Commit 926d002e authored by Johan Hovold's avatar Johan Hovold Committed by Chun-Kuang Hu
Browse files

drm/mediatek: Fix device use-after-free on unbind 



A recent change fixed device reference leaks when looking up drm
platform device driver data during bind() but failed to remove a partial
fix which had been added by commit 80805b62 ("drm/mediatek: Fix
kobject put for component sub-drivers").

This results in a reference imbalance on component bind() failures and
on unbind() which could lead to a user-after-free.

Make sure to only drop the references after retrieving the driver data
by effectively reverting the previous partial fix.

Note that holding a reference to a device does not prevent its driver
data from going away so there is no point in keeping the reference.

Fixes: 1f403699 ("drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv")
Reported-by: default avatarSjoerd Simons <sjoerd@collabora.com>
Closes: https://lore.kernel.org/r/20251003-mtk-drm-refcount-v1-1-3b3f2813b0db@collabora.com


Cc: stable@vger.kernel.org
Cc: Ma Ke <make24@iscas.ac.cn>
Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Reviewed-by: default avatarAngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: default avatarSjoerd Simons <sjoerd@collabora.com>
Tested-by: default avatarSjoerd Simons <sjoerd@collabora.com>
Tested-by: default avatarRitesh Raj Sarraf <ritesh.sarraf@collabora.com>
Reviewed-by: default avatarCK Hu <ck.hu@mediatek.com>
Link: https://patchwork.kernel.org/project/dri-devel/patch/20251006093937.27869-1-johan@kernel.org/


Signed-off-by: default avatarChun-Kuang Hu <chunkuang.hu@kernel.org>
parent 3a866087

drivers/gpu/drm/mediatek/mtk_drm_drv.c

+0 −10
Original line number Diff line number Diff line
@@ -686,10 +686,6 @@ static int mtk_drm_bind(struct device *dev) 
	for (i = 0; i < private->data->mmsys_dev_num; i++)

		private->all_drm_private[i]->drm = NULL;

err_put_dev:

	for (i = 0; i < private->data->mmsys_dev_num; i++) {

		/* For device_find_child in mtk_drm_get_all_priv() */

		put_device(private->all_drm_private[i]->dev);

	}

	put_device(private->mutex_dev);

	return ret;

}
@@ -697,18 +693,12 @@ static int mtk_drm_bind(struct device *dev) 
static void mtk_drm_unbind(struct device *dev)

{

	struct mtk_drm_private *private = dev_get_drvdata(dev);

	int i;



	/* for multi mmsys dev, unregister drm dev in mmsys master */

	if (private->drm_master) {

		drm_dev_unregister(private->drm);

		mtk_drm_kms_deinit(private->drm);

		drm_dev_put(private->drm);



		for (i = 0; i < private->data->mmsys_dev_num; i++) {

			/* For device_find_child in mtk_drm_get_all_priv() */

			put_device(private->all_drm_private[i]->dev);

		}

		put_device(private->mutex_dev);

	}

	private->mtk_drm_bound = false;