Received: by 2002:a05:6a10:206:0:0:0:0 with SMTP id 6csp4649617pxj; Wed, 12 May 2021 10:03:24 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxOQv/isx2dZ4bo0IXkubsTK5IQx/Q1Jvng+JJfyrCJ/rXKqQwIM3OlnSVDZUsKAYs3ELYu X-Received: by 2002:a05:6402:20f:: with SMTP id t15mr44444518edv.370.1620839004623; Wed, 12 May 2021 10:03:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1620839004; cv=none; d=google.com; s=arc-20160816; b=xhoG16eRR0ruyst1gz8UleblQYXL3hH3hpxvbQn63JB6i/ZyZduN5Fqho1f4E1tQSq vHwR8tl5+R/43Jk+TbJqfPunw4wSbNZZ21PZmGW8pqQS7IxfjZwn44orW/CT5SrmQGkD SlM9rWz5WD+mRVivHQ1jZfme+yMldfu4nr9PxzTsiAvEQDp7tSuXOMPZYx8wjJeABieC FIILl0MNvfN+ZRwSxP8BQ6Xf7Q8H6geDlg/Euf5lUsj65dnVd08s1eKqnHzYfaZgi0PF j9cIWPy+svDUDRXzQJzjQoz2C492RKfOy3YZlqAy3BpcgmFinlrB6/naKbZg7/sl8Eus rjhg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=jRo6OBRsyZVYHuG/8XcC5YdwUR18yePYL4wB9GVNlbI=; b=TfkJGgWSoV13eazQxZ1NzAki4lfy/Jvpv/BizGSFBwNaqr8etZ6XvmW55ZhoL1L4Be N8L1jqa+fJmNUkMaaxDtn0tAGxRYDnSUtUDxl0afllFSuDeqF5Ihi7eRg017w8q0uC/8 pME981hqgrRSMAsXrmih5KZShBgs1/fV4iyvYsHs3ZzbV6OjszGWf9EEbcp4eC+cZbhn pv9sX2j1SW0dPRxD9FTbuGD4hcWnQcte0WDAf0s/9qPZzwGz+oEOYQPc/LAcmVbfOG7d 8jSPi8YjBJbBMrFDe3F47fAc/5xUBKVhvF7xT8CRFN88O6MRiW7aM1CtzD+ctEasMyAY BnWg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=akLgOfEW; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id o15si56777edc.604.2021.05.12.10.03.00; Wed, 12 May 2021 10:03:24 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=akLgOfEW; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343875AbhELQ76 (ORCPT + 99 others); Wed, 12 May 2021 12:59:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:35232 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237889AbhELP4s (ORCPT ); Wed, 12 May 2021 11:56:48 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id C613861461; Wed, 12 May 2021 15:28:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1620833326; bh=LQXZaWxdFrbx4iUlhxsh9hQfXSBcjHWTSy6hmOmnKfs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=akLgOfEW8wW5n09bINQtu7zcl0TL+etDklRhfpi7j2sraRA5cdhPs/jM14JZ7Fpl/ YyS7+MrdBP84wQPS380W5OLweIjqt9hyirMcavVqOdenJbDxEYqB0uo/fgj09i8GNE rgE4y8ifsVC2OVEy2rpXROtsAWElyEFXnHOm4d2Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrzej Hajda , Neil Armstrong , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Paul Cercueil , Laurent Pinchart Subject: [PATCH 5.11 070/601] drm: bridge/panel: Cleanup connector on bridge detach Date: Wed, 12 May 2021 16:42:27 +0200 Message-Id: <20210512144830.122578348@linuxfoundation.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210512144827.811958675@linuxfoundation.org> References: <20210512144827.811958675@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Paul Cercueil commit 4d906839d321c2efbf3fed4bc31ffd9ff55b75c0 upstream. If we don't call drm_connector_cleanup() manually in panel_bridge_detach(), the connector will be cleaned up with the other DRM objects in the call to drm_mode_config_cleanup(). However, since our drm_connector is devm-allocated, by the time drm_mode_config_cleanup() will be called, our connector will be long gone. Therefore, the connector must be cleaned up when the bridge is detached to avoid use-after-free conditions. v2: Cleanup connector only if it was created v3: Add FIXME v4: (Use connector->dev) directly in if() block Fixes: 13dfc0540a57 ("drm/bridge: Refactor out the panel wrapper from the lvds-encoder bridge.") Cc: # 4.12+ Cc: Andrzej Hajda Cc: Neil Armstrong Cc: Laurent Pinchart Cc: Jonas Karlman Cc: Jernej Skrabec Signed-off-by: Paul Cercueil Reviewed-by: Laurent Pinchart Link: https://patchwork.freedesktop.org/patch/msgid/20210327115742.18986-2-paul@crapouillou.net Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/bridge/panel.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) --- a/drivers/gpu/drm/bridge/panel.c +++ b/drivers/gpu/drm/bridge/panel.c @@ -87,6 +87,18 @@ static int panel_bridge_attach(struct dr static void panel_bridge_detach(struct drm_bridge *bridge) { + struct panel_bridge *panel_bridge = drm_bridge_to_panel_bridge(bridge); + struct drm_connector *connector = &panel_bridge->connector; + + /* + * Cleanup the connector if we know it was initialized. + * + * FIXME: This wouldn't be needed if the panel_bridge structure was + * allocated with drmm_kzalloc(). This might be tricky since the + * drm_device pointer can only be retrieved when the bridge is attached. + */ + if (connector->dev) + drm_connector_cleanup(connector); } static void panel_bridge_pre_enable(struct drm_bridge *bridge)