[PATCH] drm: mxsfb: Fix NULL pointer dereference crash on unload

[Daniel Vetter]

On Sun, Oct 17, 2021 at 10:05 PM Marek Vasut <marex at denx.de> wrote:
>
> On 10/17/21 7:52 PM, Sam Ravnborg wrote:
> > Hi Marek,
> >
> > On Wed, Sep 08, 2021 at 08:24:20PM +0200, Daniel Vetter wrote:
> >> On Tue, Sep 07, 2021 at 04:49:00AM +0200, Marek Vasut wrote:
> >>> The mxsfb->crtc.funcs may already be NULL when unloading the driver,
> >>> in which case calling mxsfb_irq_disable() via drm_irq_uninstall() from
> >>> mxsfb_unload() leads to NULL pointer dereference.
> >>>
> >>> Since all we care about is masking the IRQ and mxsfb->base is still
> >>> valid, just use that to clear and mask the IRQ.
> >>>
> >>> Fixes: ae1ed00932819 ("drm: mxsfb: Stop using DRM simple display pipeline helper")
> >>> Signed-off-by: Marek Vasut <marex at denx.de>
> >>> Cc: Daniel Abrecht <public at danielabrecht.ch>
> >>> Cc: Emil Velikov <emil.l.velikov at gmail.com>
> >>> Cc: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
> >>> Cc: Sam Ravnborg <sam at ravnborg.org>
> >>> Cc: Stefan Agner <stefan at agner.ch>
> >>
> >> You probably want a drm_atomic_helper_shutdown instead of trying to do all
> >> that manually. We've also added a bunch more devm and drmm_ functions to
> >> automate the cleanup a lot more here, e.g. your drm_mode_config_cleanup is
> >> in the wrong place.
> >
> > I have applied v2 of this patch today - but failed to see any response
> > in v2 to this comment from Daniel. Was it lost somehow?
>
> Hmmm, I'll investigate that ^ in the next round of mxsfb clean ups.

Yeah this was just a quick comment about how to do this cleanly, not
meant to hold up a bugfix or anything like that.
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch