From nobody Fri Jul 24 23:31:01 2026 Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E47F144AB77; Wed, 22 Jul 2026 09:49:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.85.4 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784713773; cv=none; b=sX6VjnpCqmQpunuq4iW3cDuWdiWj9PkaJHQVk3joVUKmnb70bKOdt4em6sDgZbI/lnYEjWMR1+ReZ0qvaKBUuegbxtsZ0CWFaoVXpqc3WmB08vi/6tyHVvAGKgy2Z2nc+bXcKSgwkgMMx1JXYqIX4mW++yNzzXSxw4di3crfbDw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784713773; c=relaxed/simple; bh=VXSXcShK4fFsIMKbnC3JNGRYByz27krwWD0x9HCnrR8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=aT1RpgfE6sHhEY2cMvDrmdIgE5Vd3D9pvPizYp5BMghsF9RAWAJ6A/k/7MsdtkTQ1GMD03iA/sw18ryKaJTcb60LnJktoj1zBuEbID89dL+RPsZ7BEbmvoOC8ecALhawggpOGu/tYAKV6CuekdiPz3fj5nfjjvTA+qNAy7vqIqM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=sRAaH/ub; arc=none smtp.client-ip=185.246.85.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="sRAaH/ub" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id 56F334E40EC4; Wed, 22 Jul 2026 09:49:28 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 2B57B60388; Wed, 22 Jul 2026 09:49:28 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 6D6F411BD1C3E; Wed, 22 Jul 2026 11:49:26 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1784713767; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=DwqaYl2u6ozHetdvc/pa9W4sLF5l+X9UH8Twm0l8b5o=; b=sRAaH/ubXawQiSsAQXM5IjGeAnFMGwC63jIGnVhQS8E2FXcHC8waO8Z07eu8I6qRkPBAHC Wa6FL78uuOJXFWpsgympW7bVh1FWD4Al4Huj6gg3JUwUMwZowPxcxjLsjyVePtS7udJpoA 7wOOghVm4XnkCfGbv8eGcJzIeBa4FUNGZDtck6XzfaKunXHWxPdWdYyuNwZ8BUJBprdnUn QzdHNgj1TStDn2uPQmhEsWj7oEnE97nHajWVa2VjGOWIgHEvz4hUgSr86mXd0MWiieYwfZ IF+t09nHYjIR0RbeOY2Zutd/m6ZV+t7urq4ijt6DpidWLw5raenYs36qXSWF3A== From: Romain Gantois Date: Wed, 22 Jul 2026 11:49:12 +0200 Subject: [PATCH v3 1/2] drm/logicvc: Avoid use-after-free with devm_kzalloc() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260722-logicvc-uaf-v3-1-f3b2319d58a6@bootlin.com> References: <20260722-logicvc-uaf-v3-0-f3b2319d58a6@bootlin.com> In-Reply-To: <20260722-logicvc-uaf-v3-0-f3b2319d58a6@bootlin.com> To: Paul Kocialkowski , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter Cc: Thomas Petazzoni , Paul Kocialkowski , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Romain Gantois , Jason Xiang , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Last-TLS-Session-Version: TLSv1.3 The logicvc driver calls drm_universal_plane_init(), drm_crtc_init_with_planes(), and drm_encoder_alloc(). These functions should not be called with structs allocated with devm_kzalloc(), as this can lead to use-after-free bugs. In fact, a use-after-free caused by this has been observed on a v6.6 kernel. Use DRM-managed allocations instead for panel, CRTC and encoder objects. Found using KASAN. Fixes: efeeaefe9be56 ("drm: Add support for the LogiCVC display controller") Cc: stable@vger.kernel.org Reviewed-by: Maxime Ripard Signed-off-by: Romain Gantois --- drivers/gpu/drm/logicvc/logicvc_crtc.c | 17 ++--- drivers/gpu/drm/logicvc/logicvc_interface.c | 49 +++++-------- drivers/gpu/drm/logicvc/logicvc_layer.c | 105 +++++++++++++-----------= ---- 3 files changed, 75 insertions(+), 96 deletions(-) diff --git a/drivers/gpu/drm/logicvc/logicvc_crtc.c b/drivers/gpu/drm/logic= vc/logicvc_crtc.c index 43a675d03808f..3a4c347eaa648 100644 --- a/drivers/gpu/drm/logicvc/logicvc_crtc.c +++ b/drivers/gpu/drm/logicvc/logicvc_crtc.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include =20 @@ -214,7 +215,6 @@ static void logicvc_crtc_disable_vblank(struct drm_crtc= *drm_crtc) =20 static const struct drm_crtc_funcs logicvc_crtc_funcs =3D { .reset =3D drm_atomic_helper_crtc_reset, - .destroy =3D drm_crtc_cleanup, .set_config =3D drm_atomic_helper_set_config, .page_flip =3D drm_atomic_helper_page_flip, .atomic_duplicate_state =3D drm_atomic_helper_crtc_duplicate_state, @@ -250,11 +250,6 @@ int logicvc_crtc_init(struct logicvc_drm *logicvc) struct device_node *of_node =3D dev->of_node; struct logicvc_crtc *crtc; struct logicvc_layer *layer_primary; - int ret; - - crtc =3D devm_kzalloc(dev, sizeof(*crtc), GFP_KERNEL); - if (!crtc) - return -ENOMEM; =20 layer_primary =3D logicvc_layer_get_primary(logicvc); if (!layer_primary) { @@ -262,12 +257,12 @@ int logicvc_crtc_init(struct logicvc_drm *logicvc) return -EINVAL; } =20 - ret =3D drm_crtc_init_with_planes(drm_dev, &crtc->drm_crtc, - &layer_primary->drm_plane, NULL, - &logicvc_crtc_funcs, NULL); - if (ret) { + crtc =3D drmm_crtc_alloc_with_planes(drm_dev, struct logicvc_crtc, + drm_crtc, &layer_primary->drm_plane, + NULL, &logicvc_crtc_funcs, NULL); + if (IS_ERR(crtc)) { drm_err(drm_dev, "Failed to initialize CRTC\n"); - return ret; + return PTR_ERR(crtc); } =20 drm_crtc_helper_add(&crtc->drm_crtc, &logicvc_crtc_helper_funcs); diff --git a/drivers/gpu/drm/logicvc/logicvc_interface.c b/drivers/gpu/drm/= logicvc/logicvc_interface.c index 689049d395c0d..0d037f37b950f 100644 --- a/drivers/gpu/drm/logicvc/logicvc_interface.c +++ b/drivers/gpu/drm/logicvc/logicvc_interface.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -60,10 +61,6 @@ static const struct drm_encoder_helper_funcs logicvc_enc= oder_helper_funcs =3D { .disable =3D logicvc_encoder_disable, }; =20 -static const struct drm_encoder_funcs logicvc_encoder_funcs =3D { - .destroy =3D drm_encoder_cleanup, -}; - static int logicvc_connector_get_modes(struct drm_connector *drm_connector) { struct logicvc_interface *interface =3D @@ -84,7 +81,6 @@ static const struct drm_connector_helper_funcs logicvc_co= nnector_helper_funcs =3D static const struct drm_connector_funcs logicvc_connector_funcs =3D { .reset =3D drm_atomic_helper_connector_reset, .fill_modes =3D drm_helper_probe_single_connector_modes, - .destroy =3D drm_connector_cleanup, .atomic_duplicate_state =3D drm_atomic_helper_connector_duplicate_state, .atomic_destroy_state =3D drm_atomic_helper_connector_destroy_state, }; @@ -147,36 +143,35 @@ int logicvc_interface_init(struct logicvc_drm *logicv= c) int encoder_type =3D logicvc_interface_encoder_type(logicvc); int connector_type =3D logicvc_interface_connector_type(logicvc); bool native_connector =3D logicvc_interface_native_connector(logicvc); + struct drm_bridge *bridge; + struct drm_panel *panel; int ret; =20 - interface =3D devm_kzalloc(dev, sizeof(*interface), GFP_KERNEL); - if (!interface) { - ret =3D -ENOMEM; - goto error_early; - } - - ret =3D drm_of_find_panel_or_bridge(of_node, 0, 0, &interface->drm_panel, - &interface->drm_bridge); + ret =3D drm_of_find_panel_or_bridge(of_node, 0, 0, &panel, + &bridge); if (ret =3D=3D -EPROBE_DEFER) - goto error_early; + return ret; =20 - ret =3D drm_encoder_init(drm_dev, &interface->drm_encoder, - &logicvc_encoder_funcs, encoder_type, NULL); - if (ret) { + interface =3D drmm_encoder_alloc(drm_dev, struct logicvc_interface, drm_e= ncoder, + NULL, encoder_type, NULL); + if (IS_ERR(interface)) { drm_err(drm_dev, "Failed to initialize encoder\n"); - goto error_early; + return PTR_ERR(interface); } =20 + interface->drm_panel =3D panel; + interface->drm_bridge =3D bridge; + drm_encoder_helper_add(&interface->drm_encoder, &logicvc_encoder_helper_funcs); =20 if (native_connector || interface->drm_panel) { - ret =3D drm_connector_init(drm_dev, &interface->drm_connector, - &logicvc_connector_funcs, - connector_type); + ret =3D drmm_connector_init(drm_dev, &interface->drm_connector, + &logicvc_connector_funcs, + connector_type, NULL); if (ret) { drm_err(drm_dev, "Failed to initialize connector\n"); - goto error_encoder; + return ret; } =20 drm_connector_helper_add(&interface->drm_connector, @@ -187,7 +182,7 @@ int logicvc_interface_init(struct logicvc_drm *logicvc) if (ret) { drm_err(drm_dev, "Failed to attach connector to encoder\n"); - goto error_encoder; + return ret; } } =20 @@ -197,17 +192,11 @@ int logicvc_interface_init(struct logicvc_drm *logicv= c) if (ret) { drm_err(drm_dev, "Failed to attach bridge to encoder\n"); - goto error_encoder; + return ret; } } =20 logicvc->interface =3D interface; =20 return 0; - -error_encoder: - drm_encoder_cleanup(&interface->drm_encoder); - -error_early: - return ret; } diff --git a/drivers/gpu/drm/logicvc/logicvc_layer.c b/drivers/gpu/drm/logi= cvc/logicvc_layer.c index eab4d773f92b6..de1f4a8a61557 100644 --- a/drivers/gpu/drm/logicvc/logicvc_layer.c +++ b/drivers/gpu/drm/logicvc/logicvc_layer.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include =20 @@ -250,7 +251,6 @@ static struct drm_plane_helper_funcs logicvc_plane_help= er_funcs =3D { static const struct drm_plane_funcs logicvc_plane_funcs =3D { .update_plane =3D drm_atomic_helper_update_plane, .disable_plane =3D drm_atomic_helper_disable_plane, - .destroy =3D drm_plane_cleanup, .reset =3D drm_atomic_helper_plane_reset, .atomic_duplicate_state =3D drm_atomic_helper_plane_duplicate_state, .atomic_destroy_state =3D drm_atomic_helper_plane_destroy_state, @@ -350,16 +350,17 @@ int logicvc_layer_buffer_find_setup(struct logicvc_dr= m *logicvc, return 0; } =20 -static struct logicvc_layer_formats *logicvc_layer_formats_lookup(struct l= ogicvc_layer *layer) +static struct logicvc_layer_formats * +logicvc_layer_formats_lookup(struct logicvc_layer_config *config) { bool alpha; unsigned int i =3D 0; =20 - alpha =3D (layer->config.alpha_mode =3D=3D LOGICVC_LAYER_ALPHA_PIXEL); + alpha =3D (config->alpha_mode =3D=3D LOGICVC_LAYER_ALPHA_PIXEL); =20 while (logicvc_layer_formats[i].formats) { - if (logicvc_layer_formats[i].colorspace =3D=3D layer->config.colorspace = && - logicvc_layer_formats[i].depth =3D=3D layer->config.depth && + if (logicvc_layer_formats[i].colorspace =3D=3D config->colorspace && + logicvc_layer_formats[i].depth =3D=3D config->depth && logicvc_layer_formats[i].alpha =3D=3D alpha) return &logicvc_layer_formats[i]; =20 @@ -380,10 +381,9 @@ static unsigned int logicvc_layer_formats_count(struct= logicvc_layer_formats *fo } =20 static int logicvc_layer_config_parse(struct logicvc_drm *logicvc, - struct logicvc_layer *layer) + struct device_node *of_node, + struct logicvc_layer_config *config) { - struct device_node *of_node =3D layer->of_node; - struct logicvc_layer_config *config =3D &layer->config; int ret; =20 logicvc_of_property_parse_bool(of_node, @@ -458,11 +458,30 @@ struct logicvc_layer *logicvc_layer_get_primary(struc= t logicvc_drm *logicvc) return logicvc_layer_get_from_type(logicvc, DRM_PLANE_TYPE_PRIMARY); } =20 +static void logicvc_layer_set_config(struct logicvc_layer *layer, + struct logicvc_layer_config *config) +{ + layer->config.colorspace =3D config->colorspace; + layer->config.depth =3D config->depth; + layer->config.alpha_mode =3D config->alpha_mode; + layer->config.base_offset =3D config->base_offset; + layer->config.buffer_offset =3D config->buffer_offset; + layer->config.primary =3D config->primary; +} + +static void logicvc_layer_fini(struct drm_device *drm_dev, + void *data) +{ + struct logicvc_layer *layer =3D data; + + list_del(&layer->list); +} + static int logicvc_layer_init(struct logicvc_drm *logicvc, struct device_node *of_node, u32 index) { struct drm_device *drm_dev =3D &logicvc->drm_dev; - struct device *dev =3D drm_dev->dev; + struct logicvc_layer_config config =3D { 0 }; struct logicvc_layer *layer =3D NULL; struct logicvc_layer_formats *formats; unsigned int formats_count; @@ -470,28 +489,18 @@ static int logicvc_layer_init(struct logicvc_drm *log= icvc, unsigned int zpos; int ret; =20 - layer =3D devm_kzalloc(dev, sizeof(*layer), GFP_KERNEL); - if (!layer) { - ret =3D -ENOMEM; - goto error; - } - - layer->of_node =3D of_node; - layer->index =3D index; - - ret =3D logicvc_layer_config_parse(logicvc, layer); + ret =3D logicvc_layer_config_parse(logicvc, of_node, &config); if (ret) { drm_err(drm_dev, "Failed to parse config for layer #%d\n", index); - goto error; + return ret; } =20 - formats =3D logicvc_layer_formats_lookup(layer); + formats =3D logicvc_layer_formats_lookup(&config); if (!formats) { drm_err(drm_dev, "Failed to lookup formats for layer #%d\n", index); - ret =3D -EINVAL; - goto error; + return -EINVAL; } =20 formats_count =3D logicvc_layer_formats_count(formats); @@ -511,24 +520,27 @@ static int logicvc_layer_init(struct logicvc_drm *log= icvc, regmap_write(logicvc->regmap, LOGICVC_BACKGROUND_COLOR_REG, background); =20 - devm_kfree(dev, layer); - return 0; } =20 - if (layer->config.primary) + if (config.primary) type =3D DRM_PLANE_TYPE_PRIMARY; else type =3D DRM_PLANE_TYPE_OVERLAY; =20 - ret =3D drm_universal_plane_init(drm_dev, &layer->drm_plane, 0, - &logicvc_plane_funcs, formats->formats, - formats_count, NULL, type, NULL); - if (ret) { + layer =3D drmm_universal_plane_alloc(drm_dev, struct logicvc_layer, + drm_plane, 0, &logicvc_plane_funcs, + formats->formats, formats_count, + NULL, type, NULL); + if (IS_ERR(layer)) { drm_err(drm_dev, "Failed to initialize layer plane\n"); - return ret; + return PTR_ERR(layer); } =20 + layer->of_node =3D of_node; + layer->index =3D index; + logicvc_layer_set_config(layer, &config); + drm_plane_helper_add(&layer->drm_plane, &logicvc_plane_helper_funcs); =20 zpos =3D logicvc->config.layers_count - index - 1; @@ -545,22 +557,13 @@ static int logicvc_layer_init(struct logicvc_drm *log= icvc, =20 list_add_tail(&layer->list, &logicvc->layers_list); =20 - return 0; - -error: - if (layer) - devm_kfree(dev, layer); - - return ret; -} + ret =3D drmm_add_action_or_reset(drm_dev, logicvc_layer_fini, + layer); + if (ret) + return ret; =20 -static void logicvc_layer_fini(struct logicvc_drm *logicvc, - struct logicvc_layer *layer) -{ - struct device *dev =3D logicvc->drm_dev.dev; =20 - list_del(&layer->list); - devm_kfree(dev, layer); + return 0; } =20 void logicvc_layers_attach_crtc(struct logicvc_drm *logicvc) @@ -584,14 +587,12 @@ int logicvc_layers_init(struct logicvc_drm *logicvc) struct device_node *layer_node =3D NULL; struct device_node *layers_node; struct logicvc_layer *layer; - struct logicvc_layer *next; int ret =3D 0; =20 layers_node =3D of_get_child_by_name(of_node, "layers"); if (!layers_node) { drm_err(drm_dev, "No layers node found in the description\n"); - ret =3D -ENODEV; - goto error; + return -ENODEV; } =20 for_each_child_of_node(layers_node, layer_node) { @@ -614,17 +615,11 @@ int logicvc_layers_init(struct logicvc_drm *logicvc) ret =3D logicvc_layer_init(logicvc, layer_node, index); if (ret) { of_node_put(layers_node); - goto error; + return ret; } } =20 of_node_put(layers_node); =20 return 0; - -error: - list_for_each_entry_safe(layer, next, &logicvc->layers_list, list) - logicvc_layer_fini(logicvc, layer); - - return ret; } --=20 2.55.0 From nobody Fri Jul 24 23:31:01 2026 Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 915463EF652 for ; Wed, 22 Jul 2026 09:49:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.84.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784713773; cv=none; b=kUzW25lGBF00UL67Re/yRxTtAgywA4zK+TbUQsvBOfS9CW+XZneX+ubuBU1tlW30Siz3ijqWIFcXOkXy1Abp89GuiFtLGGivpodGfDPUkWwu59M5gGXTRGAWBr0rWiXwJqKGfbYZJ4MvWUpb8KxnT+nljdJRjnqV/JpFIWQIu1I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784713773; c=relaxed/simple; bh=M993H7D+BqE+CyW6mZgB1dleZlufM3PRixzI0h7+OGc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=doypwvIS/s1Td8jqrLMrLvsN/nDF3oT5WBwLAjZxwcOBEt+D2tiMnz2SlsOX2U/g+1Ymm+UmJSTv5lrPXR9rk4fgBfBHSBNeNDFBYrt3Mwik9LVC8xbyqL8uOByF55BsiVAVMYpnmTWtYQhFyEonROlG4Sg1cz90ym/J7NBiTak= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=tcDzR5BB; arc=none smtp.client-ip=185.246.84.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="tcDzR5BB" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 9CA601A1182; Wed, 22 Jul 2026 09:49:29 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 69D3E60388; Wed, 22 Jul 2026 09:49:29 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 9958411BD3A30; Wed, 22 Jul 2026 11:49:27 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1784713768; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=stxIwdcEleIWpSaYIh2+fwHEePZ7UOvIiJ1idqO9hgI=; b=tcDzR5BBmWodymMvcvZB931nkbROUJXX4yFigAx1RfQMt1ncxXeIOq8vhFcGIEbfadqfnB gEisTvXUWwSCVBWGs0bL2nFE7nZn5FfApkSIghYXqzbButtEd9NHTGuOiS6l7o2OjExx7d DN8AzpBaXhMZJSK36HmnSftf+6/WVHHg6x9RdQWlKTcmXRUkpxc2ZTil11VPLkkt719MJw dSjCebsBS4Q6r5c+qhqAcgCUmBL6NBuP+HVKP2JaWbznmWpPt12oneNaX6rM9dF9B2n8Dh xdmugNDZfaD9i+rXuwo97K1JGEEXHvuQ0FDaqzArIXfQSRyJ4EKDZlAPf51sMg== From: Romain Gantois Date: Wed, 22 Jul 2026 11:49:13 +0200 Subject: [PATCH v3 2/2] drm/logicvc: Avoid using DRM resources after device is unplugged Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260722-logicvc-uaf-v3-2-f3b2319d58a6@bootlin.com> References: <20260722-logicvc-uaf-v3-0-f3b2319d58a6@bootlin.com> In-Reply-To: <20260722-logicvc-uaf-v3-0-f3b2319d58a6@bootlin.com> To: Paul Kocialkowski , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter Cc: Thomas Petazzoni , Paul Kocialkowski , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Romain Gantois , Jason Xiang , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Last-TLS-Session-Version: TLSv1.3 Some DRM resources such as plane, CRTC or encoder objects could remain in use after the DRM device is removed. Use the drm_dev_enter/exit() mechanism to ensure that the DRM device is not unplugged before using its resources. Fixes: efeeaefe9be56 ("drm: Add support for the LogiCVC display controller"= ) = =E2=94=82 Cc: stable@vger.kernel.org Signed-off-by: Romain Gantois --- drivers/gpu/drm/logicvc/logicvc_crtc.c | 39 +++++++++++++++++++++++++= ++++ drivers/gpu/drm/logicvc/logicvc_drm.c | 6 ++++- drivers/gpu/drm/logicvc/logicvc_interface.c | 12 +++++++++ drivers/gpu/drm/logicvc/logicvc_layer.c | 28 ++++++++++++++++----- 4 files changed, 78 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/logicvc/logicvc_crtc.c b/drivers/gpu/drm/logic= vc/logicvc_crtc.c index 3a4c347eaa648..e2575fa78ab25 100644 --- a/drivers/gpu/drm/logicvc/logicvc_crtc.c +++ b/drivers/gpu/drm/logicvc/logicvc_crtc.c @@ -36,6 +36,21 @@ logicvc_crtc_mode_valid(struct drm_crtc *drm_crtc, return 0; } =20 +static void logicvc_crtc_drop_any_event(struct drm_device *drm_dev, + struct drm_crtc *drm_crtc) +{ + unsigned long flags; + + spin_lock_irqsave(&drm_dev->event_lock, flags); + + if (drm_crtc->state->event) { + drm_crtc->state->event =3D NULL; + drm_warn(drm_crtc->dev, "Device is unplugged, ignoring pending vblank ev= ent!"); + } + + spin_unlock_irqrestore(&drm_dev->event_lock, flags); +} + static void logicvc_crtc_atomic_begin(struct drm_crtc *drm_crtc, struct drm_atomic_state *state) { @@ -44,6 +59,12 @@ static void logicvc_crtc_atomic_begin(struct drm_crtc *d= rm_crtc, drm_atomic_get_old_crtc_state(state, drm_crtc); struct drm_device *drm_dev =3D drm_crtc->dev; unsigned long flags; + int idx; + + if (!drm_dev_enter(drm_dev, &idx)) { + logicvc_crtc_drop_any_event(drm_dev, drm_crtc); + return; + } =20 /* * We need to grab the pending event here if vblank was already enabled @@ -58,6 +79,8 @@ static void logicvc_crtc_atomic_begin(struct drm_crtc *dr= m_crtc, =20 spin_unlock_irqrestore(&drm_dev->event_lock, flags); } + + drm_dev_exit(idx); } =20 static void logicvc_crtc_atomic_enable(struct drm_crtc *drm_crtc, @@ -76,6 +99,12 @@ static void logicvc_crtc_atomic_enable(struct drm_crtc *= drm_crtc, unsigned int vact, vfp, vsl, vbp; unsigned long flags; u32 ctrl; + int idx; + + if (!drm_dev_enter(drm_dev, &idx)) { + logicvc_crtc_drop_any_event(drm_dev, drm_crtc); + return; + } =20 /* Timings */ =20 @@ -148,6 +177,8 @@ static void logicvc_crtc_atomic_enable(struct drm_crtc = *drm_crtc, drm_crtc->state->event =3D NULL; spin_unlock_irqrestore(&drm_dev->event_lock, flags); } + + drm_dev_exit(idx); } =20 static void logicvc_crtc_atomic_disable(struct drm_crtc *drm_crtc, @@ -155,6 +186,12 @@ static void logicvc_crtc_atomic_disable(struct drm_crt= c *drm_crtc, { struct logicvc_drm *logicvc =3D logicvc_drm(drm_crtc->dev); struct drm_device *drm_dev =3D drm_crtc->dev; + int idx; + + if (!drm_dev_enter(drm_dev, &idx)) { + logicvc_crtc_drop_any_event(drm_dev, drm_crtc); + return; + } =20 drm_crtc_vblank_off(drm_crtc); =20 @@ -180,6 +217,8 @@ static void logicvc_crtc_atomic_disable(struct drm_crtc= *drm_crtc, drm_crtc->state->event =3D NULL; spin_unlock_irq(&drm_dev->event_lock); } + + drm_dev_exit(idx); } =20 static const struct drm_crtc_helper_funcs logicvc_crtc_helper_funcs =3D { diff --git a/drivers/gpu/drm/logicvc/logicvc_drm.c b/drivers/gpu/drm/logicv= c/logicvc_drm.c index bbebf4fc7f51a..fb66f5fb67937 100644 --- a/drivers/gpu/drm/logicvc/logicvc_drm.c +++ b/drivers/gpu/drm/logicvc/logicvc_drm.c @@ -72,6 +72,10 @@ static irqreturn_t logicvc_drm_irq_handler(int irq, void= *data) irqreturn_t ret =3D IRQ_NONE; u32 stat =3D 0; =20 + /* The interrupt handler will be unregistered when the device is + * removed. Therefore, there's no need for drm_dev_enter() here. + */ + /* Get pending interrupt sources. */ regmap_read(logicvc->regmap, LOGICVC_INT_STAT_REG, &stat); =20 @@ -463,7 +467,7 @@ static void logicvc_drm_remove(struct platform_device *= pdev) struct device *dev =3D &pdev->dev; struct drm_device *drm_dev =3D &logicvc->drm_dev; =20 - drm_dev_unregister(drm_dev); + drm_dev_unplug(drm_dev); drm_atomic_helper_shutdown(drm_dev); =20 logicvc_mode_fini(logicvc); diff --git a/drivers/gpu/drm/logicvc/logicvc_interface.c b/drivers/gpu/drm/= logicvc/logicvc_interface.c index 0d037f37b950f..aa13338a29535 100644 --- a/drivers/gpu/drm/logicvc/logicvc_interface.c +++ b/drivers/gpu/drm/logicvc/logicvc_interface.c @@ -34,6 +34,10 @@ static void logicvc_encoder_enable(struct drm_encoder *d= rm_encoder) struct logicvc_drm *logicvc =3D logicvc_drm(drm_encoder->dev); struct logicvc_interface *interface =3D logicvc_interface_from_drm_encoder(drm_encoder); + int idx; + + if (!drm_dev_enter(drm_encoder->dev, &idx)) + return; =20 regmap_update_bits(logicvc->regmap, LOGICVC_POWER_CTRL_REG, LOGICVC_POWER_CTRL_VIDEO_ENABLE, @@ -43,17 +47,25 @@ static void logicvc_encoder_enable(struct drm_encoder *= drm_encoder) drm_panel_prepare(interface->drm_panel); drm_panel_enable(interface->drm_panel); } + + drm_dev_exit(idx); } =20 static void logicvc_encoder_disable(struct drm_encoder *drm_encoder) { struct logicvc_interface *interface =3D logicvc_interface_from_drm_encoder(drm_encoder); + int idx; + + if (!drm_dev_enter(drm_encoder->dev, &idx)) + return; =20 if (interface->drm_panel) { drm_panel_disable(interface->drm_panel); drm_panel_unprepare(interface->drm_panel); } + + drm_dev_exit(idx); } =20 static const struct drm_encoder_helper_funcs logicvc_encoder_helper_funcs = =3D { diff --git a/drivers/gpu/drm/logicvc/logicvc_layer.c b/drivers/gpu/drm/logi= cvc/logicvc_layer.c index de1f4a8a61557..4d9bfd57affcf 100644 --- a/drivers/gpu/drm/logicvc/logicvc_layer.c +++ b/drivers/gpu/drm/logicvc/logicvc_layer.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include #include @@ -92,7 +93,7 @@ static int logicvc_plane_atomic_check(struct drm_plane *d= rm_plane, struct drm_crtc_state *crtc_state; int min_scale, max_scale; bool can_position; - int ret; + int idx, ret =3D 0; =20 if (!new_state->crtc) return 0; @@ -108,12 +109,15 @@ static int logicvc_plane_atomic_check(struct drm_plan= e *drm_plane, return -EINVAL; } =20 + if (!drm_dev_enter(drm_dev, &idx)) + return -ENODEV; + if (!logicvc->caps->layer_address) { ret =3D logicvc_layer_buffer_find_setup(logicvc, layer, new_state, NULL); if (ret) { drm_err(drm_dev, "No viable setup for buffer found.\n"); - return ret; + goto out_exit; } } =20 @@ -127,12 +131,12 @@ static int logicvc_plane_atomic_check(struct drm_plan= e *drm_plane, ret =3D drm_atomic_helper_check_plane_state(new_state, crtc_state, min_scale, max_scale, can_position, true); - if (ret) { + if (ret) drm_err(drm_dev, "Invalid plane state\n\n"); - return ret; - } =20 - return 0; +out_exit: + drm_dev_exit(idx); + return ret; } =20 static void logicvc_plane_atomic_update(struct drm_plane *drm_plane, @@ -148,8 +152,12 @@ static void logicvc_plane_atomic_update(struct drm_pla= ne *drm_plane, struct drm_framebuffer *fb =3D new_state->fb; struct logicvc_layer_buffer_setup setup =3D {}; u32 index =3D layer->index; + int idx; u32 reg; =20 + if (!drm_dev_enter(drm_dev, &idx)) + return; + /* Layer dimensions */ =20 regmap_write(logicvc->regmap, LOGICVC_LAYER_WIDTH_REG(index), @@ -230,6 +238,8 @@ static void logicvc_plane_atomic_update(struct drm_plan= e *drm_plane, reg |=3D LOGICVC_LAYER_CTRL_COLOR_KEY_DISABLE; =20 regmap_write(logicvc->regmap, LOGICVC_LAYER_CTRL_REG(index), reg); + + drm_dev_exit(idx); } =20 static void logicvc_plane_atomic_disable(struct drm_plane *drm_plane, @@ -238,8 +248,14 @@ static void logicvc_plane_atomic_disable(struct drm_pl= ane *drm_plane, struct logicvc_layer *layer =3D logicvc_layer(drm_plane); struct logicvc_drm *logicvc =3D logicvc_drm(drm_plane->dev); u32 index =3D layer->index; + int idx; + + if (!drm_dev_enter(&logicvc->drm_dev, &idx)) + return; =20 regmap_write(logicvc->regmap, LOGICVC_LAYER_CTRL_REG(index), 0); + + drm_dev_exit(idx); } =20 static struct drm_plane_helper_funcs logicvc_plane_helper_funcs =3D { --=20 2.55.0