Skip to content

Commit

Permalink
drm/i915: Remove pci private pointer after destroying the device private
Browse files Browse the repository at this point in the history
On an aborted module load, we unwind and free our device private - but
we left a dangling pointer to our privates inside the pci_device. After
the attempted aborted unload, we may still get a call to i915_pci_remove()
when the module is removed, potentially chasing stale data.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180716080332.32283-5-chris@chris-wilson.co.uk
  • Loading branch information
Chris Wilson committed Jul 16, 2018
1 parent 55e4b85 commit 159b69b
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 1 deletion.
1 change: 1 addition & 0 deletions drivers/gpu/drm/i915/i915_drv.c
Original file line number Diff line number Diff line change
Expand Up @@ -1424,6 +1424,7 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent)
drm_dev_fini(&dev_priv->drm);
out_free:
kfree(dev_priv);
pci_set_drvdata(pdev, NULL);
return ret;
}

Expand Down
13 changes: 12 additions & 1 deletion drivers/gpu/drm/i915/i915_pci.c
Original file line number Diff line number Diff line change
Expand Up @@ -674,10 +674,16 @@ MODULE_DEVICE_TABLE(pci, pciidlist);

static void i915_pci_remove(struct pci_dev *pdev)
{
struct drm_device *dev = pci_get_drvdata(pdev);
struct drm_device *dev;

dev = pci_get_drvdata(pdev);
if (!dev) /* driver load aborted, nothing to cleanup */
return;

i915_driver_unload(dev);
drm_dev_put(dev);

pci_set_drvdata(pdev, NULL);
}

static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
Expand Down Expand Up @@ -712,6 +718,11 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
if (err)
return err;

if (i915_inject_load_failure()) {
i915_pci_remove(pdev);
return -ENODEV;
}

err = i915_live_selftests(pdev);
if (err) {
i915_pci_remove(pdev);
Expand Down

0 comments on commit 159b69b

Please sign in to comment.