• Stephane Viau's avatar
    drm/msm: fix unbalanced DRM framebuffer init/destroy · 7194b62c
    Stephane Viau authored
    When msm_framebuffer_init() fails before calling drm_framebuffer_init(),
    drm_framebuffer_cleanup() [called in msm_framebuffer_destroy()]
    is still being called even though drm_framebuffer_init() was not
    called for that buffer. Thus a NULL pointer derefencing:
    
    [  247.529691] Unable to handle kernel NULL pointer dereference at virtual address 0000027c
    ...
    [  247.563996] PC is at __mutex_lock_slowpath+0x94/0x3a8
    ...
    [  247.823025] [<c07c3c78>] (__mutex_lock_slowpath) from [<c07c3fac>] (mutex_lock+0x20/0x3c)
    [  247.831186] [<c07c3fac>] (mutex_lock) from [<c0347cf0>] (drm_framebuffer_cleanup+0x18/0x38)
    [  247.839520] [<c0347cf0>] (drm_framebuffer_cleanup) from [<c036d138>] (msm_framebuffer_destroy+0x48/0x100)
    [  247.849066] [<c036d138>] (msm_framebuffer_destroy) from [<c036d580>] (msm_framebuffer_init+0x1e8/0x228)
    [  247.858439] [<c036d580>] (msm_framebuffer_init) from [<c036d630>] (msm_framebuffer_create+0x70/0x134)
    [  247.867642] [<c036d630>] (msm_framebuffer_create) from [<c03493ec>] (internal_framebuffer_create+0x67c/0x7b4)
    [  247.877537] [<c03493ec>] (internal_framebuffer_create) from [<c034ce34>] (drm_mode_addfb2+0x20/0x98)
    [  247.886650] [<c034ce34>] (drm_mode_addfb2) from [<c034071c>] (drm_ioctl+0x240/0x420)
    [  247.894378] [<c034071c>] (drm_ioctl) from [<c011df7c>] (do_vfs_ioctl+0x4e4/0x5a4)
    ...
    Signed-off-by: default avatarStephane Viau <sviau@codeaurora.org>
    [plus initialize msm_fb to NULL to -Rob]
    Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
    7194b62c
msm_fb.c 6.41 KB