Re: [PATCH] drm/vc4: hvs/v3d: Fix null dereference in unbind

[Gregor Herburger]

On Tue, Jul 21, 2026 at 09:28:51AM -0300, Maíra Canal wrote:
> Hi Gregor,
> 
> On 20/07/26 14:20, Gregor Herburger wrote:
> > The hvs and v3d drivers use dev_get_drvdata(master) in their unbind
> > functions. Since the vc4-drm gets removed before its dependent drivers
> > (vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to
> > get drvdata of its master and fails with a null dereference error.
> > 
> > Use the data pointer passed to the unbind functions directly instead of
> > dev_get_drvdata(master). This avoids using potentially freed memory.
> > 
> 
> Shouldn't this patch have a "Fixes:" tag?
Right, will send a v2 with Fixes tags. 
> 
> Best regards,
> - Maíra
> 
> > Signed-off-by: Gregor Herburger <gregor.herburger@xxxxxxxxxxxxx>
> > ---
> >   drivers/gpu/drm/vc4/vc4_hvs.c | 2 +-
> >   drivers/gpu/drm/vc4/vc4_v3d.c | 2 +-
> >   2 files changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
> > index 184d51ea3fa5..e715147d091c 100644
> > --- a/drivers/gpu/drm/vc4/vc4_hvs.c
> > +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
> > @@ -1752,7 +1752,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
> >   static void vc4_hvs_unbind(struct device *dev, struct device *master,
> >   			   void *data)
> >   {
> > -	struct drm_device *drm = dev_get_drvdata(master);
> > +	struct drm_device *drm = data;
> >   	struct vc4_dev *vc4 = to_vc4_dev(drm);
> >   	struct vc4_hvs *hvs = vc4->hvs;
> >   	struct drm_mm_node *node, *next;
> > diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c
> > index d31b906cb8e7..f32410420d3e 100644
> > --- a/drivers/gpu/drm/vc4/vc4_v3d.c
> > +++ b/drivers/gpu/drm/vc4/vc4_v3d.c
> > @@ -494,7 +494,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
> >   static void vc4_v3d_unbind(struct device *dev, struct device *master,
> >   			   void *data)
> >   {
> > -	struct drm_device *drm = dev_get_drvdata(master);
> > +	struct drm_device *drm = data;
> >   	struct vc4_dev *vc4 = to_vc4_dev(drm);
> >   	vc4_irq_uninstall(drm);
> > 
> > ---
> > base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb
> > change-id: 20260715-rpi-vc4-fix-d93513b05425
> > 
> > Best regards,
> > --
> > Gregor Herburger <gregor.herburger@xxxxxxxxxxxxx>
> > 
> 

-- 
Gregor Herburger
Linutronix GmbH | Bahnhofstrasse 3 | D-88690 Uhldingen-Mühlhofen
Phone: +49 7556 25 999 35; Fax.: +49 7556 25 999 99

Hinweise zum Datenschutz finden Sie hier (Informations on data privacy 
can be found here): https://linutronix.de/legal/data-protection.php

Linutronix GmbH | Firmensitz (Registered Office): Uhldingen-Mühlhofen | 
Registergericht (Registration Court): Amtsgericht Freiburg i.Br., HRB700 
806 | Geschäftsführer (Managing Directors): Dr. Wilfried Wessner, 
Katharina Kopp, Alexander Gieringer