Re: [PATCH v3 02/14] drm/msm/mdp5: forget the hardware blocks of a previous bind

[Konrad Dybcio]

On 10/24/26 1:19 AM, Dmitry Baryshkov wrote:
> Binding the MDP5 driver again, after an unbind or after a failed bind,
> corrupts struct mdp5_kms. On DB820c, binding it after a failed bind
> oopses in hwmixer_init():
> 
>   Unable to handle kernel paging request at virtual address ffff0004d411f9d8
>   pc : mdp5_kms_init+0x264/0x7f8
> 
> Since mdp5_kms is allocated in mdp5_dev_probe(), it outlives the bind,
> but hwpipe_init(), hwmixer_init() and interface_init() still run on
> each bind and append to the hwpipes[], hwmixers[] and intfs[] arrays
> without resetting their counts. The second bind writes past the end of
> hwpipes[] into the fields which follow it.
> 
> Reset the counts when the hardware blocks are torn down. The blocks
> themselves are devm-allocated on the MDP5 device on each bind and are
> only freed when it is unbound; that leak is left for a separate change.
> 
> Fixes: 1f50db2f3e1e ("drm/msm/mdp5: move resource allocation to the _probe function")
> Assisted-by: LLM
> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxxxxxxxx>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@xxxxxxxxxxxxxxxx>

Konrad