Commit ef545484 authored by Simona Vetter's avatar Simona Vetter
Browse files

Merge tag 'mediatek-drm-fixes-20251028' of... 

Merge tag 'mediatek-drm-fixes-20251028' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux

 into drm-fixes

Mediatek DRM Fixes - 20251028

1. Fix device use-after-free on unbind

Signed-off-by: default avatarSimona Vetter <simona.vetter@ffwll.ch>
From: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Link: https://patch.msgid.link/20251028151548.3944-1-chunkuang.hu@kernel.org
parents dcb6fa37 926d002e

drivers/gpu/drm/mediatek/mtk_drm_drv.c

+0 −10
Original line number Diff line number Diff line
@@ -686,10 +686,6 @@ static int mtk_drm_bind(struct device *dev) 
	for (i = 0; i < private->data->mmsys_dev_num; i++)

		private->all_drm_private[i]->drm = NULL;

err_put_dev:

	for (i = 0; i < private->data->mmsys_dev_num; i++) {

		/* For device_find_child in mtk_drm_get_all_priv() */

		put_device(private->all_drm_private[i]->dev);

	}

	put_device(private->mutex_dev);

	return ret;

}
@@ -697,18 +693,12 @@ static int mtk_drm_bind(struct device *dev) 
static void mtk_drm_unbind(struct device *dev)

{

	struct mtk_drm_private *private = dev_get_drvdata(dev);

	int i;



	/* for multi mmsys dev, unregister drm dev in mmsys master */

	if (private->drm_master) {

		drm_dev_unregister(private->drm);

		mtk_drm_kms_deinit(private->drm);

		drm_dev_put(private->drm);



		for (i = 0; i < private->data->mmsys_dev_num; i++) {

			/* For device_find_child in mtk_drm_get_all_priv() */

			put_device(private->all_drm_private[i]->dev);

		}

		put_device(private->mutex_dev);

	}

	private->mtk_drm_bound = false;