Commit 8bed4ec4 authored by Baihan Li's avatar Baihan Li Committed by Dmitry Baryshkov
Browse files

drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local 



The local variable is passed in request_irq (), and there will be use
after free problem, which will make request_irq failed. Using the global
irq name instead of it to fix.

Fixes: b11bc1ae ("drm/hisilicon/hibmc: Add MSI irq getting and requesting for HPD")
Signed-off-by: default avatarBaihan Li <libaihan@huawei.com>
Signed-off-by: default avatarYongbang Shi <shiyongbang@huawei.com>
Reviewed-by: default avatarDmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250813094238.3722345-4-shiyongbang@huawei.com


Signed-off-by: default avatarDmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
parent e5f48bfa

drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c

+3 −7
Original line number Diff line number Diff line
@@ -32,7 +32,7 @@ 


DEFINE_DRM_GEM_FOPS(hibmc_fops);



static const char *g_irqs_names_map[HIBMC_MAX_VECTORS] = { "vblank", "hpd" };

static const char *g_irqs_names_map[HIBMC_MAX_VECTORS] = { "hibmc-vblank", "hibmc-hpd" };



static irqreturn_t hibmc_interrupt(int irq, void *arg)

{
@@ -277,7 +277,6 @@ static void hibmc_unload(struct drm_device *dev) 
static int hibmc_msi_init(struct drm_device *dev)

{

	struct pci_dev *pdev = to_pci_dev(dev->dev);

	char name[32] = {0};

	int valid_irq_num;

	int irq;

	int ret;
@@ -292,9 +291,6 @@ static int hibmc_msi_init(struct drm_device *dev) 
	valid_irq_num = ret;



	for (int i = 0; i < valid_irq_num; i++) {

		snprintf(name, ARRAY_SIZE(name) - 1, "%s-%s-%s",

			 dev->driver->name, pci_name(pdev), g_irqs_names_map[i]);



		irq = pci_irq_vector(pdev, i);



		if (i)
@@ -302,10 +298,10 @@ static int hibmc_msi_init(struct drm_device *dev) 
			ret = devm_request_threaded_irq(&pdev->dev, irq,

							hibmc_dp_interrupt,

							hibmc_dp_hpd_isr,

							IRQF_SHARED, name, dev);

							IRQF_SHARED, g_irqs_names_map[i], dev);

		else

			ret = devm_request_irq(&pdev->dev, irq, hibmc_interrupt,

					       IRQF_SHARED, name, dev);

					       IRQF_SHARED, g_irqs_names_map[i], dev);

		if (ret) {

			drm_err(dev, "install irq failed: %d\n", ret);

			return ret;