[Nouveau] [PATCH 2/2] drm/nouveau/bl: Allocate backlight connector nodes.

[Jeffery Miller]

Avoid adding nodes to the bl_connectors list from
the stack.

Nodes on the stack were being added to the bl_connectors list.
nouveau_backlight_exit would panic while traversing the bl_connectors list.

This panic was observed on an optimus system when unloading the nouveau
module.

Signed-off-by: Jeffery Miller <jmiller at neverware.com>
---
 drivers/gpu/drm/nouveau/nouveau_backlight.c | 70 ++++++++++++++-------
 1 file changed, 47 insertions(+), 23 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c
index debbbf0fd4bd..fce2441cce0d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c
+++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
@@ -46,19 +46,40 @@ struct backlight_connector {
 	int id;
 };
 
-static bool
+static void
 nouveau_get_backlight_name(char backlight_name[BL_NAME_SIZE], struct backlight_connector
 		*connector)
 {
-	const int nb = ida_simple_get(&bl_ida, 0, 0, GFP_KERNEL);
-	if (nb < 0 || nb >= 100)
-		return false;
-	if (nb > 0)
-		snprintf(backlight_name, BL_NAME_SIZE, "nv_backlight%d", nb);
+	if (connector->id > 0)
+		snprintf(backlight_name, BL_NAME_SIZE, "nv_backlight%d",
+				connector->id);
 	else
 		snprintf(backlight_name, BL_NAME_SIZE, "nv_backlight");
-	connector->id = nb;
-	return true;
+}
+
+static struct backlight_connector *
+nouveau_alloc_bl_connector(void)
+{
+	const int nb = ida_simple_get(&bl_ida, 0, 100, GFP_KERNEL);
+	struct backlight_connector *bl_connector;
+
+	if (nb < 0)
+		return ERR_PTR(nb);
+	bl_connector = kzalloc(sizeof(*bl_connector), GFP_KERNEL);
+	if (!bl_connector) {
+		ida_simple_remove(&bl_ida, nb);
+		return ERR_PTR(-ENOMEM);
+	}
+	bl_connector->id = nb;
+	return bl_connector;
+}
+
+static void
+nouveau_free_bl_connector(struct backlight_connector *bl_connector)
+{
+	if (bl_connector->id >= 0)
+		ida_simple_remove(&bl_ida, bl_connector->id);
+	kfree(bl_connector);
 }
 
 static int
@@ -99,7 +120,7 @@ nv40_backlight_init(struct drm_connector *connector)
 	struct nvif_object *device = &drm->client.device.object;
 	struct backlight_properties props;
 	struct backlight_device *bd;
-	struct backlight_connector bl_connector;
+	struct backlight_connector *bl_connector;
 	char backlight_name[BL_NAME_SIZE];
 
 	if (!(nvif_rd32(device, NV40_PMC_BACKLIGHT) & NV40_PMC_BACKLIGHT_MASK))
@@ -108,19 +129,21 @@ nv40_backlight_init(struct drm_connector *connector)
 	memset(&props, 0, sizeof(struct backlight_properties));
 	props.type = BACKLIGHT_RAW;
 	props.max_brightness = 31;
-	if (!nouveau_get_backlight_name(backlight_name, &bl_connector)) {
+	bl_connector = nouveau_alloc_bl_connector();
+	if (IS_ERR(bl_connector)) {
 		NV_ERROR(drm, "Failed to retrieve a unique name for the backlight interface\n");
-		return 0;
+		return PTR_ERR(bl_connector);
 	}
+
+	nouveau_get_backlight_name(backlight_name, bl_connector);
 	bd = backlight_device_register(backlight_name , connector->kdev, drm,
 				       &nv40_bl_ops, &props);
 
 	if (IS_ERR(bd)) {
-		if (bl_connector.id > 0)
-			ida_simple_remove(&bl_ida, bl_connector.id);
+		nouveau_free_bl_connector(bl_connector);
 		return PTR_ERR(bd);
 	}
-	list_add(&bl_connector.head, &drm->bl_connectors);
+	list_add(&bl_connector->head, &drm->bl_connectors);
 	drm->backlight = bd;
 	bd->props.brightness = nv40_get_intensity(bd);
 	backlight_update_status(bd);
@@ -218,7 +241,7 @@ nv50_backlight_init(struct drm_connector *connector)
 	struct backlight_properties props;
 	struct backlight_device *bd;
 	const struct backlight_ops *ops;
-	struct backlight_connector bl_connector;
+	struct backlight_connector *bl_connector;
 	char backlight_name[BL_NAME_SIZE];
 
 	nv_encoder = find_encoder(connector, DCB_OUTPUT_LVDS);
@@ -241,20 +264,21 @@ nv50_backlight_init(struct drm_connector *connector)
 	memset(&props, 0, sizeof(struct backlight_properties));
 	props.type = BACKLIGHT_RAW;
 	props.max_brightness = 100;
-	if (!nouveau_get_backlight_name(backlight_name, &bl_connector)) {
+	bl_connector = nouveau_alloc_bl_connector();
+	if (IS_ERR(bl_connector)) {
 		NV_ERROR(drm, "Failed to retrieve a unique name for the backlight interface\n");
-		return 0;
+		return PTR_ERR(bl_connector);
 	}
+	nouveau_get_backlight_name(backlight_name, bl_connector);
 	bd = backlight_device_register(backlight_name , connector->kdev,
 				       nv_encoder, ops, &props);
 
 	if (IS_ERR(bd)) {
-		if (bl_connector.id > 0)
-			ida_simple_remove(&bl_ida, bl_connector.id);
+		nouveau_free_bl_connector(bl_connector);
 		return PTR_ERR(bd);
 	}
 
-	list_add(&bl_connector.head, &drm->bl_connectors);
+	list_add(&bl_connector->head, &drm->bl_connectors);
 	drm->backlight = bd;
 	bd->props.brightness = bd->ops->get_brightness(bd);
 	backlight_update_status(bd);
@@ -302,10 +326,10 @@ nouveau_backlight_exit(struct drm_device *dev)
 {
 	struct nouveau_drm *drm = nouveau_drm(dev);
 	struct backlight_connector *connector;
+	struct backlight_connector *safe;
 
-	list_for_each_entry(connector, &drm->bl_connectors, head) {
-		if (connector->id >= 0)
-			ida_simple_remove(&bl_ida, connector->id);
+	list_for_each_entry_safe(connector, safe, &drm->bl_connectors, head) {
+		nouveau_free_bl_connector(connector);
 	}
 
 	if (drm->backlight) {
-- 
2.17.1