| From 0f7a6f5d8dced43d14b7be9c9bc8b4f92eeadfd9 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 22 Nov 2022 09:39:49 -0500 |
| Subject: drm/mediatek: Clean dangling pointer on bind error path |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: Nícolas F. R. A. Prado <nfraprado@collabora.com> |
| |
| [ Upstream commit 36aa8c61af55675ed967900fbe5deb32d776f051 ] |
| |
| mtk_drm_bind() can fail, in which case drm_dev_put() is called, |
| destroying the drm_device object. However a pointer to it was still |
| being held in the private object, and that pointer would be passed along |
| to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that |
| point, resulting in a panic. Clean the pointer when destroying the |
| object in the error path to prevent this from happening. |
| |
| Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") |
| Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com> |
| Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> |
| Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221122143949.3493104-1-nfraprado@collabora.com/ |
| Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c |
| index d143217636071..eeb1277794dbf 100644 |
| --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c |
| +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c |
| @@ -425,6 +425,7 @@ static int mtk_drm_bind(struct device *dev) |
| err_deinit: |
| mtk_drm_kms_deinit(drm); |
| err_free: |
| + private->drm = NULL; |
| drm_dev_put(drm); |
| return ret; |
| } |
| -- |
| 2.39.2 |
| |
