From: Ville Syrjälä Date: Wed, 15 Apr 2026 21:04:05 +0000 (+0300) Subject: drm/i915: Clear i915->display when no longer valid X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=758eedf64bd308d6011d740f5cc3b3ef181ce4c0;p=thirdparty%2Fkernel%2Flinux.git drm/i915: Clear i915->display when no longer valid Don't leave a stale i915->display pointer hanging around after the display driver has been torn down. Apparently the gt code calls into the reset codepaths after this, and if the display pointer is still around we may try to access freed memory. The whole teardown sequence here seems rather suspect. Why is display done first and then everything else via the managed release? Who the heck knows. Someone really needs to dig into this stuff and figure out the proper init/cleanup sequence for both i915 (real and mock) and xe... Cc: Jani Nikula Cc: Jouni Högander Cc: Maarten Lankhorst Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260415210411.24750-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula --- diff --git a/drivers/gpu/drm/i915/i915_driver.c b/drivers/gpu/drm/i915/i915_driver.c index 195e34acef301..d31819758f3d5 100644 --- a/drivers/gpu/drm/i915/i915_driver.c +++ b/drivers/gpu/drm/i915/i915_driver.c @@ -310,6 +310,7 @@ static void i915_driver_late_release(struct drm_i915_private *dev_priv) i915_params_free(&dev_priv->params); intel_display_device_remove(display); + dev_priv->display = NULL; } /** diff --git a/drivers/gpu/drm/i915/selftests/mock_gem_device.c b/drivers/gpu/drm/i915/selftests/mock_gem_device.c index 27dc0e40a8d75..796c9b070e41f 100644 --- a/drivers/gpu/drm/i915/selftests/mock_gem_device.c +++ b/drivers/gpu/drm/i915/selftests/mock_gem_device.c @@ -277,6 +277,7 @@ void mock_destroy_device(struct drm_i915_private *i915) struct device *dev = i915->drm.dev; intel_display_device_remove(i915->display); + i915->display = NULL; devres_release_group(dev, NULL); put_device(dev);