Merge branch 'etnaviv/fixes' of https://git.pengutronix.de/git/lst/linux into drm-fixes

Fix a kernel nullptr deref on module
unload when any etnaviv GPU failed to initialize properly.

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Lucas Stach <l.stach@pengutronix.de>
Link: https://patchwork.freedesktop.org/patch/msgid/1561974148.2321.1.camel@pengutronix.de

1 files changed, 5 insertions, 2 deletions

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 72d01e873160..5418a1a87b2c 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -760,7 +760,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
         if (IS_ERR(gpu->cmdbuf_suballoc)) {
                 dev_err(gpu->dev, "Failed to create cmdbuf suballocator\n");
                 ret = PTR_ERR(gpu->cmdbuf_suballoc);
-                goto fail;
+                goto destroy_iommu;
         }
 
         /* Create buffer: */
@@ -768,7 +768,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
                                   PAGE_SIZE);
         if (ret) {
                 dev_err(gpu->dev, "could not create command buffer\n");
-                goto destroy_iommu;
+                goto destroy_suballoc;
         }
 
         if (gpu->mmu->version == ETNAVIV_IOMMU_V1 &&
@@ -800,6 +800,9 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
 free_buffer:
         etnaviv_cmdbuf_free(&gpu->buffer);
         gpu->buffer.suballoc = NULL;
+destroy_suballoc:
+        etnaviv_cmdbuf_suballoc_destroy(gpu->cmdbuf_suballoc);
+        gpu->cmdbuf_suballoc = NULL;
 destroy_iommu:
         etnaviv_iommu_destroy(gpu->mmu);
         gpu->mmu = NULL;