]> git.baikalelectronics.ru Git - kernel.git/commit
drm/tidss: fix crash related to accessing freed memory
authorTomi Valkeinen <tomi.valkeinen@ti.com>
Wed, 15 Apr 2020 09:20:06 +0000 (12:20 +0300)
committerTomi Valkeinen <tomi.valkeinen@ti.com>
Mon, 20 Apr 2020 07:07:35 +0000 (10:07 +0300)
commit29227947b271125dd5707ecaeaddf185b9b76628
tree38fb5b37c3075b238e00bf387fe9c20dbecb0b88
parentbd74be43d1bd00cea13eb531fe5c708d10e82a7e
drm/tidss: fix crash related to accessing freed memory

tidss uses devm_kzalloc to allocate DRM plane, encoder and crtc objects.
This is not correct as the lifetime of those objects should be longer
than the underlying device's.

When unloading tidss module, the devm_kzalloc'ed objects have already
been freed when tidss_release() is called, and the driver will accesses
freed memory possibly causing a crash, a kernel WARN, or other undefined
behavior, and also KASAN will give a bug.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200415092006.26675-1-tomi.valkeinen@ti.com
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
drivers/gpu/drm/tidss/tidss_crtc.c
drivers/gpu/drm/tidss/tidss_encoder.c
drivers/gpu/drm/tidss/tidss_plane.c