GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-07-08 23:55:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

drm/i915: Remove pci private pointer after destroying the device private

Browse source 
On an aborted module load, we unwind and free our device private - but
we left a dangling pointer to our privates inside the pci_device. After
the attempted aborted unload, we may still get a call to i915_pci_remove()
when the module is removed, potentially chasing stale data.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180716080332.32283-5-chris@chris-wilson.co.uk
This commit is contained in:
Chris Wilson 2018-07-16 09:03:31 +01:00
parent 55e4b859a2
commit 159b69bc0d
2 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
drivers/gpu/drm/i915/i915_drv.c
View file

@ -1424,6 +1424,7 @@ out_fini:
drm_dev_fini(&dev_priv->drm); drm_dev_fini(&dev_priv->drm);
out_free: out_free:
kfree(dev_priv); kfree(dev_priv);
pci_set_drvdata(pdev, NULL);
return ret; return ret;
} }

13
drivers/gpu/drm/i915/i915_pci.c
View file

@ -674,10 +674,16 @@ MODULE_DEVICE_TABLE(pci, pciidlist);
static void i915_pci_remove(struct pci_dev *pdev) static void i915_pci_remove(struct pci_dev *pdev)
{ {
struct drm_device *dev = pci_get_drvdata(pdev); struct drm_device *dev;
dev = pci_get_drvdata(pdev);
if (!dev) /* driver load aborted, nothing to cleanup */
return;
i915_driver_unload(dev); i915_driver_unload(dev);
drm_dev_put(dev); drm_dev_put(dev);
pci_set_drvdata(pdev, NULL);
} }
static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
@ -712,6 +718,11 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
if (err) if (err)
return err; return err;
if (i915_inject_load_failure()) {
i915_pci_remove(pdev);
return -ENODEV;
}
err = i915_live_selftests(pdev); err = i915_live_selftests(pdev);
if (err) { if (err) {
i915_pci_remove(pdev); i915_pci_remove(pdev);