Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume

BUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3

Call trace:
dpu_vbif_init_memtypes+0x40/0xb8
dpu_runtime_resume+0xcc/0x1c0
pm_generic_runtime_resume+0x30/0x44
__genpd_runtime_resume+0x68/0x7c
genpd_runtime_resume+0x134/0x258
__rpm_callback+0x98/0x138
rpm_callback+0x30/0x88
rpm_resume+0x36c/0x49c
__pm_runtime_resume+0x80/0xb0
dpu_core_irq_uninstall+0x30/0xb0
dpu_irq_uninstall+0x18/0x24
msm_drm_uninit+0xd8/0x16c

Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Signed-off-by: Vinod Polimera <quic_vpolimer@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/483255/
Link: https://lore.kernel.org/r/1650857213-30075-1-git-send-email-quic_vpolimer@quicinc.com
[DB: fixed Fixes tag]
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>

authored by

Vinod Polimera and committed by
Dmitry Baryshkov
fa5186b2 95093595

+3 -1
+3 -1
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
··· 774 774 for (i = 0; i < dpu_kms->catalog->vbif_count; i++) { 775 775 u32 vbif_idx = dpu_kms->catalog->vbif[i].id; 776 776 777 - if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) 777 + if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) { 778 778 dpu_hw_vbif_destroy(dpu_kms->hw_vbif[vbif_idx]); 779 + dpu_kms->hw_vbif[vbif_idx] = NULL; 780 + } 779 781 } 780 782 } 781 783