mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 12:13:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

drm/amd/display: Fix more KUnit connector use-after-free bugs

Browse Source 
drmm_connector_init() and drmm_encoder_init() register their cleanup
(drm_connector_cleanup() / drm_encoder_cleanup()) as DRM-managed actions
tied to the drm_device lifetime. When the object memory is owned by
KUnit, it is freed before that action runs, so the cleanup touches freed
memory. Allocate these objects with drmm_kzalloc() so their lifetime
matches the cleanup action.

Signed-off-by: Alex Hung <alex.hung@amd.com>
Assisted-by: Copilot:Claude-Opus-4.8
Acked-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Alex Hung
2026-07-24 13:12:39 -06:00
committed by Alex Deucher
parent ef45aaf737
commit 1cdb23735d
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/gpu/drm/amd/display/amdgpu_dm/tests/amdgpu_dm_connector_test.c
View File

@@ -3763,7 +3763,7 @@ static struct dm_test_stream_ctx *dm_test_stream_ctx_alloc(struct kunit *test)
DRIVER_MODESET);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx->drm);
ctx->aconnector = kunit_kzalloc(test, sizeof(*ctx->aconnector), GFP_KERNEL);
ctx->aconnector = drmm_kzalloc(ctx->drm, sizeof(*ctx->aconnector), GFP_KERNEL);
KUNIT_ASSERT_NOT_NULL(test, ctx->aconnector);
KUNIT_ASSERT_EQ(test,
drmm_connector_init(ctx->drm, &ctx->aconnector->base,
@@ -4026,7 +4026,7 @@ static void dm_test_poll_dac_load_returns_cached(struct kunit *test)
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, drm);
adev = drm_to_adev(drm);
aconnector = kunit_kzalloc(test, sizeof(*aconnector), GFP_KERNEL);
aconnector = drmm_kzalloc(drm, sizeof(*aconnector), GFP_KERNEL);
KUNIT_ASSERT_NOT_NULL(test, aconnector);
KUNIT_ASSERT_EQ(test,
drmm_connector_init(drm, &aconnector->base,
@@ -4073,7 +4073,7 @@ static struct amdgpu_dm_connector *dm_test_reg_connector(struct kunit *test)
DRIVER_MODESET);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, drm);
aconnector = kunit_kzalloc(test, sizeof(*aconnector), GFP_KERNEL);
aconnector = drmm_kzalloc(drm, sizeof(*aconnector), GFP_KERNEL);
KUNIT_ASSERT_NOT_NULL(test, aconnector);
KUNIT_ASSERT_EQ(test,
drmm_connector_init(drm, &aconnector->base,
@@ -4528,7 +4528,7 @@ dm_test_modes_ctx_alloc(struct kunit *test, int connector_type)
ctx->drm = dm_test_alloc_drm(test);
ctx->aconnector = dm_test_add_connector(test, ctx->drm, connector_type);
ctx->aenc = kunit_kzalloc(test, sizeof(*ctx->aenc), GFP_KERNEL);
ctx->aenc = drmm_kzalloc(ctx->drm, sizeof(*ctx->aenc), GFP_KERNEL);
KUNIT_ASSERT_NOT_NULL(test, ctx->aenc);
KUNIT_ASSERT_EQ(test,
drmm_encoder_init(ctx->drm, &ctx->aenc->base, NULL,