All of lore.kernel.org
 help / color / mirror / Atom feed
From: Toby Chen <tobyc@nvidia.com>
To: Sandy Huang <hjc@rock-chips.com>, Heiko Stubner <heiko@sntech.de>
Cc: <linux-arm-kernel@lists.infradead.org>,
	<linux-kernel@vger.kernel.org>, Toby Chen <tobyc@nvidia.com>
Subject: [PATCH] drm/rockchip: dw_hdmi: cleanup drm encoder during unbind
Date: Thu, 16 Mar 2023 17:51:26 -0700	[thread overview]
Message-ID: <20230317005126.496-1-tobyc@nvidia.com> (raw)

This fixes a use-after-free crash during rmmod.

The DRM encoder is embedded inside the larger rockchip_hdmi,
which is allocated with the component. The component memory
gets freed before the main drm device is destroyed. Fix it
by running encoder cleanup before tearing down its container.

Signed-off-by: Toby Chen <tobyc@nvidia.com>
---
 drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
index 2f4b8f64cbad..8aa88e6c9e5a 100644
--- a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
@@ -642,6 +642,8 @@ static void dw_hdmi_rockchip_unbind(struct device *dev, struct device *master,
 	dw_hdmi_unbind(hdmi->hdmi);
 	clk_disable_unprepare(hdmi->ref_clk);
 
+	drm_encoder_cleanup(&hdmi->encoder.encoder);
+
 	regulator_disable(hdmi->avdd_1v8);
 	regulator_disable(hdmi->avdd_0v9);
 }
-- 
2.25.1


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

WARNING: multiple messages have this Message-ID (diff)
From: Toby Chen <tobyc@nvidia.com>
To: Sandy Huang <hjc@rock-chips.com>, Heiko Stubner <heiko@sntech.de>
Cc: <linux-arm-kernel@lists.infradead.org>,
	<linux-kernel@vger.kernel.org>, Toby Chen <tobyc@nvidia.com>
Subject: [PATCH] drm/rockchip: dw_hdmi: cleanup drm encoder during unbind
Date: Thu, 16 Mar 2023 17:51:26 -0700	[thread overview]
Message-ID: <20230317005126.496-1-tobyc@nvidia.com> (raw)

This fixes a use-after-free crash during rmmod.

The DRM encoder is embedded inside the larger rockchip_hdmi,
which is allocated with the component. The component memory
gets freed before the main drm device is destroyed. Fix it
by running encoder cleanup before tearing down its container.

Signed-off-by: Toby Chen <tobyc@nvidia.com>
---
 drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
index 2f4b8f64cbad..8aa88e6c9e5a 100644
--- a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
@@ -642,6 +642,8 @@ static void dw_hdmi_rockchip_unbind(struct device *dev, struct device *master,
 	dw_hdmi_unbind(hdmi->hdmi);
 	clk_disable_unprepare(hdmi->ref_clk);
 
+	drm_encoder_cleanup(&hdmi->encoder.encoder);
+
 	regulator_disable(hdmi->avdd_1v8);
 	regulator_disable(hdmi->avdd_0v9);
 }
-- 
2.25.1


             reply	other threads:[~2023-03-17  0:52 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-03-17  0:51 Toby Chen [this message]
2023-03-17  0:51 ` [PATCH] drm/rockchip: dw_hdmi: cleanup drm encoder during unbind Toby Chen
2023-03-22 23:24 ` Heiko Stuebner
2023-03-22 23:24   ` Heiko Stuebner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230317005126.496-1-tobyc@nvidia.com \
    --to=tobyc@nvidia.com \
    --cc=heiko@sntech.de \
    --cc=hjc@rock-chips.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.