drm/msm: Fix error handling crashes seen when VRAM allocation fails

If VRAM allocation fails, the error handling path crashes in
msm_drm_uninit(). The following changes are made to fix this:

msm_gem_shrinker_cleanup() is fixed to unregister the shrinker only
if it was init-ed in the first place.

Before calling kms->funcs->destroy(), we check if kms->funcs is also
non-NULL. This is needed for MDP5, since during msm_drm_int(), priv->kms
becomes non-NULL early, but msm_kms_init() is called on it only later
in mdp5_kms_init().

Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Reviewed-by: Andy Gross <andy.gross@linaro.org>

diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index fb5c0b0a7594adcb0f38858cce0fc87d786f4eaa..46568fc80848f1376122d4936e662310e6cdb4b4 100644 (file)
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -228,7 +228,7 @@ static int msm_drm_uninit(struct device *dev)
        flush_workqueue(priv->atomic_wq);
        destroy_workqueue(priv->atomic_wq);
 
-       if (kms)
+       if (kms && kms->funcs)
                kms->funcs->destroy(kms);
 
        if (gpu) {

diff --git a/drivers/gpu/drm/msm/msm_gem_shrinker.c b/drivers/gpu/drm/msm/msm_gem_shrinker.c
index 283d2841ba58137efa28ea4c2cef3872b4cb5202..192b2d3a79cb221e4b067b5b153d3a913edd6ffc 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gem_shrinker.c
+++ b/drivers/gpu/drm/msm/msm_gem_shrinker.c
@@ -163,6 +163,9 @@ void msm_gem_shrinker_init(struct drm_device *dev)
 void msm_gem_shrinker_cleanup(struct drm_device *dev)
 {
        struct msm_drm_private *priv = dev->dev_private;
-       WARN_ON(unregister_vmap_purge_notifier(&priv->vmap_notifier));
-       unregister_shrinker(&priv->shrinker);
+
+       if (priv->shrinker.nr_deferred) {
+               WARN_ON(unregister_vmap_purge_notifier(&priv->vmap_notifier));
+               unregister_shrinker(&priv->shrinker);
+       }
 }