drm/i915: Clear i915->display when no longer valid

Don't leave a stale i915->display pointer hanging around after
the display driver has been torn down. Apparently the gt code
calls into the reset codepaths after this, and if the display
pointer is still around we may try to access freed memory.

The whole teardown sequence here seems rather suspect. Why is
display done first and then everything else via the managed
release? Who the heck knows. Someone really needs to dig into
this stuff and figure out the proper init/cleanup sequence for
both i915 (real and mock) and xe...

Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Jouni Högander <jouni.hogander@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260415210411.24750-2-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>

diff --git a/drivers/gpu/drm/i915/i915_driver.c b/drivers/gpu/drm/i915/i915_driver.c
index 195e34acef301f5f746a85a512bf344d33d6bcad..d31819758f3d5019dd2c88157f9a43030a5ec81a 100644 (file)
--- a/drivers/gpu/drm/i915/i915_driver.c
+++ b/drivers/gpu/drm/i915/i915_driver.c
@@ -310,6 +310,7 @@ static void i915_driver_late_release(struct drm_i915_private *dev_priv)
        i915_params_free(&dev_priv->params);
 
        intel_display_device_remove(display);
+       dev_priv->display = NULL;
 }
 
 /**

diff --git a/drivers/gpu/drm/i915/selftests/mock_gem_device.c b/drivers/gpu/drm/i915/selftests/mock_gem_device.c
index 27dc0e40a8d75c949f830d1f72ca200eba5d1992..796c9b070e41f4c81548344d22ff094f700cfa43 100644 (file)
--- a/drivers/gpu/drm/i915/selftests/mock_gem_device.c
+++ b/drivers/gpu/drm/i915/selftests/mock_gem_device.c
@@ -277,6 +277,7 @@ void mock_destroy_device(struct drm_i915_private *i915)
        struct device *dev = i915->drm.dev;
 
        intel_display_device_remove(i915->display);
+       i915->display = NULL;
 
        devres_release_group(dev, NULL);
        put_device(dev);