Unverified Commit 1342b5b2 authored by Samuel Holland's avatar Samuel Holland Committed by Maxime Ripard
Browse files

drm/sun4i: Fix crash during suspend after component bind failure 



If the component driver fails to bind, or is unbound, the driver data
for the top-level platform device points to a freed drm_device. If the
system is then suspended, the driver passes this dangling pointer to
drm_mode_config_helper_suspend(), which crashes.

Fix this by only setting the driver data while the platform driver holds
a reference to the drm_device.

Fixes: 624b4b48 ("drm: sun4i: Add support for suspending the display driver")
Signed-off-by: default avatarSamuel Holland <samuel@sholland.org>
Reviewed-by: default avatarJernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: default avatarMaxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20220615054254.16352-1-samuel@sholland.org
parent 92016904

drivers/gpu/drm/sun4i/sun4i_drv.c

+3 −1
Original line number Diff line number Diff line
@@ -73,7 +73,6 @@ static int sun4i_drv_bind(struct device *dev) 
		goto free_drm;

	}



	dev_set_drvdata(dev, drm);

	drm->dev_private = drv;

	INIT_LIST_HEAD(&drv->frontend_list);

	INIT_LIST_HEAD(&drv->engine_list);
@@ -114,6 +113,8 @@ static int sun4i_drv_bind(struct device *dev) 


	drm_fbdev_generic_setup(drm, 32);



	dev_set_drvdata(dev, drm);



	return 0;



finish_poll:
@@ -130,6 +131,7 @@ static void sun4i_drv_unbind(struct device *dev) 
{

	struct drm_device *drm = dev_get_drvdata(dev);



	dev_set_drvdata(dev, NULL);

	drm_dev_unregister(drm);

	drm_kms_helper_poll_fini(drm);

	drm_atomic_helper_shutdown(drm);