On Fri, Nov 02, 2018 at 06:19:17PM +0530, Jayant Shekhar wrote: > In case of msm drm bind failure, dpu_mdss_destroy is triggered. > In this function, resources are freed and pm runtime disable is > called, which triggers dpu_mdss_disable. Now in dpu_mdss_disable, > driver tries to access a memory which is already freed. This > results in kernel panic. Fix this by ensuring proper sequence > of dpu destroy and disable calls. > > Changes in v2: > - Removed double spacings [Jeykumar] > > Signed-off-by: Jayant Shekhar <jshekhar@xxxxxxxxxxxxxx> Reviewed-by: Sean Paul <sean@xxxxxxxxxx> > --- > drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c | 5 +---- > 1 file changed, 1 insertion(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c > index fd9c893..902bb4c 100644 > --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c > +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c > @@ -156,18 +156,15 @@ static void dpu_mdss_destroy(struct drm_device *dev) > struct dpu_mdss *dpu_mdss = to_dpu_mdss(priv->mdss); > struct dss_module_power *mp = &dpu_mdss->mp; > > + pm_runtime_disable(dev->dev); > _dpu_mdss_irq_domain_fini(dpu_mdss); > - > free_irq(platform_get_irq(pdev, 0), dpu_mdss); > - > msm_dss_put_clk(mp->clk_config, mp->num_clk); > devm_kfree(&pdev->dev, mp->clk_config); > > if (dpu_mdss->mmio) > devm_iounmap(&pdev->dev, dpu_mdss->mmio); > dpu_mdss->mmio = NULL; > - > - pm_runtime_disable(dev->dev); > priv->mdss = NULL; > } > > -- > The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, > a Linux Foundation Collaborative Project > -- Sean Paul, Software Engineer, Google / Chromium OS
