]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
authorJeongjun Park <aha310510@gmail.com>
Mon, 19 Jan 2026 08:25:51 +0000 (17:25 +0900)
committerInki Dae <inki.dae@samsung.com>
Sun, 1 Feb 2026 14:27:56 +0000 (23:27 +0900)
commitd3968a0d85b211e197f2f4f06268a7031079e0d0
treea16d393ab59918a9ae370beb2702292d7db501b4
parent502d2d8e01c8930afd42363d543ed11298cbe34a
drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()

vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to
obtain a struct vidi_context pointer. However, drm_dev->dev is the
exynos-drm master device, and the driver_data contained therein is not
the vidi component device, but a completely different device.

This can lead to various bugs, ranging from null pointer dereferences and
garbage value accesses to, in unlucky cases, out-of-bounds errors,
use-after-free errors, and more.

To resolve this issue, we need to store/delete the vidi device pointer in
exynos_drm_private->vidi_dev during bind/unbind, and then read this
exynos_drm_private->vidi_dev within ioctl() to obtain the correct
struct vidi_context pointer.

Cc: <stable@vger.kernel.org>
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
drivers/gpu/drm/exynos/exynos_drm_drv.h
drivers/gpu/drm/exynos/exynos_drm_vidi.c