From: "Danilo Krummrich" <dakr@kernel.org>
To: "Alvin Sun" <alvin.sun@linux.dev>
Cc: "Miguel Ojeda" <ojeda@kernel.org>,
"Boqun Feng" <boqun@kernel.org>, "Gary Guo" <gary@garyguo.net>,
"Björn Roy Baron" <bjorn3_gh@protonmail.com>,
"Benno Lossin" <lossin@kernel.org>,
"Andreas Hindborg" <a.hindborg@kernel.org>,
"Alice Ryhl" <aliceryhl@google.com>,
"Trevor Gross" <tmgross@umich.edu>,
"Daniel Almeida" <daniel.almeida@collabora.com>,
"Tamir Duberstein" <tamird@kernel.org>,
"Alexandre Courbot" <acourbot@nvidia.com>,
"Onur Özkan" <work@onurozkan.dev>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Rafael J. Wysocki" <rafael@kernel.org>,
"Maarten Lankhorst" <maarten.lankhorst@linux.intel.com>,
"Maxime Ripard" <mripard@kernel.org>,
"Thomas Zimmermann" <tzimmermann@suse.de>,
"David Airlie" <airlied@gmail.com>,
"Simona Vetter" <simona@ffwll.ch>,
"Alexander Viro" <viro@zeniv.linux.org.uk>,
"Christian Brauner" <brauner@kernel.org>,
"Jan Kara" <jack@suse.cz>,
"Matthew Brost" <matthew.brost@intel.com>,
"Thomas Hellström" <thomas.hellstrom@linux.intel.com>,
"Maíra Canal" <mcanal@igalia.com>,
"Melissa Wen" <mwen@igalia.com>,
"Wambui Karuga" <wambui.karugax@gmail.com>,
"Eric Anholt" <eric@anholt.net>, "Ben Gamari" <bgamari@gmail.com>,
rust-for-linux@vger.kernel.org, driver-core@lists.linux.dev,
dri-devel@lists.freedesktop.org
Subject: Re: [PATCH v2 9/9] drm/debugfs: hold device reference for the lifetime of open files
Date: Mon, 03 Aug 2026 19:56:39 +0200 [thread overview]
Message-ID: <DKFI3UD0X731.1X9513GWW3LT7@kernel.org> (raw)
In-Reply-To: <20260731-tyr-debugfs-v2-v2-9-aea19eccb996@linux.dev>
On Thu Jul 30, 2026 at 7:05 PM CEST, Alvin Sun wrote:
> Hold a device reference (via drm_dev_get/put) across the lifetime of open
> debugfs files. Prevents use-after-free when a device is unregistered while
> a debugfs file remains open. Both drm_debugfs_open (legacy info_list)
> and drm_debugfs_entry_open (drm_debugfs_add_file) paths are covered.
>
> Fixes: 1c9cacbea8805 ("drm/debugfs: create device-centered debugfs functions")
> Fixes: 28a62277e06f9 ("drm: Convert proc files to seq_file and introduce debugfs")
>
> Signed-off-by: Alvin Sun <alvin.sun@linux.dev>
> ---
> drivers/gpu/drm/drm_debugfs.c | 42 ++++++++++++++++++++++++++++++++++++++----
> 1 file changed, 38 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
> index 38cf6ce387cc8..5262a708f1602 100644
> --- a/drivers/gpu/drm/drm_debugfs.c
> +++ b/drivers/gpu/drm/drm_debugfs.c
> @@ -159,11 +159,28 @@ static const struct drm_debugfs_info drm_debugfs_list[] = {
> static int drm_debugfs_open(struct inode *inode, struct file *file)
> {
> struct drm_info_node *node = inode->i_private;
> + struct drm_device *dev = node->minor->dev;
> + int ret;
>
> if (!device_is_registered(node->minor->kdev))
> return -ENODEV;
>
> - return single_open(file, node->info_ent->show, node);
> + drm_dev_get(dev);
> +
> + ret = single_open(file, node->info_ent->show, node);
> + if (ret)
> + drm_dev_put(dev);
> +
> + return ret;
> +}
> +
> +static int drm_debugfs_release(struct inode *inode, struct file *file)
> +{
> + struct drm_info_node *node =
> + ((struct seq_file *)file->private_data)->private;
> +
> + drm_dev_put(node->minor->dev);
> + return single_release(inode, file);
> }
This isn't needed; in drm_dev_unregister() we call debugfs_remove_recursive(),
which already waits for all in-flight file operations. The DRM device itself is
guaranteed to be valid as long as it is registered.
prev parent reply other threads:[~2026-08-03 17:56 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-30 17:05 [PATCH v2 0/9] drm/tyr: add debugfs support Alvin Sun
2026-07-30 17:05 ` [PATCH v2 1/9] rust: seq_file: add as_raw() method Alvin Sun
2026-07-30 17:05 ` [PATCH v2 2/9] rust: debugfs: add SeqShow trait and seq_file file operations Alvin Sun
2026-07-31 13:08 ` Alice Ryhl
2026-07-31 16:52 ` Alvin Sun
2026-08-03 15:05 ` Alice Ryhl
2026-08-03 15:23 ` Danilo Krummrich
2026-07-30 17:05 ` [PATCH v2 3/9] rust: debugfs: add Entry::from_raw and ScopedDir::from_dentry Alvin Sun
2026-08-03 17:55 ` Danilo Krummrich
2026-07-30 17:05 ` [PATCH v2 4/9] drm: move debugfs_init after dev->registered is set Alvin Sun
2026-07-30 17:05 ` [PATCH v2 5/9] rust: drm: add debugfs_init callback to Driver trait Alvin Sun
2026-08-03 17:55 ` Danilo Krummrich
2026-07-30 17:05 ` [PATCH v2 6/9] rust: drm: add DrmSeqShow seq_file adapter Alvin Sun
2026-08-03 17:56 ` Danilo Krummrich
2026-07-30 17:05 ` [PATCH v2 7/9] rust: drm: gpuvm: add dump_gpuva_info to UniqueRefGpuVm Alvin Sun
2026-07-31 13:01 ` Alice Ryhl
2026-07-30 17:05 ` [PATCH v2 8/9] drm/tyr: add gpuvas debugfs file Alvin Sun
2026-07-31 12:59 ` Alice Ryhl
2026-07-31 16:29 ` Daniel Almeida
2026-08-03 17:56 ` Danilo Krummrich
2026-07-30 17:05 ` [PATCH v2 9/9] drm/debugfs: hold device reference for the lifetime of open files Alvin Sun
2026-08-03 17:56 ` Danilo Krummrich [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DKFI3UD0X731.1X9513GWW3LT7@kernel.org \
--to=dakr@kernel.org \
--cc=a.hindborg@kernel.org \
--cc=acourbot@nvidia.com \
--cc=airlied@gmail.com \
--cc=aliceryhl@google.com \
--cc=alvin.sun@linux.dev \
--cc=bgamari@gmail.com \
--cc=bjorn3_gh@protonmail.com \
--cc=boqun@kernel.org \
--cc=brauner@kernel.org \
--cc=daniel.almeida@collabora.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=driver-core@lists.linux.dev \
--cc=eric@anholt.net \
--cc=gary@garyguo.net \
--cc=gregkh@linuxfoundation.org \
--cc=jack@suse.cz \
--cc=lossin@kernel.org \
--cc=maarten.lankhorst@linux.intel.com \
--cc=matthew.brost@intel.com \
--cc=mcanal@igalia.com \
--cc=mripard@kernel.org \
--cc=mwen@igalia.com \
--cc=ojeda@kernel.org \
--cc=rafael@kernel.org \
--cc=rust-for-linux@vger.kernel.org \
--cc=simona@ffwll.ch \
--cc=tamird@kernel.org \
--cc=thomas.hellstrom@linux.intel.com \
--cc=tmgross@umich.edu \
--cc=tzimmermann@suse.de \
--cc=viro@zeniv.linux.org.uk \
--cc=wambui.karugax@gmail.com \
--cc=work@onurozkan.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox