Hi everyone, this is version three of my series which fixes some memory
management issues in the logicvc-drm driver.
Patch 1/2 migrates the driver to drmm to avoid accessing DRM objects after
they have been freed by devm.
Patch 2/2 uses the unplug mechanism to ensure that DRM objects aren't
accessed after the DRM device is removed.
Best Regards,
Romain
Signed-off-by: Romain Gantois <romain.gantois@bootlin.com>
---
Changes in v3:
- Added a required drm_device_enter() section.
- Removed unecessary drm_device_enter() sections.
- Cleared vblank events in atomic callbacks when device is unplugged.
- Link to v2: https://patch.msgid.link/20260630-logicvc-uaf-v2-0-99e881833860@bootlin.com
Changes in v2:
- Added protection of DRM device resources after removal using drm_dev_enter()
- Link to v1: https://patch.msgid.link/20260601-logicvc-uaf-v1-1-8c9ca5b3429c@bootlin.com
To: Paul Kocialkowski <paulk@sys-base.io>
To: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
To: Maxime Ripard <mripard@kernel.org>
To: Thomas Zimmermann <tzimmermann@suse.de>
To: David Airlie <airlied@gmail.com>
To: Simona Vetter <simona@ffwll.ch>
Cc: Jason Xiang <jx@jasonxiang.net>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
---
Romain Gantois (2):
drm/logicvc: Avoid use-after-free with devm_kzalloc()
drm/logicvc: Avoid using DRM resources after device is unplugged
drivers/gpu/drm/logicvc/logicvc_crtc.c | 56 +++++++++---
drivers/gpu/drm/logicvc/logicvc_drm.c | 6 +-
drivers/gpu/drm/logicvc/logicvc_interface.c | 61 ++++++-------
drivers/gpu/drm/logicvc/logicvc_layer.c | 133 +++++++++++++++-------------
4 files changed, 153 insertions(+), 103 deletions(-)
---
base-commit: 44e151be23deb788d9f6124de93823faf6e04e99
change-id: 20260526-logicvc-uaf-eab103f0d0de
Best regards,
--
Romain Gantois <romain.gantois@bootlin.com>