From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DA95CEFCD9F for ; Mon, 9 Mar 2026 22:44:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Cc:To:In-Reply-To:References :Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=ulCqZJ2F1BtpCMWjJ6Yl76Pff0fD9orco/4tOsO3/q4=; b=0O0V87/v5XJplVKRuqoS3jWeHc if/j/0ce3tBofYhhxtl5Hnh6rKs0eA7H4FgjGhkZ33u5E5rPWYhuVa/ZDDkCOtT4cEfGIVUF4jxwr bbVLJ9KQeTtr8RDmF8X6ADAh+VeWC/E8IRGQ/yGW8pR8ePrCTV3RqHAh5m7rTr4EfS7Mnpke4JT8t 3y5ytm6DvHCb8ddqiVLI71rSrHlAUj7sg9LlBsB6HFt/UqftqZ1GM2jWF7JWMRhUr3zrMGD1EopcS FmqPmr4ym0chHCuanLgLJSh7qmxXILqk8OtKj/3xfmlBuUnxrtt2wyQMbagYT5eqm6SvxAepesZ+S GQnRE0Rg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux)) id 1vzjLB-00000008F5S-1RTA; Mon, 09 Mar 2026 22:44:45 +0000 Received: from bali.collaboradmins.com ([2a01:4f8:201:9162::2]) by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux)) id 1vzjL6-00000008Ez4-0Vae; Mon, 09 Mar 2026 22:44:41 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1773096276; bh=rYpWUQ3mqz6uob7ZfihmWRD74dfEUvjuf4DnktKdAMg=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=aunrSO1MagiS8C5tdB6lao0fJGtJOnXf+tTwv/et9GTZoYycDr8PMTsWq0kD1VA7l OvywJCKo9oa6KL9wHuxLc+VOFQ0zCMakhXHHkubEqmQ/pb6p44XGywsK1iAnKAmZjI Ye3+RBr5S0S48Fzb+JnWIkLF0lsByfB7n/bj54ksU/Eh3q75TQqWLBYW9zeFVxrHaE 82/lL9PaWjBy9opQOeiazGpttp7lz+hD1c1vdwEq11Iz9c1eJBhBaRbfAfBZwDbnzX FieQ8r6tBTMwWfmEcGfBXhui/GWC4nYeVmjyc2CDtRl4GdFNK4NJ3M+33s63Adyuss Oh7t3d3cY8IIg== Received: from localhost (unknown [86.123.23.225]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: cristicc) by bali.collaboradmins.com (Postfix) with ESMTPSA id C29A217E048B; Mon, 9 Mar 2026 23:44:36 +0100 (CET) From: Cristian Ciocaltea Date: Tue, 10 Mar 2026 00:44:30 +0200 Subject: [PATCH v2 2/8] drm/rockchip: dw_dp: Switch to drmm_kzalloc() MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260310-drm-rk-fixes-v2-2-645ecfb43f49@collabora.com> References: <20260310-drm-rk-fixes-v2-0-645ecfb43f49@collabora.com> In-Reply-To: <20260310-drm-rk-fixes-v2-0-645ecfb43f49@collabora.com> To: Sandy Huang , =?utf-8?q?Heiko_St=C3=BCbner?= , Andy Yan , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dmitry Baryshkov , Dmitry Baryshkov , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec Cc: kernel@collabora.com, dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-rockchip@lists.infradead.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.14.3 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260309_154440_318418_A32BF4EB X-CRM114-Status: GOOD ( 12.84 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Driver makes use of drmm_encoder_init() to initialize the encoder and automatically handle the cleanup by registering drm_encoder_cleanup() with drmm_add_action(). However, the internal structure containing the encoder part gets allocated with devm_kzalloc(), which happens while component_bind_all() is being called from Rockchip DRM driver. The component framework further ensures it is deallocated as part of releasing all the resources claimed during bind, which is triggered from component_unbind_all(). When the reference to the DRM device gets eventually dropped via drm_dev_put() in rockchip_drm_unbind(), drmm_encoder_alloc_release() attempts to access the now released encoder structure, leading to use-after-free. Ensure driver's internal structure is still reachable on encoder cleanup by switching from a device-managed allocation to a drm-managed one. Fixes: d68ba7bac955 ("drm/rockchip: Add RK3588 DPTX output support") Signed-off-by: Cristian Ciocaltea --- drivers/gpu/drm/rockchip/dw_dp-rockchip.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c index dac3d202971e..532af476d250 100644 --- a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c +++ b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include @@ -82,7 +83,7 @@ static int dw_dp_rockchip_bind(struct device *dev, struct device *master, void * struct drm_connector *connector; int ret; - dp = devm_kzalloc(dev, sizeof(*dp), GFP_KERNEL); + dp = drmm_kzalloc(drm_dev, sizeof(*dp), GFP_KERNEL); if (!dp) return -ENOMEM; -- 2.52.0