On Tue, Oct 16, 2018 at 06:09:23PM +0200, Stefan Agner wrote: > This reverts commit 8e3b16e2117409625b89807de3912ff773aea354. > > Using the component framework requires all components to undo in > ->unbind what ->bind does. Unfortunately that particular commit > broke this rule. In particular, this is an issue if a single > component during probe fails. In that case, component_bind_all() > calls unbind on already succussfully bound components, and then > frees memory allocated using devm. If one of those components > registered e.g. an encoder with the framework then this leads to > use after free situations. > > Revert the commit to ensure that all components properly undo > what ->bind does. > > Link: https://www.mail-archive.com/dri-devel@xxxxxxxxxxxxxxxxxxxxx/msg233327.html > Suggested-by: Russell King <rmk+kernel@xxxxxxxxxxxxxxx> > Signed-off-by: Stefan Agner <stefan@xxxxxxxx> Adding Benjamin, who just made the same mistake I think (and I reviewed it ... oh well). -Daniel > --- > drivers/gpu/drm/imx/imx-drm-core.c | 4 ++-- > drivers/gpu/drm/imx/imx-ldb.c | 6 ++++++ > drivers/gpu/drm/imx/imx-tve.c | 3 +++ > drivers/gpu/drm/imx/parallel-display.c | 3 +++ > 4 files changed, 14 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c > index 5ea0c82f9957..caa6061a98ba 100644 > --- a/drivers/gpu/drm/imx/imx-drm-core.c > +++ b/drivers/gpu/drm/imx/imx-drm-core.c > @@ -305,11 +305,11 @@ static void imx_drm_unbind(struct device *dev) > > drm_fb_cma_fbdev_fini(drm); > > - drm_mode_config_cleanup(drm); > - > component_unbind_all(drm->dev, drm); > dev_set_drvdata(dev, NULL); > > + drm_mode_config_cleanup(drm); > + > drm_dev_put(drm); > } > > diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c > index 3bd0f8a18e74..592aabc4a262 100644 > --- a/drivers/gpu/drm/imx/imx-ldb.c > +++ b/drivers/gpu/drm/imx/imx-ldb.c > @@ -723,6 +723,12 @@ static void imx_ldb_unbind(struct device *dev, struct device *master, > if (channel->panel) > drm_panel_detach(channel->panel); > > + if (!channel->connector.funcs) > + continue; > + > + channel->connector.funcs->destroy(&channel->connector); > + channel->encoder.funcs->destroy(&channel->encoder); > + > kfree(channel->edid); > i2c_put_adapter(channel->ddc); > } > diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c > index cffd3310240e..8d6e89ce1edb 100644 > --- a/drivers/gpu/drm/imx/imx-tve.c > +++ b/drivers/gpu/drm/imx/imx-tve.c > @@ -673,6 +673,9 @@ static void imx_tve_unbind(struct device *dev, struct device *master, > { > struct imx_tve *tve = dev_get_drvdata(dev); > > + tve->connector.funcs->destroy(&tve->connector); > + tve->encoder.funcs->destroy(&tve->encoder); > + > if (!IS_ERR(tve->dac_reg)) > regulator_disable(tve->dac_reg); > } > diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c > index aefd04e18f93..6f11bffcde37 100644 > --- a/drivers/gpu/drm/imx/parallel-display.c > +++ b/drivers/gpu/drm/imx/parallel-display.c > @@ -258,6 +258,9 @@ static void imx_pd_unbind(struct device *dev, struct device *master, > if (imxpd->panel) > drm_panel_detach(imxpd->panel); > > + imxpd->encoder.funcs->destroy(&imxpd->encoder); > + imxpd->connector.funcs->destroy(&imxpd->connector); > + > kfree(imxpd->edid); > } > > -- > 2.19.1 > > _______________________________________________ > dri-devel mailing list > dri-devel@xxxxxxxxxxxxxxxxxxxxx > https://lists.freedesktop.org/mailman/listinfo/dri-devel -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/dri-devel
