[PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind

[PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind

[Gregor Herburger]

The hvs and v3d drivers use dev_get_drvdata(master) in their unbind
functions. Since the vc4-drm gets removed before its dependent drivers
(vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to
get drvdata of its master and fails with a null dereference error.

Use the data pointer passed to the unbind functions directly instead of
dev_get_drvdata(master). This avoids using potentially freed memory.

Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
---
 drivers/gpu/drm/vc4/vc4_hvs.c | 2 +-
 drivers/gpu/drm/vc4/vc4_v3d.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
index 184d51ea3fa5..e715147d091c 100644
--- a/drivers/gpu/drm/vc4/vc4_hvs.c
+++ b/drivers/gpu/drm/vc4/vc4_hvs.c
@@ -1752,7 +1752,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
 static void vc4_hvs_unbind(struct device *dev, struct device *master,
 			   void *data)
 {
-	struct drm_device *drm = dev_get_drvdata(master);
+	struct drm_device *drm = data;
 	struct vc4_dev *vc4 = to_vc4_dev(drm);
 	struct vc4_hvs *hvs = vc4->hvs;
 	struct drm_mm_node *node, *next;
diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c
index d31b906cb8e7..f32410420d3e 100644
--- a/drivers/gpu/drm/vc4/vc4_v3d.c
+++ b/drivers/gpu/drm/vc4/vc4_v3d.c
@@ -494,7 +494,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
 static void vc4_v3d_unbind(struct device *dev, struct device *master,
 			   void *data)
 {
-	struct drm_device *drm = dev_get_drvdata(master);
+	struct drm_device *drm = data;
 	struct vc4_dev *vc4 = to_vc4_dev(drm);
 
 	vc4_irq_uninstall(drm);

---
base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb
change-id: 20260715-rpi-vc4-fix-d93513b05425

Best regards,
--  
Gregor Herburger <gregor.herburger@linutronix.de>

Re: [PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] vc4_v3d_unbind() accesses hardware without resuming from runtime suspend, leading to system hangs.
- [High] Component bind callbacks improperly use devm_ APIs on the component device, causing memory leaks and dangling IRQ handlers.
--

--- Patch [1]: [PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind ---
commit 70be44b543f0237e5db3dfd6dff591c323b131ef
Author: Gregor Herburger <gregor.herburger@linutronix.de>

drm/vc4: hvs/v3d: Fix null dereference in unbind

The hvs and v3d drivers use dev_get_drvdata(master) in their unbind
functions. Since the vc4-drm gets removed before its dependent drivers
(vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to
get drvdata of its master and fails with a null dereference error.

> diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
> index 184d51ea3fa57..e715147d091ca 100644
> --- a/drivers/gpu/drm/vc4/vc4_hvs.c
> +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
> @@ -1752,7 +1752,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
>  static void vc4_hvs_unbind(struct device *dev, struct device *master,
>  			   void *data)
>  {
> -	struct drm_device *drm = dev_get_drvdata(master);
> +	struct drm_device *drm = data;

[Severity: High]
This is a pre-existing issue, but does vc4_hvs_bind() improperly use
devm_ APIs?

The component framework leaves the component device bound to its base driver
even when the aggregate DRM master unbinds. Since devm_ APIs are attached
to the component device (dev), they are only freed when the component device
is removed, not when it is unbound.

Specifically, devm_request_irq() in vc4_hvs_bind() leaves the IRQ handler
registered after unbind. Since vc4_hvs_unbind() nullifies vc4->hvs, will
a subsequent interrupt cause vc4_hvs_irq_handler() to dereference a NULL
pointer?

>  	struct vc4_dev *vc4 = to_vc4_dev(drm);
>  	struct vc4_hvs *hvs = vc4->hvs;
>  	struct drm_mm_node *node, *next;
> diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c
> index d31b906cb8e78..f32410420d3e4 100644
> --- a/drivers/gpu/drm/vc4/vc4_v3d.c
> +++ b/drivers/gpu/drm/vc4/vc4_v3d.c
> @@ -494,7 +494,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
>  static void vc4_v3d_unbind(struct device *dev, struct device *master,
>  			   void *data)
>  {
> -	struct drm_device *drm = dev_get_drvdata(master);
> +	struct drm_device *drm = data;

[Severity: High]
This is a pre-existing issue, but does vc4_v3d_bind() leak memory on unbind?

Since devm_ APIs attached to the component device (&pdev->dev) are only freed
when the component device is removed (not unbound), does the devm_kzalloc()
in vc4_v3d_bind() leak memory on every unbind/bind cycle?

>  	struct vc4_dev *vc4 = to_vc4_dev(drm);
>  
>  	vc4_irq_uninstall(drm);

[Severity: High]
This is a pre-existing issue, but can this code access hardware while it is
runtime suspended?

When the DRM driver is unbound, vc4_v3d_unbind() is called. The V3D hardware
may be in an autosuspended state because vc4_v3d_bind() enables runtime PM
autosuspend.

This calls vc4_irq_uninstall() (which accesses V3D_INTDIS and V3D_INTCTL)
and subsequently writes to V3D_BPOA and V3D_BPOS.

Will accessing these registers without a preceding pm_runtime_get_sync() to
wake the hardware cause an AXI bus timeout and system hang on ARM systems?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720-rpi-vc4-fix-v1-1-6073a96a5773@linutronix.de?part=1

Re: [PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind

[Maíra Canal]

Hi Gregor,

On 20/07/26 14:20, Gregor Herburger wrote:
> The hvs and v3d drivers use dev_get_drvdata(master) in their unbind
> functions. Since the vc4-drm gets removed before its dependent drivers
> (vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to
> get drvdata of its master and fails with a null dereference error.
> 
> Use the data pointer passed to the unbind functions directly instead of
> dev_get_drvdata(master). This avoids using potentially freed memory.
> 

Shouldn't this patch have a "Fixes:" tag?

Best regards,
- Maíra

> Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
> ---
>   drivers/gpu/drm/vc4/vc4_hvs.c | 2 +-
>   drivers/gpu/drm/vc4/vc4_v3d.c | 2 +-
>   2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
> index 184d51ea3fa5..e715147d091c 100644
> --- a/drivers/gpu/drm/vc4/vc4_hvs.c
> +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
> @@ -1752,7 +1752,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
>   static void vc4_hvs_unbind(struct device *dev, struct device *master,
>   			   void *data)
>   {
> -	struct drm_device *drm = dev_get_drvdata(master);
> +	struct drm_device *drm = data;
>   	struct vc4_dev *vc4 = to_vc4_dev(drm);
>   	struct vc4_hvs *hvs = vc4->hvs;
>   	struct drm_mm_node *node, *next;
> diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c
> index d31b906cb8e7..f32410420d3e 100644
> --- a/drivers/gpu/drm/vc4/vc4_v3d.c
> +++ b/drivers/gpu/drm/vc4/vc4_v3d.c
> @@ -494,7 +494,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
>   static void vc4_v3d_unbind(struct device *dev, struct device *master,
>   			   void *data)
>   {
> -	struct drm_device *drm = dev_get_drvdata(master);
> +	struct drm_device *drm = data;
>   	struct vc4_dev *vc4 = to_vc4_dev(drm);
>   
>   	vc4_irq_uninstall(drm);
> 
> ---
> base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb
> change-id: 20260715-rpi-vc4-fix-d93513b05425
> 
> Best regards,
> --
> Gregor Herburger <gregor.herburger@linutronix.de>
> 

Re: [PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind

[Gregor Herburger]

On Tue, Jul 21, 2026 at 09:28:51AM -0300, Maíra Canal wrote:
> Hi Gregor,
> 
> On 20/07/26 14:20, Gregor Herburger wrote:
> > The hvs and v3d drivers use dev_get_drvdata(master) in their unbind
> > functions. Since the vc4-drm gets removed before its dependent drivers
> > (vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to
> > get drvdata of its master and fails with a null dereference error.
> > 
> > Use the data pointer passed to the unbind functions directly instead of
> > dev_get_drvdata(master). This avoids using potentially freed memory.
> > 
> 
> Shouldn't this patch have a "Fixes:" tag?
Right, will send a v2 with Fixes tags. 
> 
> Best regards,
> - Maíra
> 
> > Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
> > ---
> >   drivers/gpu/drm/vc4/vc4_hvs.c | 2 +-
> >   drivers/gpu/drm/vc4/vc4_v3d.c | 2 +-
> >   2 files changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
> > index 184d51ea3fa5..e715147d091c 100644
> > --- a/drivers/gpu/drm/vc4/vc4_hvs.c
> > +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
> > @@ -1752,7 +1752,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
> >   static void vc4_hvs_unbind(struct device *dev, struct device *master,
> >   			   void *data)
> >   {
> > -	struct drm_device *drm = dev_get_drvdata(master);
> > +	struct drm_device *drm = data;
> >   	struct vc4_dev *vc4 = to_vc4_dev(drm);
> >   	struct vc4_hvs *hvs = vc4->hvs;
> >   	struct drm_mm_node *node, *next;
> > diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c
> > index d31b906cb8e7..f32410420d3e 100644
> > --- a/drivers/gpu/drm/vc4/vc4_v3d.c
> > +++ b/drivers/gpu/drm/vc4/vc4_v3d.c
> > @@ -494,7 +494,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
> >   static void vc4_v3d_unbind(struct device *dev, struct device *master,
> >   			   void *data)
> >   {
> > -	struct drm_device *drm = dev_get_drvdata(master);
> > +	struct drm_device *drm = data;
> >   	struct vc4_dev *vc4 = to_vc4_dev(drm);
> >   	vc4_irq_uninstall(drm);
> > 
> > ---
> > base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb
> > change-id: 20260715-rpi-vc4-fix-d93513b05425
> > 
> > Best regards,
> > --
> > Gregor Herburger <gregor.herburger@linutronix.de>
> > 
> 

-- 
Gregor Herburger
Linutronix GmbH | Bahnhofstrasse 3 | D-88690 Uhldingen-Mühlhofen
Phone: +49 7556 25 999 35; Fax.: +49 7556 25 999 99

Hinweise zum Datenschutz finden Sie hier (Informations on data privacy 
can be found here): https://linutronix.de/legal/data-protection.php

Linutronix GmbH | Firmensitz (Registered Office): Uhldingen-Mühlhofen | 
Registergericht (Registration Court): Amtsgericht Freiburg i.Br., HRB700 
806 | Geschäftsführer (Managing Directors): Dr. Wilfried Wessner, 
Katharina Kopp, Alexander Gieringer