github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-06 13:37:36 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/sun4i: Fix crash during suspend after component bind failure

Browse Source 
[ Upstream commit 1342b5b23d ]

If the component driver fails to bind, or is unbound, the driver data
for the top-level platform device points to a freed drm_device. If the
system is then suspended, the driver passes this dangling pointer to
drm_mode_config_helper_suspend(), which crashes.

Fix this by only setting the driver data while the platform driver holds
a reference to the drm_device.

Fixes: 624b4b48d9 ("drm: sun4i: Add support for suspending the display driver")
Signed-off-by: Samuel Holland <samuel@sholland.org>
Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20220615054254.16352-1-samuel@sholland.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Samuel Holland 2022-06-15 00:42:53 -05:00 committed by Greg Kroah-Hartman
parent 516760f1d2
commit 4ae116428e
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/gpu/drm/sun4i/sun4i_drv.c
View File

@ -71,7 +71,6 @@ static int sun4i_drv_bind(struct device *dev)
goto free_drm; goto free_drm;
} }
dev_set_drvdata(dev, drm);
drm->dev_private = drv; drm->dev_private = drv;
INIT_LIST_HEAD(&drv->frontend_list); INIT_LIST_HEAD(&drv->frontend_list);
INIT_LIST_HEAD(&drv->engine_list); INIT_LIST_HEAD(&drv->engine_list);
@ -112,6 +111,8 @@ static int sun4i_drv_bind(struct device *dev)
drm_fbdev_generic_setup(drm, 32); drm_fbdev_generic_setup(drm, 32);
dev_set_drvdata(dev, drm);
return 0; return 0;
finish_poll: finish_poll:
@ -128,6 +129,7 @@ static void sun4i_drv_unbind(struct device *dev)
{ {
struct drm_device *drm = dev_get_drvdata(dev); struct drm_device *drm = dev_get_drvdata(dev);
dev_set_drvdata(dev, NULL);
drm_dev_unregister(drm); drm_dev_unregister(drm);
drm_kms_helper_poll_fini(drm); drm_kms_helper_poll_fini(drm);
drm_atomic_helper_shutdown(drm); drm_atomic_helper_shutdown(drm);