| Message ID | 20230706092731.2630232-1-u.kleine-koenig@pengutronix.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/imx/lcdc: Fix double-free of driver data | expand |
Hello, On Thu, Jul 06, 2023 at 11:27:31AM +0200, Uwe Kleine-König wrote: > The struct imx_lcdc driver data is allocated using devm_drm_dev_alloc() > so it must not be explicitly kfree()d. > > Also drm_kms_helper_poll_fini() should not be called as there is no > matching drm_kms_helper_poll_init(). So drop the release function > completely. > > Fixes: c87e859cdeb5 ("drm/imx/lcdc: Implement DRM driver for imx25") > Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> This fix is now waiting for two months to be picked up. Who feels responsible? Best regards Uwe
On Do, 2023-07-06 at 11:27 +0200, Uwe Kleine-König wrote: > The struct imx_lcdc driver data is allocated using devm_drm_dev_alloc() > so it must not be explicitly kfree()d. > > Also drm_kms_helper_poll_fini() should not be called as there is no > matching drm_kms_helper_poll_init(). So drop the release function > completely. > > Fixes: c87e859cdeb5 ("drm/imx/lcdc: Implement DRM driver for imx25") > Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> regards Philipp
diff --git a/drivers/gpu/drm/imx/lcdc/imx-lcdc.c b/drivers/gpu/drm/imx/lcdc/imx-lcdc.c index 8e6d457917da..7bd433847824 100644 --- a/drivers/gpu/drm/imx/lcdc/imx-lcdc.c +++ b/drivers/gpu/drm/imx/lcdc/imx-lcdc.c @@ -342,21 +342,12 @@ static const struct drm_mode_config_helper_funcs imx_lcdc_mode_config_helpers = .atomic_commit_tail = drm_atomic_helper_commit_tail_rpm, }; -static void imx_lcdc_release(struct drm_device *drm) -{ - struct imx_lcdc *lcdc = imx_lcdc_from_drmdev(drm); - - drm_kms_helper_poll_fini(drm); - kfree(lcdc); -} - DEFINE_DRM_GEM_DMA_FOPS(imx_lcdc_drm_fops); static struct drm_driver imx_lcdc_drm_driver = { .driver_features = DRIVER_GEM | DRIVER_MODESET | DRIVER_ATOMIC, .fops = &imx_lcdc_drm_fops, DRM_GEM_DMA_DRIVER_OPS_VMAP, - .release = imx_lcdc_release, .name = "imx-lcdc", .desc = "i.MX LCDC driver", .date = "20200716",
The struct imx_lcdc driver data is allocated using devm_drm_dev_alloc() so it must not be explicitly kfree()d. Also drm_kms_helper_poll_fini() should not be called as there is no matching drm_kms_helper_poll_init(). So drop the release function completely. Fixes: c87e859cdeb5 ("drm/imx/lcdc: Implement DRM driver for imx25") Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> --- drivers/gpu/drm/imx/lcdc/imx-lcdc.c | 9 --------- 1 file changed, 9 deletions(-) base-commit: 6995e2de6891c724bfeb2db33d7b87775f913ad1