Unverified Commit a950c2ed authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12879 drm/stm: Avoid use-after-free issues with crtc and plane 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhang Kunbo <zhangkunbo@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/GEI2SBHCPBIKDY4ZVHUFRUY3I77ZQFZV/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYRAF 
 
Link:https://gitee.com/openeuler/kernel/pulls/12879

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents d4ea89d4 301f56a1

drivers/gpu/drm/stm/drv.c

+2 −1
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ 
#include <drm/drm_gem_framebuffer_helper.h>

#include <drm/drm_probe_helper.h>

#include <drm/drm_vblank.h>

#include <drm/drm_managed.h>



#include "ltdc.h"
@@ -73,7 +74,7 @@ static int drv_load(struct drm_device *ddev) 


	DRM_DEBUG("%s\n", __func__);



	ldev = devm_kzalloc(ddev->dev, sizeof(*ldev), GFP_KERNEL);

	ldev = drmm_kzalloc(ddev, sizeof(*ldev), GFP_KERNEL);

	if (!ldev)

		return -ENOMEM;

drivers/gpu/drm/stm/ltdc.c

+4 −4
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ 
#include <drm/drm_plane_helper.h>

#include <drm/drm_probe_helper.h>

#include <drm/drm_vblank.h>

#include <drm/drm_managed.h>



#include <video/videomode.h>
@@ -956,7 +957,6 @@ static struct drm_plane *ltdc_plane_create(struct drm_device *ddev, 
{

	unsigned long possible_crtcs = CRTC_MASK;

	struct ltdc_device *ldev = ddev->dev_private;

	struct device *dev = ddev->dev;

	struct drm_plane *plane;

	unsigned int i, nb_fmt = 0;

	u32 formats[NB_PF * 2];
@@ -984,7 +984,7 @@ static struct drm_plane *ltdc_plane_create(struct drm_device *ddev, 
		formats[nb_fmt++] = drm_fmt_no_alpha;

	}



	plane = devm_kzalloc(dev, sizeof(*plane), GFP_KERNEL);

	plane = drmm_kzalloc(ddev, sizeof(*plane), GFP_KERNEL);

	if (!plane)

		return NULL;
@@ -1115,7 +1115,7 @@ static int ltdc_encoder_init(struct drm_device *ddev, struct drm_bridge *bridge) 
	struct drm_encoder *encoder;

	int ret;



	encoder = devm_kzalloc(ddev->dev, sizeof(*encoder), GFP_KERNEL);

	encoder = drmm_kzalloc(ddev, sizeof(*encoder), GFP_KERNEL);

	if (!encoder)

		return -ENOMEM;
@@ -1327,7 +1327,7 @@ int ltdc_load(struct drm_device *ddev) 


	}



	crtc = devm_kzalloc(dev, sizeof(*crtc), GFP_KERNEL);

	crtc = drmm_kzalloc(ddev, sizeof(*crtc), GFP_KERNEL);

	if (!crtc) {

		DRM_ERROR("Failed to allocate crtc\n");

		ret = -ENOMEM;