Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 08291847 authored by Egbert Eich's avatar Egbert Eich Committed by Alex Deucher
Browse files

drm/radeon: Don't destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy(). 



radeon_i2c_fini() walks thru the list of I2C bus recs rdev->i2c_bus[]
to destroy each of them.
radeon_ext_tmds_enc_destroy() however also has code to destroy it's
associated I2C bus rec which has been obtained by radeon_i2c_lookup()
and is therefore also in the i2c_bus[] list.
This causes a double free resulting in a kernel panic when unloading
the radeon driver.
Removing destroy code from radeon_ext_tmds_enc_destroy() fixes this
problem.

agd5f: fix compiler warning

Signed-off-by: default avatarEgbert Eich <eich@suse.de>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
parent 3691feea

drivers/gpu/drm/radeon/radeon_legacy_encoders.c

+1 −5
Original line number Original line Diff line number Diff line
@@ -991,11 +991,7 @@ static void radeon_legacy_tmds_ext_mode_set(struct drm_encoder *encoder, 
static void radeon_ext_tmds_enc_destroy(struct drm_encoder *encoder)

static void radeon_ext_tmds_enc_destroy(struct drm_encoder *encoder)

{

{

	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);

	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);

	struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv;

	/* don't destroy the i2c bus record here, this will be done in radeon_i2c_fini */

	if (tmds) {

		if (tmds->i2c_bus)

			radeon_i2c_destroy(tmds->i2c_bus);

	}

	kfree(radeon_encoder->enc_priv);

	kfree(radeon_encoder->enc_priv);

	drm_encoder_cleanup(encoder);

	drm_encoder_cleanup(encoder);

	kfree(radeon_encoder);

	kfree(radeon_encoder);