From: Baihan Li <libai...@huawei.com>

The local variable is passed in request_irq (), and there will be use
after free problem, which will make request_irq failed. Using the global
irq name instead of it to fix.

Fixes: b11bc1ae4658 ("drm/hisilicon/hibmc: Add MSI irq getting and requesting 
for HPD")
Signed-off-by: Baihan Li <libai...@huawei.com>
Signed-off-by: Yongbang Shi <shiyongb...@huawei.com>
---
ChangeLog:
v1 -> v2:
  - add explanations in commit, suggested by Dmitry Baryshkov.
---
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c 
b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
index 768b97f9e74a..4cdcc34070ee 100644
--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
+++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
@@ -32,7 +32,7 @@
 
 DEFINE_DRM_GEM_FOPS(hibmc_fops);
 
-static const char *g_irqs_names_map[HIBMC_MAX_VECTORS] = { "vblank", "hpd" };
+static const char *g_irqs_names_map[HIBMC_MAX_VECTORS] = { "hibmc-vblank", 
"hibmc-hpd" };
 
 static irqreturn_t hibmc_interrupt(int irq, void *arg)
 {
@@ -277,7 +277,6 @@ static void hibmc_unload(struct drm_device *dev)
 static int hibmc_msi_init(struct drm_device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev->dev);
-       char name[32] = {0};
        int valid_irq_num;
        int irq;
        int ret;
@@ -292,9 +291,6 @@ static int hibmc_msi_init(struct drm_device *dev)
        valid_irq_num = ret;
 
        for (int i = 0; i < valid_irq_num; i++) {
-               snprintf(name, ARRAY_SIZE(name) - 1, "%s-%s-%s",
-                        dev->driver->name, pci_name(pdev), 
g_irqs_names_map[i]);
-
                irq = pci_irq_vector(pdev, i);
 
                if (i)
@@ -302,10 +298,10 @@ static int hibmc_msi_init(struct drm_device *dev)
                        ret = devm_request_threaded_irq(&pdev->dev, irq,
                                                        hibmc_dp_interrupt,
                                                        hibmc_dp_hpd_isr,
-                                                       IRQF_SHARED, name, dev);
+                                                       IRQF_SHARED, 
g_irqs_names_map[i], dev);
                else
                        ret = devm_request_irq(&pdev->dev, irq, hibmc_interrupt,
-                                              IRQF_SHARED, name, dev);
+                                              IRQF_SHARED, 
g_irqs_names_map[i], dev);
                if (ret) {
                        drm_err(dev, "install irq failed: %d\n", ret);
                        return ret;
-- 
2.33.0

Reply via email to