From patchwork Tue Mar 25 17:24:09 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anusha Srivatsa X-Patchwork-Id: 14029301 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3CB1BC36008 for ; Tue, 25 Mar 2025 17:24:33 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 0A1E010E5CF; Tue, 25 Mar 2025 17:24:32 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.b="bQHUf4JR"; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by gabe.freedesktop.org (Postfix) with ESMTPS id 5573410E5C8 for ; Tue, 25 Mar 2025 17:24:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1742923468; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HM/1y6ZZeRJGjWVbHgb0Aft5utZNcOq6uww/UkYs2ek=; b=bQHUf4JRpRKSQ0aaxNALxVR9K8IntQoITAGqQoD55jkPu46ne6ua+HSXh4H494aMBotK74 h67ZitfloxBCiea8SlhsxZTgrgNt0bIG5/wFOqICXcnKmdgilA/UmnnjcyxZJUBAjEerty 7CO7e7JTH3YXCYvGRKuormifqeXDZJY= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-61-a4ROO-LjNqOUSyNnH8qz_A-1; Tue, 25 Mar 2025 13:24:23 -0400 X-MC-Unique: a4ROO-LjNqOUSyNnH8qz_A-1 X-Mimecast-MFC-AGG-ID: a4ROO-LjNqOUSyNnH8qz_A_1742923460 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B8C4C1801A1A; Tue, 25 Mar 2025 17:24:19 +0000 (UTC) Received: from asrivats-na.rmtustx.csb (unknown [10.2.16.186]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 3D110180A802; Tue, 25 Mar 2025 17:24:17 +0000 (UTC) From: Anusha Srivatsa Date: Tue, 25 Mar 2025 13:24:09 -0400 Subject: [PATCH 2/5] drm/panel: Add refcount support MIME-Version: 1.0 Message-Id: <20250325-b4-panel-refcounting-v1-2-4e2bf5d19c5d@redhat.com> References: <20250325-b4-panel-refcounting-v1-0-4e2bf5d19c5d@redhat.com> In-Reply-To: <20250325-b4-panel-refcounting-v1-0-4e2bf5d19c5d@redhat.com> To: Neil Armstrong , Jessica Zhang , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Luca Ceresoli , Anusha Srivatsa X-Developer-Signature: v=1; a=ed25519-sha256; t=1742923451; l=4503; i=asrivats@redhat.com; s=20250122; h=from:subject:message-id; bh=o1HBRTXPRYeNBONIQ0BqdgsBaxnckRANpHzMdm/MMqE=; b=Q3umjhdtJGevsBGv7rPrxhnI2ilHCb+QrrSaBzUDG7PFCFLD8o58H3yX9agZ7tMGHfUtrjOpD tdzZiJ7yPCyATV1qa0oH6ah4DnKC5gsMn8uGoKp2PgD//gYsiqa4/UX X-Developer-Key: i=asrivats@redhat.com; a=ed25519; pk=brnIHkBsUZEhyW6Zyn0U92AeIZ1psws/q8VFbIkf1AU= X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Allocate panel via reference counting. Add _get() and _put() helper functions to ensure panel allocations are refcounted. Avoid use after free by ensuring panel is valid and can be usable till the last reference is put. This avoids use-after-free Signed-off-by: Anusha Srivatsa --- drivers/gpu/drm/drm_panel.c | 65 ++++++++++++++++++++++++++++++++++++++++++++- include/drm/drm_panel.h | 19 ++++++++++++- 2 files changed, 82 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c index bdeab5710ee324dc1742fbc77582250960556308..079c3c666a2ddc99a0051d1a3c9ba65d986dd003 100644 --- a/drivers/gpu/drm/drm_panel.c +++ b/drivers/gpu/drm/drm_panel.c @@ -355,24 +355,87 @@ struct drm_panel *of_drm_find_panel(const struct device_node *np) } EXPORT_SYMBOL(of_drm_find_panel); +static void __drm_panel_free(struct kref *kref) +{ + struct drm_panel *panel = container_of(kref, struct drm_panel, refcount); + + kfree(panel->container); +} + +/** + * drm_panel_get - Acquire a panel reference + * @panel: DRM panel + * + * This function increments the panel's refcount. + * + */ +struct drm_panel *drm_panel_get(struct drm_panel *panel) +{ + if (!panel) + return panel; + + kref_get(&panel->refcount); + + return panel; +} + +/** + * drm_panel_put - Release a panel reference + * @panel: DRM panel + * + * This function decrements the panel's reference count and frees the + * object if the reference count drops to zero. + */ +struct drm_panel *drm_panel_put(struct drm_panel *panel) +{ + if (!panel) + return panel; + + kref_put(&panel->refcount, __drm_panel_free); + + return panel; +} + +/** + * drm_bridge_put_void - wrapper to drm_bridge_put() taking a void pointer + * + * @data: pointer to @struct drm_bridge, cast to a void pointer + * + * Wrapper of drm_bridge_put() to be used when a function taking a void + * pointer is needed, for example as a devm action. + */ +static void drm_panel_put_void(void *data) +{ + struct drm_panel *panel = (struct drm_panel *)data; + + drm_panel_put(panel); +} + void *__devm_drm_panel_alloc(struct device *dev, size_t size, size_t offset, const struct drm_panel_funcs *funcs, int connector_type) { void *container; struct drm_panel *panel; + int err; if (!funcs) { dev_warn(dev, "Missing funcs pointer\n"); return ERR_PTR(-EINVAL); } - container = devm_kzalloc(dev, size, GFP_KERNEL); + container = kzalloc(size, GFP_KERNEL); if (!container) return ERR_PTR(-ENOMEM); panel = container + offset; + panel->container = container; panel->funcs = funcs; + kref_init(&panel->refcount); + + err = devm_add_action_or_reset(dev, drm_panel_put_void, panel); + if (err) + return ERR_PTR(err); drm_panel_init(panel, dev, funcs, connector_type); diff --git a/include/drm/drm_panel.h b/include/drm/drm_panel.h index 63fb1dbe15a0556e7484bc18737a6b1f4c208b0c..af81d596f385567a12cf9e08dff9443ce4d97ec0 100644 --- a/include/drm/drm_panel.h +++ b/include/drm/drm_panel.h @@ -267,6 +267,17 @@ struct drm_panel { * If true then the panel has been enabled. */ bool enabled; + + /** + * @container: Pointer to the private driver struct embedding this + * @struct drm_panel. + */ + void *container; + + /** + * @refcount: reference count of users referencing this bridge. + */ + struct kref refcount; }; void *__devm_drm_panel_alloc(struct device *dev, size_t size, size_t offset, @@ -280,7 +291,10 @@ void *__devm_drm_panel_alloc(struct device *dev, size_t size, size_t offset, * @member: the name of the &drm_panel within @type * @funcs: callbacks for this panel * @connector_type: connector type of the driver - * The returned refcount is initialised to 1 + * + * The returned refcount is initialised to 1. This reference will + * be automatically dropped via devm (by calling + * drm_bridge_put()) when @dev is removed. * * Returns: * Pointer to new panel, or ERR_PTR on failure. @@ -294,6 +308,9 @@ void drm_panel_init(struct drm_panel *panel, struct device *dev, const struct drm_panel_funcs *funcs, int connector_type); +struct drm_panel *drm_panel_get(struct drm_panel *panel); +struct drm_panel *drm_panel_put(struct drm_panel *panel); + void drm_panel_add(struct drm_panel *panel); void drm_panel_remove(struct drm_panel *panel);