From: Ville Syrjälä <ville.syrjala@linux.intel.com>
Date: Tue, 3 Mar 2026 10:14:17 +0000 (+0200)
Subject: drm/i915/overlay: Fix oops on unload
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=aa029f7a51d74401ebd05388ed573ad18b2830a8;p=thirdparty%2Flinux.git

drm/i915/overlay: Fix oops on unload

Apparently I failed to test the unload case properly and
thus didn't notice that the i915_overlay_is_active() needs
i915->overlay after fetch_and_zero() already cleared it.
Stop using fetch_and_zero() and only clear the pointer at
the end to avoid the oops.

Fixes: 38d9a352c45e ("drm/i915/overlay: Extract i915_overlay_is_active()")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260303101417.14409-1-ville.syrjala@linux.intel.com
Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
---

diff --git a/drivers/gpu/drm/i915/i915_overlay.c b/drivers/gpu/drm/i915/i915_overlay.c
index 28518dbb5b8e0..04d5ad6aba5ab 100644
--- a/drivers/gpu/drm/i915/i915_overlay.c
+++ b/drivers/gpu/drm/i915/i915_overlay.c
@@ -482,9 +482,8 @@ static void __iomem *i915_overlay_setup(struct drm_device *drm,
 static void i915_overlay_cleanup(struct drm_device *drm)
 {
 	struct drm_i915_private *i915 = to_i915(drm);
-	struct i915_overlay *overlay;
+	struct i915_overlay *overlay = i915->overlay;
 
-	overlay = fetch_and_zero(&i915->overlay);
 	if (!overlay)
 		return;
 
@@ -499,6 +498,7 @@ static void i915_overlay_cleanup(struct drm_device *drm)
 	i915_active_fini(&overlay->last_flip);
 
 	kfree(overlay);
+	i915->overlay = NULL;
 }
 
 const struct intel_display_overlay_interface i915_display_overlay_interface = {