LF-1256-3 drm/imx: dpu: crtc: Allocate dpu_crtc in ->probe() instead of ->bind()

The structure dpu_crtc essentially contains drm crtc.  If we allocate
the instance of the structure dpu_crtc with devm_kzalloc() in ->bind(),
it would be freed in case anything in dpu_crtc_init() fails after the
call for drm_crtc_init_with_planes().  However, drm_crtc_init_with_planes()
may have already added the crtc into the crtc_list.  The function
drm_mode_config_cleanup() called in imx_drm_bind() as a part of it's
bailout logic would walk through the list to try to cleanup the crtc,
which would cause the use-after-free issue.  This patch changes the
dpu_crtc allocation from ->bind() to ->probe() to fix the issue.  And,
with this change, ->unbind() doesn't need to cleanup the crtc anymore,
since it can be done by the imx-drm core driver.

Reviewed-by: Sandor Yu <Sandor.yu@nxp.com>
Signed-off-by: Liu Ying <victor.liu@nxp.com>

0 files changed, 0 insertions, 0 deletions