From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F74D432E98; Thu, 30 Jul 2026 17:05:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785431151; cv=none; b=H416gQCOZvyumF8dcuyoXn+8ZZSL6p7jv1Uq2uFemOLCjtiS9bLkAIq7mydauaN4hmUMh48+TzyiV/sdHZyUIS4wgYdzBbTxemQtf17pHeHbZMu5a5+pQ/ROOCbWG3qHWD9BzlfE9b9UYdhpws2u2mpHlfE9JsEAYL6AX/sf3ic= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785431151; c=relaxed/simple; bh=skA4KVHM8LMz73TA56MQb3n/Ixh2G2cs8JHXFUZaNIU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=lOommcaIou1m1Aa7sWZA3oYUf62hjiEeNFaJg7vMiUpYG32o8ccvYCT6SG3Ntcq0oJGfbZitreL6QR8eLmOFzPh1dsyaQ84MGrN3iD29zjQ/QeHZcVnet13y295QiG67QZLlqs7rszMLB3L8FaCifFjESFyrEoNOKVUC9RHtQXg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=yYmeCtbD; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="yYmeCtbD" Received: by smtp.kernel.org (Postfix) with ESMTPS id 50F43C2BCFD; Thu, 30 Jul 2026 17:05:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux.dev; s=korg; t=1785431151; bh=skA4KVHM8LMz73TA56MQb3n/Ixh2G2cs8JHXFUZaNIU=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=yYmeCtbDDCLxHrj4UeDlPOHGZybc9oRgoiMKd28LLLlNo1cSoFpL7QOtdAkz+YdeN I6Fkd9CbjRViQsDDTNjpHa5h+2w9HXvwr6DmQDhGaZ/8lUscQJ7Itc9jTpUP3bLK3Q XN2ki20ASAGy4KBwoqSuqpTfhmKkckBGVQF5+BjY= Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 37A77C55171; Thu, 30 Jul 2026 17:05:51 +0000 (UTC) From: Alvin Sun Date: Fri, 31 Jul 2026 01:05:47 +0800 Subject: [PATCH v2 9/9] drm/debugfs: hold device reference for the lifetime of open files Precedence: bulk X-Mailing-List: driver-core@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260731-tyr-debugfs-v2-v2-9-aea19eccb996@linux.dev> References: <20260731-tyr-debugfs-v2-v2-0-aea19eccb996@linux.dev> In-Reply-To: <20260731-tyr-debugfs-v2-v2-0-aea19eccb996@linux.dev> To: Miguel Ojeda , Boqun Feng , Gary Guo , =?utf-8?q?Bj=C3=B6rn_Roy_Baron?= , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich , Daniel Almeida , Tamir Duberstein , Alexandre Courbot , =?utf-8?q?Onur_=C3=96zkan?= , Greg Kroah-Hartman , "Rafael J. Wysocki" , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter Cc: Alexander Viro , Christian Brauner , Jan Kara , Matthew Brost , =?utf-8?q?Thomas_Hellstr=C3=B6m?= , =?utf-8?q?Ma=C3=ADra_Canal?= , Melissa Wen , Wambui Karuga , Eric Anholt , Ben Gamari , rust-for-linux@vger.kernel.org, driver-core@lists.linux.dev, dri-devel@lists.freedesktop.org, Alvin Sun X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1785431148; l=3132; i=alvin.sun@linux.dev; s=20260317; h=from:subject:message-id; bh=skA4KVHM8LMz73TA56MQb3n/Ixh2G2cs8JHXFUZaNIU=; b=byirK3xd7xbmRD0KNzAAenKpeldvUER6QjL52yREv13nnnfpFq5CGiZ65r+lwQ7WTBzZbuVjH 2PRTkN6XUtDB1MhPnoqzBmw/q8DJSTtfx8+g8cJQ91uO8Obgrcp4MCI X-Developer-Key: i=alvin.sun@linux.dev; a=ed25519; pk=CHcwQp8GSoj25V/L1ZWNSQjWp9eSIb0s9LKr0Nm3WuE= X-Endpoint-Received: by B4 Relay for alvin.sun@linux.dev/20260317 with auth_id=684 Hold a device reference (via drm_dev_get/put) across the lifetime of open debugfs files. Prevents use-after-free when a device is unregistered while a debugfs file remains open. Both drm_debugfs_open (legacy info_list) and drm_debugfs_entry_open (drm_debugfs_add_file) paths are covered. Fixes: 1c9cacbea8805 ("drm/debugfs: create device-centered debugfs functions") Fixes: 28a62277e06f9 ("drm: Convert proc files to seq_file and introduce debugfs") Signed-off-by: Alvin Sun --- drivers/gpu/drm/drm_debugfs.c | 42 ++++++++++++++++++++++++++++++++++++++---- 1 file changed, 38 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c index 38cf6ce387cc8..5262a708f1602 100644 --- a/drivers/gpu/drm/drm_debugfs.c +++ b/drivers/gpu/drm/drm_debugfs.c @@ -159,11 +159,28 @@ static const struct drm_debugfs_info drm_debugfs_list[] = { static int drm_debugfs_open(struct inode *inode, struct file *file) { struct drm_info_node *node = inode->i_private; + struct drm_device *dev = node->minor->dev; + int ret; if (!device_is_registered(node->minor->kdev)) return -ENODEV; - return single_open(file, node->info_ent->show, node); + drm_dev_get(dev); + + ret = single_open(file, node->info_ent->show, node); + if (ret) + drm_dev_put(dev); + + return ret; +} + +static int drm_debugfs_release(struct inode *inode, struct file *file) +{ + struct drm_info_node *node = + ((struct seq_file *)file->private_data)->private; + + drm_dev_put(node->minor->dev); + return single_release(inode, file); } static int drm_debugfs_entry_open(struct inode *inode, struct file *file) @@ -171,11 +188,28 @@ static int drm_debugfs_entry_open(struct inode *inode, struct file *file) struct drm_debugfs_entry *entry = inode->i_private; struct drm_debugfs_info *node = &entry->file; struct drm_minor *minor = entry->dev->primary ?: entry->dev->accel; + struct drm_device *dev = entry->dev; + int ret; if (!device_is_registered(minor->kdev)) return -ENODEV; - return single_open(file, node->show, entry); + drm_dev_get(dev); + + ret = single_open(file, node->show, entry); + if (ret) + drm_dev_put(dev); + + return ret; +} + +static int drm_debugfs_entry_release(struct inode *inode, struct file *file) +{ + struct drm_debugfs_entry *entry = + ((struct seq_file *)file->private_data)->private; + + drm_dev_put(entry->dev); + return single_release(inode, file); } static const struct file_operations drm_debugfs_entry_fops = { @@ -183,7 +217,7 @@ static const struct file_operations drm_debugfs_entry_fops = { .open = drm_debugfs_entry_open, .read = seq_read, .llseek = seq_lseek, - .release = single_release, + .release = drm_debugfs_entry_release, }; static const struct file_operations drm_debugfs_fops = { @@ -191,7 +225,7 @@ static const struct file_operations drm_debugfs_fops = { .open = drm_debugfs_open, .read = seq_read, .llseek = seq_lseek, - .release = single_release, + .release = drm_debugfs_release, }; /** -- 2.43.0