Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 159b69bc authored by Chris Wilson's avatar Chris Wilson
Browse files

drm/i915: Remove pci private pointer after destroying the device private 



On an aborted module load, we unwind and free our device private - but
we left a dangling pointer to our privates inside the pci_device. After
the attempted aborted unload, we may still get a call to i915_pci_remove()
when the module is removed, potentially chasing stale data.

Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180716080332.32283-5-chris@chris-wilson.co.uk
parent 55e4b859

drivers/gpu/drm/i915/i915_drv.c

+1 −0
Original line number Diff line number Diff line
@@ -1424,6 +1424,7 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent) 
	drm_dev_fini(&dev_priv->drm);

out_free:

	kfree(dev_priv);

	pci_set_drvdata(pdev, NULL);

	return ret;

}

drivers/gpu/drm/i915/i915_pci.c

+12 −1
Original line number Diff line number Diff line
@@ -674,10 +674,16 @@ MODULE_DEVICE_TABLE(pci, pciidlist); 


static void i915_pci_remove(struct pci_dev *pdev)

{

	struct drm_device *dev = pci_get_drvdata(pdev);

	struct drm_device *dev;



	dev = pci_get_drvdata(pdev);

	if (!dev) /* driver load aborted, nothing to cleanup */

		return;



	i915_driver_unload(dev);

	drm_dev_put(dev);



	pci_set_drvdata(pdev, NULL);

}



static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
@@ -712,6 +718,11 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) 
	if (err)

		return err;



	if (i915_inject_load_failure()) {

		i915_pci_remove(pdev);

		return -ENODEV;

	}



	err = i915_live_selftests(pdev);

	if (err) {

		i915_pci_remove(pdev);