drm/i915: Remove pci private pointer after destroying the device private

On an aborted module load, we unwind and free our device private - but
we left a dangling pointer to our privates inside the pci_device. After
the attempted aborted unload, we may still get a call to i915_pci_remove()
when the module is removed, potentially chasing stale data.

Signed-off-by: Chris Wilson <[email protected]>
Reviewed-by: Tvrtko Ursulin <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index cfa7583cf408874c21a2e236492a134e6c53cf22..337b1aad5212b01057389f2a767666151960d38f 100644 (file)
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1424,6 +1424,7 @@ out_fini:
        drm_dev_fini(&dev_priv->drm);
 out_free:
        kfree(dev_priv);
+       pci_set_drvdata(pdev, NULL);
        return ret;
 }
 

diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index 55543f1b0236aa90d62c04241d5f55925fbd07c2..6a4d1388ad2d39b2f972e0d1e1270bab8d3ce8df 100644 (file)
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -674,10 +674,16 @@ MODULE_DEVICE_TABLE(pci, pciidlist);
 
 static void i915_pci_remove(struct pci_dev *pdev)
 {
-       struct drm_device *dev = pci_get_drvdata(pdev);
+       struct drm_device *dev;
+
+       dev = pci_get_drvdata(pdev);
+       if (!dev) /* driver load aborted, nothing to cleanup */
+               return;
 
        i915_driver_unload(dev);
        drm_dev_put(dev);
+
+       pci_set_drvdata(pdev, NULL);
 }
 
 static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
@@ -712,6 +718,11 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (err)
                return err;
 
+       if (i915_inject_load_failure()) {
+               i915_pci_remove(pdev);
+               return -ENODEV;
+       }
+
        err = i915_live_selftests(pdev);
        if (err) {
                i915_pci_remove(pdev);