From patchwork Wed Apr 2 08:36:25 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: AngeloGioacchino Del Regno X-Patchwork-Id: 14035653 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 374ADC28B20 for ; Wed, 2 Apr 2025 08:36:45 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id AE07E10E70F; Wed, 2 Apr 2025 08:36:41 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=collabora.com header.i=@collabora.com header.b="T2dM7mnl"; dkim-atps=neutral Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) by gabe.freedesktop.org (Postfix) with ESMTPS id C8C6510E70C for ; Wed, 2 Apr 2025 08:36:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1743582997; bh=q9gkJHzvjfpt83qtbZofheYpOUw1WDB4WQBgLWzwjPw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=T2dM7mnlCbjSMegWXKPfmZnDiHCvP2S8U9UO6vIupTp7U/nCk8EbuHWieUQGtmCWV HpSm6w1VylC9hNUsgm2PJEY4QKxk+meUud7WO8CxrHhMfZpRWC40xKfCrY5EACWnHL Pyb3LTpQT0G6f9MgM7M4y0Qr/Yp4c8MV2IM+wRJKwb4lMwlAbs02INQKknj5eoB6mu 4VY9KDdePnEgAqWYBVYQ9IEU6L/zxu67IbnMHctj6SrHHUaZUxZAdlf7DMBaEGXrba W3ug9NYg+VjdEYqZM4rbh8+UIOp+TLnSgKn/QCaqKsJERjpHBvJz209706vkVwTH8p CeiK1O0cRcGOw== Received: from IcarusMOD.eternityproject.eu (2-237-20-237.ip236.fastwebnet.it [2.237.20.237]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: kholk11) by bali.collaboradmins.com (Postfix) with ESMTPSA id 8379117E014F; Wed, 2 Apr 2025 10:36:36 +0200 (CEST) From: AngeloGioacchino Del Regno To: chunkuang.hu@kernel.org Cc: p.zabel@pengutronix.de, airlied@gmail.com, simona@ffwll.ch, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, nancy.lin@mediatek.com, ck.hu@mediatek.com, djkurtz@chromium.org, littlecvr@chromium.org, bibby.hsieh@mediatek.com, dri-devel@lists.freedesktop.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, wenst@chromium.org, kernel@collabora.com Subject: [PATCH v1 2/5] drm/mediatek: Fix kobject put for component sub-drivers Date: Wed, 2 Apr 2025 10:36:25 +0200 Message-ID: <20250402083628.20111-3-angelogioacchino.delregno@collabora.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250402083628.20111-1-angelogioacchino.delregno@collabora.com> References: <20250402083628.20111-1-angelogioacchino.delregno@collabora.com> MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" In function mtk_drm_get_all_priv(), this driver is incrementing the refcount for the sub-drivers of mediatek-drm with a call to device_find_child() when taking a reference to all of those child devices. When the component bind fails multiple times this results in a refcount_t overflow, as the reference count is never decremented: fix that by adding a call to put_device() for all of the mmsys devices in a loop, in error cases of mtk_drm_bind() and in the mtk_drm_unbind() callback. Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support") Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai --- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c index a8fbccb50c74..6b31df587507 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c @@ -676,6 +676,10 @@ static int mtk_drm_bind(struct device *dev) for (i = 0; i < private->data->mmsys_dev_num; i++) private->all_drm_private[i]->drm = NULL; err_put_dev: + for (i = 0; i < private->data->mmsys_dev_num; i++) { + /* For device_find_child in mtk_drm_get_all_priv() */ + put_device(private->all_drm_private[i]->dev); + } put_device(private->mutex_dev); return ret; } @@ -683,6 +687,7 @@ static int mtk_drm_bind(struct device *dev) static void mtk_drm_unbind(struct device *dev) { struct mtk_drm_private *private = dev_get_drvdata(dev); + int i; /* for multi mmsys dev, unregister drm dev in mmsys master */ if (private->drm_master) { @@ -690,6 +695,10 @@ static void mtk_drm_unbind(struct device *dev) mtk_drm_kms_deinit(private->drm); drm_dev_put(private->drm); + for (i = 0; i < private->data->mmsys_dev_num; i++) { + /* For device_find_child in mtk_drm_get_all_priv() */ + put_device(private->all_drm_private[i]->dev); + } put_device(private->mutex_dev); } private->mtk_drm_bound = false;