Skip to content

Commit 5696944

Browse files
mark1188-uiMatthewCroughan
authored andcommitted
drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local
The local variable is passed in request_irq (), and there will be use after free problem, which will make request_irq failed. Using the global irq name instead of it to fix. Fixes: b11bc1a ("drm/hisilicon/hibmc: Add MSI irq getting and requesting for HPD") Signed-off-by: Baihan Li <[email protected]> Signed-off-by: Yongbang Shi <[email protected]> Reviewed-by: Dmitry Baryshkov <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Dmitry Baryshkov <[email protected]>
1 parent 2b52b48 commit 5696944

File tree

1 file changed

+3
-7
lines changed

1 file changed

+3
-7
lines changed

drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232

3333
DEFINE_DRM_GEM_FOPS(hibmc_fops);
3434

35-
static const char *g_irqs_names_map[HIBMC_MAX_VECTORS] = { "vblank", "hpd" };
35+
static const char *g_irqs_names_map[HIBMC_MAX_VECTORS] = { "hibmc-vblank", "hibmc-hpd" };
3636

3737
static irqreturn_t hibmc_interrupt(int irq, void *arg)
3838
{
@@ -277,7 +277,6 @@ static void hibmc_unload(struct drm_device *dev)
277277
static int hibmc_msi_init(struct drm_device *dev)
278278
{
279279
struct pci_dev *pdev = to_pci_dev(dev->dev);
280-
char name[32] = {0};
281280
int valid_irq_num;
282281
int irq;
283282
int ret;
@@ -292,20 +291,17 @@ static int hibmc_msi_init(struct drm_device *dev)
292291
valid_irq_num = ret;
293292

294293
for (int i = 0; i < valid_irq_num; i++) {
295-
snprintf(name, ARRAY_SIZE(name) - 1, "%s-%s-%s",
296-
dev->driver->name, pci_name(pdev), g_irqs_names_map[i]);
297-
298294
irq = pci_irq_vector(pdev, i);
299295

300296
if (i)
301297
/* PCI devices require shared interrupts. */
302298
ret = devm_request_threaded_irq(&pdev->dev, irq,
303299
hibmc_dp_interrupt,
304300
hibmc_dp_hpd_isr,
305-
IRQF_SHARED, name, dev);
301+
IRQF_SHARED, g_irqs_names_map[i], dev);
306302
else
307303
ret = devm_request_irq(&pdev->dev, irq, hibmc_interrupt,
308-
IRQF_SHARED, name, dev);
304+
IRQF_SHARED, g_irqs_names_map[i], dev);
309305
if (ret) {
310306
drm_err(dev, "install irq failed: %d\n", ret);
311307
return ret;

0 commit comments

Comments
 (0)