[PATCH] drm/vkms: clear config->dev when vkms_create() fails

[Yu Zhang]

vkms_create() stores the new device in config->dev right after
devm_drm_dev_alloc(), but the error path frees the device through
devres_release_group() and faux_device_destroy() without clearing the
pointer. The configfs "enabled" store returns the error without marking
the device as enabled, so the next "enabled" write runs
vkms_config_is_valid() again, which uses config->dev to print its
diagnostics and dereferences the freed drm_device.

Clear config->dev on the error path, as vkms_destroy() does.

Fixes: 13fc9b9745cc ("drm/vkms: Add and remove VKMS instances via configfs")
Signed-off-by: Yu Zhang <yuz08559@xxxxxxxxx>
---
 drivers/gpu/drm/vkms/vkms_drv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
index 5a640b5..ecc2e47 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.c
+++ b/drivers/gpu/drm/vkms/vkms_drv.c
@@ -215,6 +215,7 @@ int vkms_create(struct vkms_config *config)
 
 out_devres:
 	devres_release_group(&fdev->dev, NULL);
+	config->dev = NULL;
 out_unregister:
 	faux_device_destroy(fdev);
 	return ret;
-- 
2.43.0