[PATCH 1/3] drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()

[Jeongjun Park]

vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to
obtain a struct vidi_context pointer. However, drm_dev->dev is the
exynos-drm master device, and the driver_data contained therein is not
the vidi component device, but a completely different device.

This can lead to various bugs, ranging from null pointer dereferences and
garbage value accesses to, in unlucky cases, out-of-bounds errors,
use-after-free errors, and more.

To resolve this issue, we need to store/delete the vidi device pointer in
exynos_drm_private->vidi_dev during bind/unbind, and then read this
exynos_drm_private->vidi_dev within ioctl() to obtain the correct
struct vidi_context pointer.

Cc: <sta...@vger.kernel.org>
Signed-off-by: Jeongjun Park <aha310...@gmail.com>
---
 drivers/gpu/drm/exynos/exynos_drm_drv.h  |  1 +
 drivers/gpu/drm/exynos/exynos_drm_vidi.c | 14 +++++++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h 
b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index 23646e55f142..06c29ff2aac0 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -199,6 +199,7 @@ struct drm_exynos_file_private {
 struct exynos_drm_private {
        struct device *g2d_dev;
        struct device *dma_dev;
+       struct device *vidi_dev;
        void *mapping;
 
        /* for atomic commit */
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c 
b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index e094b8bbc0f1..1fe297d512e7 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -223,9 +223,14 @@ ATTRIBUTE_GROUPS(vidi);
 int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
                                struct drm_file *file_priv)
 {
-       struct vidi_context *ctx = dev_get_drvdata(drm_dev->dev);
+       struct exynos_drm_private *priv = drm_dev->dev_private;
+       struct device *dev = priv ? priv->vidi_dev : NULL;
+       struct vidi_context *ctx = dev ? dev_get_drvdata(dev) : NULL;
        struct drm_exynos_vidi_connection *vidi = data;
 
+       if (!ctx)
+               return -ENODEV;
+
        if (!vidi) {
                DRM_DEV_DEBUG_KMS(ctx->dev,
                                  "user data for vidi is null.\n");
@@ -371,6 +376,7 @@ static int vidi_bind(struct device *dev, struct device 
*master, void *data)
 {
        struct vidi_context *ctx = dev_get_drvdata(dev);
        struct drm_device *drm_dev = data;
+       struct exynos_drm_private *priv = drm_dev->dev_private;
        struct drm_encoder *encoder = &ctx->encoder;
        struct exynos_drm_plane *exynos_plane;
        struct exynos_drm_plane_config plane_config = { 0 };
@@ -378,6 +384,8 @@ static int vidi_bind(struct device *dev, struct device 
*master, void *data)
        int ret;
 
        ctx->drm_dev = drm_dev;
+       if (priv)
+               priv->vidi_dev = dev;
 
        plane_config.pixel_formats = formats;
        plane_config.num_pixel_formats = ARRAY_SIZE(formats);
@@ -423,8 +431,12 @@ static int vidi_bind(struct device *dev, struct device 
*master, void *data)
 static void vidi_unbind(struct device *dev, struct device *master, void *data)
 {
        struct vidi_context *ctx = dev_get_drvdata(dev);
+       struct drm_device *drm_dev = data;
+       struct exynos_drm_private *priv = drm_dev->dev_private;
 
        timer_delete_sync(&ctx->timer);
+       if (priv)
+               priv->vidi_dev = NULL;
 }
 
 static const struct component_ops vidi_component_ops = {
--