On 16.10.2018 18:51, Lucas Stach wrote: > Am Dienstag, den 16.10.2018, 18:09 +0200 schrieb Stefan Agner: >> This reverts commit 8e3b16e2117409625b89807de3912ff773aea354. >> >> Using the component framework requires all components to undo in >> ->unbind what ->bind does. Unfortunately that particular commit >> broke this rule. In particular, this is an issue if a single >> component during probe fails. In that case, component_bind_all() >> calls unbind on already succussfully bound components, and then >> frees memory allocated using devm. If one of those components >> registered e.g. an encoder with the framework then this leads to >> use after free situations. >> >> Revert the commit to ensure that all components properly undo >> what ->bind does. > > I agree with this patch in general, but I think I remember why I > changed this in the first place: dw_hdmi_imx_unbind does not destroy > the encoder that has been registered in dw_hdmi_imx_bind. Good point, yeah that is missing. > > 8e3b16e21174 was an (apparently wrong) attempt to fix such issues once > and for all. By reverting this commit we go back to leaking the HDMI > encoder, so I think this patch should include a fix to destroy the > encoder on unbind. Makes sense, will add that to the same commit and send a v2. -- Stefan > > Regards, > Lucas > >> Link: https://www.mail-archive.com/dri-devel@xxxxxxxxxxxxxxxxxxxxx/msg233327.html >> > Suggested-by: Russell King <rmk+kernel@xxxxxxxxxxxxxxx> >> > Signed-off-by: Stefan Agner <stefan@xxxxxxxx> >> --- >> drivers/gpu/drm/imx/imx-drm-core.c | 4 ++-- >> drivers/gpu/drm/imx/imx-ldb.c | 6 ++++++ >> drivers/gpu/drm/imx/imx-tve.c | 3 +++ >> drivers/gpu/drm/imx/parallel-display.c | 3 +++ >> 4 files changed, 14 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c >> index 5ea0c82f9957..caa6061a98ba 100644 >> --- a/drivers/gpu/drm/imx/imx-drm-core.c >> +++ b/drivers/gpu/drm/imx/imx-drm-core.c >> @@ -305,11 +305,11 @@ static void imx_drm_unbind(struct device *dev) >> >> > drm_fb_cma_fbdev_fini(drm); >> >> > - drm_mode_config_cleanup(drm); >> - >> > component_unbind_all(drm->dev, drm); >> > dev_set_drvdata(dev, NULL); >> >> > + drm_mode_config_cleanup(drm); >> + >> > drm_dev_put(drm); >> } >> >> diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c >> index 3bd0f8a18e74..592aabc4a262 100644 >> --- a/drivers/gpu/drm/imx/imx-ldb.c >> +++ b/drivers/gpu/drm/imx/imx-ldb.c >> @@ -723,6 +723,12 @@ static void imx_ldb_unbind(struct device *dev, struct device *master, >> > if (channel->panel) >> > drm_panel_detach(channel->panel); >> >> > + if (!channel->connector.funcs) >> > + continue; >> + >> > + channel->connector.funcs->destroy(&channel->connector); >> > + channel->encoder.funcs->destroy(&channel->encoder); >> + >> > kfree(channel->edid); >> > i2c_put_adapter(channel->ddc); >> > } >> diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c >> index cffd3310240e..8d6e89ce1edb 100644 >> --- a/drivers/gpu/drm/imx/imx-tve.c >> +++ b/drivers/gpu/drm/imx/imx-tve.c >> @@ -673,6 +673,9 @@ static void imx_tve_unbind(struct device *dev, struct device *master, >> { >> > struct imx_tve *tve = dev_get_drvdata(dev); >> >> > + tve->connector.funcs->destroy(&tve->connector); >> > + tve->encoder.funcs->destroy(&tve->encoder); >> + >> > if (!IS_ERR(tve->dac_reg)) >> > regulator_disable(tve->dac_reg); >> } >> diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c >> index aefd04e18f93..6f11bffcde37 100644 >> --- a/drivers/gpu/drm/imx/parallel-display.c >> +++ b/drivers/gpu/drm/imx/parallel-display.c >> @@ -258,6 +258,9 @@ static void imx_pd_unbind(struct device *dev, struct device *master, >> > if (imxpd->panel) >> > drm_panel_detach(imxpd->panel); >> >> > + imxpd->encoder.funcs->destroy(&imxpd->encoder); >> > + imxpd->connector.funcs->destroy(&imxpd->connector); >> + >> > kfree(imxpd->edid); >> } >> _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/dri-devel
