Re: [PATCH] drm/etnaviv: Fix NULL dereference on unbind without PPU flop reset

[Lucas Stach]

Am Montag, dem 02.11.2026 um 11:38 +0100 schrieb Christian Gmeiner:
> From: Christian Gmeiner <cgmeiner@xxxxxxxxxx>
> 
> flop_reset_data_ppu is only allocated on GPUs that need the PPU flop
> reset. However, etnaviv_unbind(..) frees it unconditionally, and
> etnaviv_cmdbuf_free(..) dereferences cmdbuf->suballoc before checking
> whether cmdbuf is NULL.
> 
> As a result, unloading the driver on GPUs that do not need the PPU
> flop reset causes a NULL pointer dereference at address 0.
> 
> Fixes: 85ba57ad88cf ("drm/etnaviv: Add PPU flop reset")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Christian Gmeiner <cgmeiner@xxxxxxxxxx>

Reviewed-by: Lucas Stach <l.stach@xxxxxxxxxxxxxx>

> ---
>  drivers/gpu/drm/etnaviv/etnaviv_drv.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
> index 08aca9035fc1..ec1352c1b09f 100644
> --- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c
> +++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
> @@ -601,8 +601,10 @@ static void etnaviv_unbind(struct device *dev)
>  
>  	component_unbind_all(dev, drm);
>  
> -	etnaviv_cmdbuf_free(priv->flop_reset_data_ppu);
> -	kfree(priv->flop_reset_data_ppu);
> +	if (priv->flop_reset_data_ppu) {
> +		etnaviv_cmdbuf_free(priv->flop_reset_data_ppu);
> +		kfree(priv->flop_reset_data_ppu);
> +	}
>  
>  	etnaviv_cmdbuf_suballoc_destroy(priv->cmdbuf_suballoc);
>  
> 
> ---
> base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
> change-id: 20261102-etnaviv-unbind-flop-fix-5c77f75de45f
> 
> Best regards,