drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()

vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to
obtain a struct vidi_context pointer. However, drm_dev->dev is the
exynos-drm master device, and the driver_data contained therein is not
the vidi component device, but a completely different device.

This can lead to various bugs, ranging from null pointer dereferences and
garbage value accesses to, in unlucky cases, out-of-bounds errors,
use-after-free errors, and more.

To resolve this issue, we need to store/delete the vidi device pointer in
exynos_drm_private->vidi_dev during bind/unbind, and then read this
exynos_drm_private->vidi_dev within ioctl() to obtain the correct
struct vidi_context pointer.

Cc: <stable@vger.kernel.org>
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index 23646e55f142c32b865004d9363b5e8b4b4f8f7e..06c29ff2aac0e168ca210a8ccec37c0e7f0e55b1 100644 (file)
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -199,6 +199,7 @@ struct drm_exynos_file_private {
 struct exynos_drm_private {
        struct device *g2d_dev;
        struct device *dma_dev;
+       struct device *vidi_dev;
        void *mapping;
 
        /* for atomic commit */

diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 64c69dd2966ec92d94f929c817694dc9c84840c6..480c99a8f9f7575af760bf2bd7955c21adaf218a 100644 (file)
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -224,9 +224,14 @@ ATTRIBUTE_GROUPS(vidi);
 int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
                                struct drm_file *file_priv)
 {
-       struct vidi_context *ctx = dev_get_drvdata(drm_dev->dev);
+       struct exynos_drm_private *priv = drm_dev->dev_private;
+       struct device *dev = priv ? priv->vidi_dev : NULL;
+       struct vidi_context *ctx = dev ? dev_get_drvdata(dev) : NULL;
        struct drm_exynos_vidi_connection *vidi = data;
 
+       if (!ctx)
+               return -ENODEV;
+
        if (!vidi) {
                DRM_DEV_DEBUG_KMS(ctx->dev,
                                  "user data for vidi is null.\n");
@@ -372,6 +377,7 @@ static int vidi_bind(struct device *dev, struct device *master, void *data)
 {
        struct vidi_context *ctx = dev_get_drvdata(dev);
        struct drm_device *drm_dev = data;
+       struct exynos_drm_private *priv = drm_dev->dev_private;
        struct drm_encoder *encoder = &ctx->encoder;
        struct exynos_drm_plane *exynos_plane;
        struct exynos_drm_plane_config plane_config = { 0 };
@@ -379,6 +385,8 @@ static int vidi_bind(struct device *dev, struct device *master, void *data)
        int ret;
 
        ctx->drm_dev = drm_dev;
+       if (priv)
+               priv->vidi_dev = dev;
 
        plane_config.pixel_formats = formats;
        plane_config.num_pixel_formats = ARRAY_SIZE(formats);
@@ -424,8 +432,12 @@ static int vidi_bind(struct device *dev, struct device *master, void *data)
 static void vidi_unbind(struct device *dev, struct device *master, void *data)
 {
        struct vidi_context *ctx = dev_get_drvdata(dev);
+       struct drm_device *drm_dev = data;
+       struct exynos_drm_private *priv = drm_dev->dev_private;
 
        timer_delete_sync(&ctx->timer);
+       if (priv)
+               priv->vidi_dev = NULL;
 }
 
 static const struct component_ops vidi_component_ops = {