Am Montag, dem 02.11.2026 um 11:38 +0100 schrieb Christian Gmeiner: > From: Christian Gmeiner <[email protected]> > > flop_reset_data_ppu is only allocated on GPUs that need the PPU flop > reset. However, etnaviv_unbind(..) frees it unconditionally, and > etnaviv_cmdbuf_free(..) dereferences cmdbuf->suballoc before checking > whether cmdbuf is NULL. > > As a result, unloading the driver on GPUs that do not need the PPU > flop reset causes a NULL pointer dereference at address 0. > > Fixes: 85ba57ad88cf ("drm/etnaviv: Add PPU flop reset") > Cc: [email protected] > Signed-off-by: Christian Gmeiner <[email protected]>
Reviewed-by: Lucas Stach <[email protected]> > --- > drivers/gpu/drm/etnaviv/etnaviv_drv.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c > b/drivers/gpu/drm/etnaviv/etnaviv_drv.c > index 08aca9035fc1..ec1352c1b09f 100644 > --- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c > +++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c > @@ -601,8 +601,10 @@ static void etnaviv_unbind(struct device *dev) > > component_unbind_all(dev, drm); > > - etnaviv_cmdbuf_free(priv->flop_reset_data_ppu); > - kfree(priv->flop_reset_data_ppu); > + if (priv->flop_reset_data_ppu) { > + etnaviv_cmdbuf_free(priv->flop_reset_data_ppu); > + kfree(priv->flop_reset_data_ppu); > + } > > etnaviv_cmdbuf_suballoc_destroy(priv->cmdbuf_suballoc); > > > --- > base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4 > change-id: 20261102-etnaviv-unbind-flop-fix-5c77f75de45f > > Best regards,
