhyuqCofvMoHAmrZwhc0sg8qxVLvdPLNmBEwdIavZtmqdvV5L+kW36TKakgR7CUmVbjIBUGPD63bhUqjzmyPDW1v1wO7z/zHOX5HCDzwtmGRZW8llSIs0plfn4jVdlnoP7BlAu8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784648316; c=relaxed/simple; bh=gT0B/UqWA+MfWagMrYsjYSZgllA5pSGacte4E7za4cU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=b6Y/59W7COnFulY5++bW0gxj+09a5LxJVOd2zXCvBK/+dpN1/M7XzqUpGJ7kbawd14IuVItTtnqwYiOjY6QQBg5ENYQWKUgDF+567HGimiuO+Q6uiThIFvDXnNpN8iHxhPKE+FDdkJlWsBFyitpE+vMWqPOLZxL9cS13qpVbQSc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=JcWjyMTq; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=/ebiC3dJ; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="JcWjyMTq"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="/ebiC3dJ" From: Gregor Herburger DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1784648313; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Qr0yzIrf3ANiObvCzKGQ0FrOzPoo5WBOtSa9iiW6L2c=; b=JcWjyMTqJl2LU2MceAk83qGUEYBMzQAdfKzqDEInDgu8NUK37fPkzZWmZHAf9d7zdBKuvI Yj5rehgeUjIfqoQw1xLJJWiIuYhRdX4F++1s6reShPvrrjny2hrtWkXqX715hT/F8Ler43 8SfbDNnCMnDfWnWm86eXSfbbz5M6tlplQCrU9XMhOHMFusu+UPXk7jCUGV4r3/C1NfsrIo IWpm6ga+G6kqVGtf0LMImH9CMEcC8DBLuxWkUjmvgwKLw1SfUskEEIm/FKllZxEJ9wVhP1 e/se4HNh3psGihesAM9AVCFGfOF/SXWQNFAPBTQjiv7O5Us09j7axLaCDornUQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1784648313; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Qr0yzIrf3ANiObvCzKGQ0FrOzPoo5WBOtSa9iiW6L2c=; b=/ebiC3dJq1eQxGTOdQXF/8jKcpNZ31jHzqZS+KuA/yeaiE33JyZOfpU2NzHNFDoK+g5gMl TT1wZLVWnTuxlzAg== Date: Tue, 21 Jul 2026 17:38:19 +0200 Subject: [PATCH v2] drm/vc4: hvs/v3d: Fix null dereference in unbind Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260721-rpi-vc4-fix-v2-1-b813dcd01dc7@linutronix.de> X-B4-Tracking: v=1; b=H4sIAGqSX2oC/1WNyw6CMBBFf4XM2jF9UAiu/A/DgscoY0whbWkwh H+3oBuX5+bec1fw5Jg8XLIVHEX2PNoE6pRBNzT2Qch9YlBCFaKUBt3EGLsc77xgX2kjdStMrgy kxeQoxYftVn/Zz+2TurAr9sbAPozufdxFufd+ZiX+zFGixBTrpioaU5b6+mI7BzdaXs49Qb1t2 wdvNVfyvAAAAA== X-Change-ID: 20260715-rpi-vc4-fix-d93513b05425 To: Maxime Ripard , Dave Stevenson , =?utf-8?q?Ma=C3=ADra_Canal?= , Raspberry Pi Kernel Maintenance , Maarten Lankhorst , Thomas Zimmermann , David Airlie , Simona Vetter , Douglas Anderson , Eric Anholt Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Simona Vetter , Gregor Herburger X-Developer-Signature: v=1; a=ed25519-sha256; t=1784648313; l=2215; i=gregor.herburger@linutronix.de; s=20260226; h=from:subject:message-id; bh=gT0B/UqWA+MfWagMrYsjYSZgllA5pSGacte4E7za4cU=; b=x1oGNt3ancCKQbthbfgNDd12zjrlgcc2w0dm8L1rJ7GcGJpFJDQgBt4fWZeL3f0TeGyzlw4JF dw2Xeio/yJECVNVXi0eez2pR/2tC7C0z5jrDzDVkciJfUgJdtwWJaYd X-Developer-Key: i=gregor.herburger@linutronix.de; a=ed25519; pk=u72Lv7+/lS5CC1hmSrb17lv/6CK7HBh4Lvz77PHA5LM= The hvs and v3d drivers use dev_get_drvdata(master) in their unbind functions. Since the vc4-drm gets removed before its dependent drivers (vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to get drvdata of its master and fails with a null dereference error. Use the data pointer passed to the unbind functions directly instead of dev_get_drvdata(master). This avoids using potentially freed memory. Fixes: d3f5168a0810 ("drm/vc4: Bind and initialize the V3D engine.") Fixes: c8b75bca92cb ("drm/vc4: Add KMS support for Raspberry Pi.") Signed-off-by: Gregor Herburger --- Changes in v2: - Add Fixes tags - Link to v1: https://patch.msgid.link/20260720-rpi-vc4-fix-v1-1-6073a96a57= 73@linutronix.de --- drivers/gpu/drm/vc4/vc4_hvs.c | 2 +- drivers/gpu/drm/vc4/vc4_v3d.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c index 184d51ea3fa5..e715147d091c 100644 --- a/drivers/gpu/drm/vc4/vc4_hvs.c +++ b/drivers/gpu/drm/vc4/vc4_hvs.c @@ -1752,7 +1752,7 @@ static int vc4_hvs_bind(struct device *dev, struct de= vice *master, void *data) static void vc4_hvs_unbind(struct device *dev, struct device *master, void *data) { - struct drm_device *drm =3D dev_get_drvdata(master); + struct drm_device *drm =3D data; struct vc4_dev *vc4 =3D to_vc4_dev(drm); struct vc4_hvs *hvs =3D vc4->hvs; struct drm_mm_node *node, *next; diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c index d31b906cb8e7..f32410420d3e 100644 --- a/drivers/gpu/drm/vc4/vc4_v3d.c +++ b/drivers/gpu/drm/vc4/vc4_v3d.c @@ -494,7 +494,7 @@ static int vc4_v3d_bind(struct device *dev, struct devi= ce *master, void *data) static void vc4_v3d_unbind(struct device *dev, struct device *master, void *data) { - struct drm_device *drm =3D dev_get_drvdata(master); + struct drm_device *drm =3D data; struct vc4_dev *vc4 =3D to_vc4_dev(drm); =20 vc4_irq_uninstall(drm); --- base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb change-id: 20260715-rpi-vc4-fix-d93513b05425 Best regards, -- =20 Gregor Herburger