Unverified Commit b83c30ac authored Sep 02, 2025 by Maxime Ripard

drm/tidss: crtc: Cleanup reset implementation



The tidss_crtc_reset() function will (rightfully) destroy any
pre-existing state.

However, the tidss CRTC driver has its own CRTC state structure that
subclasses drm_crtc_state, and yet will destroy the previous state
by calling __drm_atomic_helper_crtc_destroy_state() and kfree() on its
drm_crtc_state pointer.

It works only because the drm_crtc_state is the first field in the
structure, and thus its offset is 0. It's incredibly fragile however, so
let's call our destroy implementation in such a case to deal with it
properly.

Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://lore.kernel.org/r/20250902-drm-state-readout-v1-22-14ad5315da3f@kernel.org


Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250902-drm-state-readout-v1-22-14ad5315da3f@kernel.org

parent ec1049f6

drivers/gpu/drm/tidss/tidss_crtc.c

+1 −3

Original line number	Diff line number	Diff line
		@@ -357,9 +357,7 @@ static void tidss_crtc_reset(struct drm_crtc *crtc)
		struct tidss_crtc_state *tstate;

		if (crtc->state)
		__drm_atomic_helper_crtc_destroy_state(crtc->state);

		kfree(crtc->state);
		tidss_crtc_destroy_state(crtc, crtc->state);

		tstate = kzalloc(sizeof(*tstate), GFP_KERNEL);
		if (!tstate) {