The destroy function in drm_mode_config_cleanup will remove the objects in ipu-drm-core by calling its destroy functions if the bind function fails. The drm_encoder is also part of the devres allocated ipu_ldb object. The ipu_ldb object will already be cleaned up if the bind for the crtc fails. This leads drm_encoder_cleanup try to clean already freed memory.
We fix this issue by adding the devres action ipu_ldb_remove_head which will remove its head from the objects in ipu-drm-core which then never calls its destroy function anymore.
Signed-off-by: Michael Grzeschik m.grzeschik@pengutronix.de --- drivers/gpu/drm/imx/imx-ldb.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c index a11f8758da70e..0a224036cc68d 100644 --- a/drivers/gpu/drm/imx/imx-ldb.c +++ b/drivers/gpu/drm/imx/imx-ldb.c @@ -581,6 +581,21 @@ static int imx_ldb_panel_ddc(struct device *dev, return 0; }
+static void ipu_ldb_remove_head(void *data) +{ + struct imx_ldb *imx_ldb = data; + struct imx_ldb_channel *imx_ldb_ch; + struct drm_encoder *encoder; + + imx_ldb_ch = &imx_ldb->channel[0]; + encoder = &imx_ldb_ch->encoder; + list_del_init(&encoder->head); + + imx_ldb_ch = &imx_ldb->channel[1]; + encoder = &imx_ldb_ch->encoder; + list_del_init(&encoder->head); +} + static void ipu_ldb_init_encoder_head(struct imx_ldb *imx_ldb) { struct imx_ldb_channel *imx_ldb_ch; @@ -613,6 +628,10 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
ipu_ldb_init_encoder_head(imx_ldb);
+ ret = devm_add_action(dev, ipu_ldb_remove_head, imx_ldb); + if (ret) + return ret; + imx_ldb->regmap = syscon_regmap_lookup_by_phandle(np, "gpr"); if (IS_ERR(imx_ldb->regmap)) { dev_err(dev, "failed to get parent regmap\n");