On Tue, Aug 28, 2018 at 03:23:04PM -0600, Jordan Crouse wrote:

The MDSS device is created before the MSM driver attempts to bind the sub components. If any of the components return -EPROBE_DEFER the MDSS device is destroyed and tried again later.

If this happens the "dpu_mdss_isr" interrupt created from the DPU MDSS is not freed when the MDSS device is destroyed and has a risk of triggering later and hitting a fault by accessing a mmio region that no longer exists. Even if the interrupt isn't triggered by accident when the device attempts to reprobe it would error out when it tries to re-register the interrupt so unconditionally removing it in the destroy is the right move.

Switch the device managed "dpu_mdss_isr" to be unmanaged and add a free_irq() in the mdss destroy function.

Signed-off-by: Jordan Crouse jcrouse@codeaurora.org

Reviewed-by: Sean Paul seanpaul@chromium.org

---

drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c index 9e533b86682c..2235ef8129f4 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c @@ -158,6 +158,8 @@ static void dpu_mdss_destroy(struct drm_device *dev)

_dpu_mdss_irq_domain_fini(dpu_mdss);

• free_irq(platform_get_irq(pdev, 0), dpu_mdss);
• msm_dss_put_clk(mp->clk_config, mp->num_clk); devm_kfree(&pdev->dev, mp->clk_config);

@@ -215,7 +217,7 @@ int dpu_mdss_init(struct drm_device *dev) if (ret) goto irq_domain_error;

• ret = devm_request_irq(dev->dev, platform_get_irq(pdev, 0),

• ret = request_irq(platform_get_irq(pdev, 0), dpu_mdss_irq, 0, "dpu_mdss_isr", dpu_mdss); if (ret) { DPU_ERROR("failed to init irq: %d\n", ret);

-- 2.18.0