diff options
| author | Katya Orlova <e.orlova@ispras.ru> | 2024-02-16 13:50:40 +0100 |
|---|---|---|
| committer | Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com> | 2024-07-15 10:22:30 +0200 |
| commit | 19dd9780b7ac673be95bf6fd6892a184c9db611f (patch) | |
| tree | bbe5b66ca919068f60e26c7fc2bad454e43e4b24 /drivers/gpu/drm/stm/drv.c | |
| parent | drm/stm: ltdc: check memory returned by devm_kzalloc() (diff) | |
| download | linux-19dd9780b7ac673be95bf6fd6892a184c9db611f.tar.xz linux-19dd9780b7ac673be95bf6fd6892a184c9db611f.zip | |
drm/stm: Avoid use-after-free issues with crtc and plane
ltdc_load() calls functions drm_crtc_init_with_planes(),
drm_universal_plane_init() and drm_encoder_init(). These functions
should not be called with parameters allocated with devm_kzalloc()
to avoid use-after-free issues [1].
Use allocations managed by the DRM framework.
Found by Linux Verification Center (linuxtesting.org).
[1]
https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/
Signed-off-by: Katya Orlova <e.orlova@ispras.ru>
Acked-by: Raphaël Gallais-Pou <raphael.gallais-pou@foss.st.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240216125040.8968-1-e.orlova@ispras.ru
Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
Diffstat (limited to 'drivers/gpu/drm/stm/drv.c')
| -rw-r--r-- | drivers/gpu/drm/stm/drv.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/stm/drv.c b/drivers/gpu/drm/stm/drv.c index 4d2db079ad4f..e1232f74dfa5 100644 --- a/drivers/gpu/drm/stm/drv.c +++ b/drivers/gpu/drm/stm/drv.c @@ -25,6 +25,7 @@ #include <drm/drm_module.h> #include <drm/drm_probe_helper.h> #include <drm/drm_vblank.h> +#include <drm/drm_managed.h> #include "ltdc.h" @@ -75,7 +76,7 @@ static int drv_load(struct drm_device *ddev) DRM_DEBUG("%s\n", __func__); - ldev = devm_kzalloc(ddev->dev, sizeof(*ldev), GFP_KERNEL); + ldev = drmm_kzalloc(ddev, sizeof(*ldev), GFP_KERNEL); if (!ldev) return -ENOMEM; |