@@ -1273,7 +1273,7 @@ static int vc4_crtc_bind(struct device *dev, struct device *master, void *data)
struct drm_plane *destroy_plane, *temp;
int ret;
- vc4_crtc = devm_kzalloc(dev, sizeof(*vc4_crtc), GFP_KERNEL);
+ vc4_crtc = drmm_kzalloc(drm, sizeof(*vc4_crtc), GFP_KERNEL);
if (!vc4_crtc)
return -ENOMEM;
crtc = &vc4_crtc->base;
@@ -479,7 +479,7 @@ static int vc4_txp_bind(struct device *dev, struct device *master, void *data)
if (irq < 0)
return irq;
- txp = devm_kzalloc(dev, sizeof(*txp), GFP_KERNEL);
+ txp = drmm_kzalloc(drm, sizeof(*txp), GFP_KERNEL);
if (!txp)
return -ENOMEM;
vc4_crtc = &txp->base;
Allocate the crtc objects with drmm_kzalloc() in order to tie the release action to the underlying struct drm_device, where all the userspace visible stuff is attached to, rather than to struct device. This can prevent potential use-after free issues on driver unload or EPROBE_DEFERRED backoff. Signed-off-by: Danilo Krummrich <dakr@redhat.com> --- drivers/gpu/drm/vc4/vc4_crtc.c | 2 +- drivers/gpu/drm/vc4/vc4_txp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)