]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/rockchip: dw_dp: Switch to drmm_kzalloc()
authorCristian Ciocaltea <cristian.ciocaltea@collabora.com>
Mon, 9 Mar 2026 22:44:30 +0000 (00:44 +0200)
committerHeiko Stuebner <heiko@sntech.de>
Thu, 26 Mar 2026 19:30:37 +0000 (20:30 +0100)
commited9da8d23020352ad24c528db09b5acdd78b81fd
tree897fc9f4bd21fa5523f123209dabe1fab5c3604f
parent3cc50e7f73fcf79f28660b9d91566b13cb62e520
drm/rockchip: dw_dp: Switch to drmm_kzalloc()

Driver makes use of drmm_encoder_init() to initialize the encoder and
automatically handle the cleanup by registering drm_encoder_cleanup()
with drmm_add_action().

However, the internal structure containing the encoder part gets
allocated with devm_kzalloc(), which happens while component_bind_all()
is being called from Rockchip DRM driver.  The component framework
further ensures it is deallocated as part of releasing all the resources
claimed during bind, which is triggered from component_unbind_all().

When the reference to the DRM device gets eventually dropped via
drm_dev_put() in rockchip_drm_unbind(), drmm_encoder_alloc_release()
attempts to access the now released encoder structure, leading to
use-after-free.

Ensure driver's internal structure is still reachable on encoder cleanup
by switching from a device-managed allocation to a drm-managed one.

Fixes: d68ba7bac955 ("drm/rockchip: Add RK3588 DPTX output support")
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patch.msgid.link/20260310-drm-rk-fixes-v2-2-645ecfb43f49@collabora.com
drivers/gpu/drm/rockchip/dw_dp-rockchip.c