From nobody Fri Sep 25 12:00:48 2026 Received: from mail-pj2-f12.google.com (mail-pj2-f12.google.com [74.125.227.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B9E50356773 for ; Sun, 13 Sep 2026 09:16:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.227.140 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789291021; cv=none; b=Quw49q/erMsAW1NcjKsfOJZ3EMHsAYJwsK8lk+gq9NxkCbAPR8cTokwXVYNhiDNXymt53XhnlGyGKyhkAzNjJYDU/Vsza7rISBBrjYIKSyYuemGsHVJMSXY4rbQMElgMRdweofd8mM/MV7Ffn8EQrxpabt/pkNqUS7M6u+donlc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789291021; c=relaxed/simple; bh=cMiptzkByQhLBMfPKZ95f4RtbJX+VASD+YXlH7rsAmM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YA5waId1mqjMmLTqUV7uSmTaVcHJjxOdMHI4K8Pa76YPG/MelFuxMIMTP4mcKNuQNXPN+yp56ognlgelRdg8/QV/R22bBWJE7JBdwMZoUATUIn6fOl2vfSg84LBFlbVOm+IGhD6EQ2oQf0HpcQB0kbflSgFT4kcNZoMOu5E/urE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Klo2sO7v; arc=none smtp.client-ip=74.125.227.140 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Klo2sO7v" Received: by mail-pj2-f12.google.com with SMTP id d9443c01a7336-2d747ed1368so9221595ad.1 for ; Sun, 13 Sep 2026 02:16:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789291019; x=1789895819; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=hl7UPP4ejrps6ty9GNEkOxkDv0jyU5q+6jxLFrutl80=; b=Klo2sO7vApGC/mdbM7sR466wLYFqnkzM4PfFL2nSB/QYUMW3Cx3883M2gZV5R9ZpeF itk1EVK6jGVKXJqQ9UZkuSTrMtH4mNMdmjg95OvWXgaa6RbaaqwS/tsuqhAWLGgpZcDK mI2p+nUqc2ByTuGjL4SbSL+ewuV7QkQop6L2+BRoWBC8pcgjhhixUrhKnE7Q9ZMDF283 9JnroTAtMxDsANSrPU/1nCnGhwHauu5psijsQvRo5kwBbqpKuHe1BI8tWnXxv+dqw6xL FUOQO+WGkqQozHF8kJYc7b870gj87swgXgPBS4xrbv8S5yErV6AXqlKH64k9daKkFWQg iXyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1789291019; x=1789895819; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=hl7UPP4ejrps6ty9GNEkOxkDv0jyU5q+6jxLFrutl80=; b=F+AGIGfxof0820E7D7NRFQeE2nU8BciGa70aZhq99lDm1i1h//1jY21YgjaUtqOIee VeRgnOthWqtn6OSl7+So6NpqgyVq7EP4W/BM8yUGxTEjaYIlAm9RYZgxT6lYAYjeRPS9 Ofk2eogH4VFMTS9wbV/mTM41jPwuzsMnNBhsj/u80FgqIL3DTXOMyp5tQ+UT2mNa+x3X Imee4VHZbbn9lZC4wzd/ray1WzM+Cvm8heF13VLXiETFhUETIHnLiHvUaUX+Me0suYbu ypyvlJA3YECLweL5OQbd4CdJ2H7VDlAyGue0dq7yIKHkcPITQ4zZovYfe8472VN+16tD pyAg== X-Forwarded-Encrypted: i=1; AKwUvBwY/bsfFM43V3K1JVcCYqEDp1j9RUs45LYaTb3gs65/rrnCoLOAjWuFsFrFnzElVwiDe70ogl/tezW9uiw=@vger.kernel.org X-Gm-Message-State: AFuF++kfXKrXQ7oM0YOhowgo31WFElOO2aN0P+gU8ofgB0kQIyuIjtnU CuEPCNmoU7lV3nj6rLTZp7CpaDSx3G0MzHhmQ6gpY5rc/oFaSFP3Sx7S X-Gm-Gg: AYBFou3fpj6PBoG2qrwWgfEo0h9t7JdUAy8z7TdAsieDZJeWW1oq2EUmxqvdiaWN+dl Bxx/geJGVdAEYOi01zqPM7Eb5fIBjWAngXmx0ImAXYiqX1jtyxbOvTWKIvQxoVMpOYtHg5N1upw PWc7u3xUj35+IZTLcSbPVLyBnzro0WUNJ9/+JA/Ii/knBLZNB00PrLurHJo0izxvd2eMmArG697 MFJ1DSm8kMEkn/6X1Z2tnBfxsMeWAxUAiHo+s4hHwsuHr9VgTdXer4i4I5/6VXq3yMhCkQ8Vopb KxtlM4tL6YuukgivaCC4BexT2PnGLdFr2j0GOfvJyQLEw5rUb+4zDIr0GehsmwwXK0KxT7Vs+ZE U/glkJjb+Pdb1CFE9UynXqtjlRss8mD0XXson/IGSHdlFQPz4Nql/WU29RPabSE+PWVPkXt6Svj vk11o0XuG4jhvcC27sqI0ExMUDmb49U5sG2kT9AHzhl5OHqezI7N6YHw== X-Received: by 2002:a17:903:390d:b0:2ca:e19c:986 with SMTP id d9443c01a7336-2dd4bc3302bmr114612235ad.1.1789291018960; Sun, 13 Sep 2026 02:16:58 -0700 (PDT) Received: from lgs.. ([2001:250:5800:1002::de93]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2dd2ceb7720sm32169865ad.37.2026.09.13.02.16.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 13 Sep 2026 02:16:58 -0700 (PDT) From: Guangshuo Li To: Tomi Valkeinen , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Greg Kroah-Hartman , Andy Gross , Rob Clark , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li , stable@vger.kernel.org Subject: [PATCH] drm/omap: dmm_tiler: fix invalid cleanup on probe failure Date: Sun, 13 Sep 2026 17:16:44 +0800 Message-ID: <20260913091644.1510151-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" omap_dmm_probe() uses omap_dmm_remove() to clean up all probe failures, but the remove path assumes that the MMIO mapping and IRQ registration have completed successfully. If probe fails before the MMIO resource is mapped, omap_dmm_remove() attempts to disable DMM interrupts through an uninitialized MMIO base, which can result in an invalid memory access. There is a similar issue with the IRQ. The IRQ number is stored in omap_dmm before request_irq() is called, so a later probe failure can make omap_dmm_remove() call free_irq() even though the IRQ was never successfully requested. Initialize the stored IRQ to -1 and keep the IRQ number local until request_irq() succeeds. Only access the interrupt registers and free the IRQ when it has been successfully registered. Also avoid unmapping the MMIO region when it has not been mapped. Propagate errors returned by platform_get_irq() while at it. This issue was found by manual code inspection. Fixes: 71e8831f6407 ("drm/omap: DMM/TILER support for OMAP4+ platform") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 65 ++++++++++++++++++------ 1 file changed, 49 insertions(+), 16 deletions(-) diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/oma= pdrm/omap_dmm_tiler.c index a2c702b831a7..169a158e5e9d 100644 --- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c @@ -769,14 +769,14 @@ static void omap_dmm_remove(struct platform_device *d= ev) =20 static int omap_dmm_probe(struct platform_device *dev) { - int ret =3D -EFAULT, i; + int ret, i; struct tcm_area area =3D {0}; u32 hwinfo, pat_geom; struct resource *mem; =20 omap_dmm =3D kzalloc_obj(*omap_dmm); if (!omap_dmm) - goto fail; + return -ENOMEM; =20 /* initialize lists */ INIT_LIST_HEAD(&omap_dmm->alloc_head); @@ -791,7 +791,7 @@ static int omap_dmm_probe(struct platform_device *dev) if (!match) { dev_err(&dev->dev, "failed to find matching device node\n"); ret =3D -ENODEV; - goto fail; + goto err_free_dmm; } =20 omap_dmm->plat_data =3D match->data; @@ -801,7 +801,8 @@ static int omap_dmm_probe(struct platform_device *dev) mem =3D platform_get_resource(dev, IORESOURCE_MEM, 0); if (!mem) { dev_err(&dev->dev, "failed to get base address resource\n"); - goto fail; + ret =3D -ENODEV; + goto err_free_dmm; } =20 omap_dmm->phys_base =3D mem->start; @@ -809,12 +810,15 @@ static int omap_dmm_probe(struct platform_device *dev) =20 if (!omap_dmm->base) { dev_err(&dev->dev, "failed to get dmm base address\n"); - goto fail; + ret =3D -ENOMEM; + goto err_free_dmm; } =20 omap_dmm->irq =3D platform_get_irq(dev, 0); - if (omap_dmm->irq < 0) - goto fail; + if (omap_dmm->irq < 0) { + ret =3D omap_dmm->irq; + goto err_unmap; + } =20 omap_dmm->dev =3D &dev->dev; =20 @@ -864,13 +868,13 @@ static int omap_dmm_probe(struct platform_device *dev) if (!omap_dmm->dummy_page) { dev_err(&dev->dev, "could not allocate dummy page\n"); ret =3D -ENOMEM; - goto fail; + goto err_workaround; } =20 /* set dma mask for device */ ret =3D dma_set_coherent_mask(&dev->dev, DMA_BIT_MASK(32)); if (ret) - goto fail; + goto err_free_dummy; =20 omap_dmm->dummy_pa =3D page_to_phys(omap_dmm->dummy_page); =20 @@ -881,7 +885,7 @@ static int omap_dmm_probe(struct platform_device *dev) if (!omap_dmm->refill_va) { dev_err(&dev->dev, "could not allocate refill memory\n"); ret =3D -ENOMEM; - goto fail; + goto err_free_dummy; } =20 /* alloc engines */ @@ -889,7 +893,7 @@ static int omap_dmm_probe(struct platform_device *dev) omap_dmm->num_engines); if (!omap_dmm->engines) { ret =3D -ENOMEM; - goto fail; + goto err_free_refill; } =20 for (i =3D 0; i < omap_dmm->num_engines; i++) { @@ -907,7 +911,7 @@ static int omap_dmm_probe(struct platform_device *dev) omap_dmm->tcm =3D kzalloc_objs(*omap_dmm->tcm, omap_dmm->num_lut); if (!omap_dmm->tcm) { ret =3D -ENOMEM; - goto fail; + goto err_free_engines; } =20 /* init containers */ @@ -921,7 +925,7 @@ static int omap_dmm_probe(struct platform_device *dev) if (!omap_dmm->tcm[i]) { dev_err(&dev->dev, "failed to allocate container\n"); ret =3D -ENOMEM; - goto fail; + goto err_free_tcm; } =20 omap_dmm->tcm[i]->lut_id =3D i; @@ -958,7 +962,7 @@ static int omap_dmm_probe(struct platform_device *dev) dev_err(&dev->dev, "couldn't register IRQ %d, error %d\n", omap_dmm->irq, ret); omap_dmm->irq =3D -1; - goto fail; + goto err_free_tcm; } =20 /* Enable all interrupts for each refill engine except @@ -980,8 +984,37 @@ static int omap_dmm_probe(struct platform_device *dev) =20 return 0; =20 -fail: - omap_dmm_remove(dev); +err_free_tcm: + for (i =3D 0; i < ARRAY_SIZE(containers); i++) + containers[i] =3D NULL; + + for (i =3D 0; i < omap_dmm->num_lut; i++) + if (omap_dmm->tcm[i]) + omap_dmm->tcm[i]->deinit(omap_dmm->tcm[i]); + kfree(omap_dmm->tcm); + +err_free_engines: + kfree(omap_dmm->engines); + +err_free_refill: + dma_free_wc(omap_dmm->dev, + REFILL_BUFFER_SIZE * omap_dmm->num_engines, + omap_dmm->refill_va, omap_dmm->refill_pa); + +err_free_dummy: + __free_page(omap_dmm->dummy_page); + +err_workaround: + if (omap_dmm->dmm_workaround) + dmm_workaround_uninit(omap_dmm); + +err_unmap: + iounmap(omap_dmm->base); + +err_free_dmm: + kfree(omap_dmm); + omap_dmm =3D NULL; + return ret; } =20 --=20 2.43.0