diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2018-07-16 09:03:31 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2018-07-16 11:25:28 +0100 |
| commit | 159b69bc0dcdb88ea5126a8f98e4caa31789326b (patch) | |
| tree | ad4363b03052981f73d35df6b89e51bd1559d229 | |
| parent | 55e4b859a2e1952d3feb2e2ec1c520952cc8b660 (diff) | |
| download | linux-stable-159b69bc0dcdb88ea5126a8f98e4caa31789326b.tar.gz linux-stable-159b69bc0dcdb88ea5126a8f98e4caa31789326b.tar.bz2 linux-stable-159b69bc0dcdb88ea5126a8f98e4caa31789326b.zip | |
drm/i915: Remove pci private pointer after destroying the device private
On an aborted module load, we unwind and free our device private - but
we left a dangling pointer to our privates inside the pci_device. After
the attempted aborted unload, we may still get a call to i915_pci_remove()
when the module is removed, potentially chasing stale data.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180716080332.32283-5-chris@chris-wilson.co.uk
| -rw-r--r-- | drivers/gpu/drm/i915/i915_drv.c | 1 | ||||
| -rw-r--r-- | drivers/gpu/drm/i915/i915_pci.c | 13 |
2 files changed, 13 insertions, 1 deletions
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c index cfa7583cf408..337b1aad5212 100644 --- a/drivers/gpu/drm/i915/i915_drv.c +++ b/drivers/gpu/drm/i915/i915_drv.c @@ -1424,6 +1424,7 @@ out_fini: drm_dev_fini(&dev_priv->drm); out_free: kfree(dev_priv); + pci_set_drvdata(pdev, NULL); return ret; } diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c index 55543f1b0236..6a4d1388ad2d 100644 --- a/drivers/gpu/drm/i915/i915_pci.c +++ b/drivers/gpu/drm/i915/i915_pci.c @@ -674,10 +674,16 @@ MODULE_DEVICE_TABLE(pci, pciidlist); static void i915_pci_remove(struct pci_dev *pdev) { - struct drm_device *dev = pci_get_drvdata(pdev); + struct drm_device *dev; + + dev = pci_get_drvdata(pdev); + if (!dev) /* driver load aborted, nothing to cleanup */ + return; i915_driver_unload(dev); drm_dev_put(dev); + + pci_set_drvdata(pdev, NULL); } static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) @@ -712,6 +718,11 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) if (err) return err; + if (i915_inject_load_failure()) { + i915_pci_remove(pdev); + return -ENODEV; + } + err = i915_live_selftests(pdev); if (err) { i915_pci_remove(pdev); |