[PATCH] drm/msm/dsi: clear the DMA buffer pointer after freeing it

[Michael McAllister]

The DSI host survives component unbind. On DSI v2, freeing the command
buffer leaves tx_buf pointing at freed memory. If a later bind fails
before allocating a new buffer, another unbind can free it again.

Clear tx_buf after freeing it, as we already do for tx_gem_obj.

Fixes: 5e05be782645 ("drm/msm/dsi: free TX buffer in unbind")
Cc: stable@xxxxxxxxxxxxxxx
Link: https://sashiko.dev/#/bug/linux-6f5085d3-ef49-482c-86e4-a2438bc1b91f
Signed-off-by: Michael McAllister <me@xxxxxxxxxxxxxxxxxxxxx>
---
Hi Dmitry, thanks for flagging. I've addressed the double-free in a separate patch.

Thanks,
Michael

 drivers/gpu/drm/msm/dsi/dsi_host.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 64fc54dff4..3feb260a31 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -1301,9 +1301,11 @@ void msm_dsi_tx_buf_free(struct mipi_dsi_host *host)
 		msm_host->vm = NULL;
 	}
 
-	if (msm_host->tx_buf)
+	if (msm_host->tx_buf) {
 		dma_free_coherent(dev->dev, msm_host->tx_size, msm_host->tx_buf,
 			msm_host->tx_buf_paddr);
+		msm_host->tx_buf = NULL;
+	}
 }
 
 void *dsi_tx_buf_get_6g(struct msm_dsi_host *msm_host)
-- 
2.39.5