[SRU][J][PATCH 1/1] drm: zynqmp_kms: Unplug DRM device before removal

Alice C. Munduruca alice.munduruca at canonical.com
Mon Nov 17 19:41:27 UTC 2025


From: Sean Anderson <sean.anderson at linux.dev>

Prevent userspace accesses to the DRM device from causing
use-after-frees by unplugging the device before we remove it. This
causes any further userspace accesses to result in an error without
further calls into this driver's internals.

Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem")
Closes: https://lore.kernel.org/dri-devel/4d8f4c9b-2efb-4774-9a37-2f257f79b2c9@linux.dev/
Signed-off-by: Sean Anderson <sean.anderson at linux.dev>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen at ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240809193600.3360015-2-sean.anderson@linux.dev
(backported from commit 2e07c88914fc5289c21820b1aa94f058feb38197)
[cremfuelled: the jammy tree doesn't contain the commit where
 `zynqmp_dpsub_drm_cleanup` was moved to the file `zynqmp_kms.c`]
CVE-2024-56538
Signed-off-by: Alice C. Munduruca <alice.munduruca at canonical.com>
---
 drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
index 78b7dd210d89..a5c11b8df5cd 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
@@ -252,7 +252,7 @@ static int zynqmp_dpsub_remove(struct platform_device *pdev)
 	struct zynqmp_dpsub *dpsub = platform_get_drvdata(pdev);
 	struct drm_device *drm = &dpsub->drm;
 
-	drm_dev_unregister(drm);
+	drm_dev_unplug(drm);
 	drm_atomic_helper_shutdown(drm);
 	drm_kms_helper_poll_fini(drm);
 
-- 
2.51.0




More information about the kernel-team mailing list