Re: [PATCH v2 6/6] drm/i915/display: Allow forcing the joiner on eDP

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] drm/i915: data race on connector->force_joined_pipes via debugfs
--

commit 45be7b5e2e6fcbea23658dd271134587c4797f89
Author: Mika Kahola <mika.kahola@intel.com>

drm/i915/display: Allow forcing the joiner on eDP

intel_dp_has_joiner() rejects eDP unless the VBT enables the pipe
joiner, and the debugfs file is only created when that returns true, so
i915_joiner_force_enable can never turn it on.

Always create the file for DP and eDP, and let a forced pipe count
above one override the VBT.

> diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
> index d8c0d9381471d..ec0b4885e33ac 100644
> --- a/drivers/gpu/drm/i915/display/intel_dp.c
> +++ b/drivers/gpu/drm/i915/display/intel_dp.c

[ ... ]

> @@ -473,9 +473,15 @@ bool intel_dp_has_joiner(struct intel_dp *intel_dp)
>  	if (intel_dp->mso_link_count)
>  		return false;
>  
> -	if (intel_dp_is_edp(intel_dp) &&
> -	    !connector->panel.vbt.edp.pipe_joiner_enable)
> -		return false;
> +	if (intel_dp_is_edp(intel_dp)) {
> +		bool pipe_joiner_enable = connector->panel.vbt.edp.pipe_joiner_enable;
> +
> +		if (connector->force_joined_pipes > 1)

[Severity: Low]
Does this code introduce a data race with debugfs?

The debugfs handler i915_joiner_write() locklessly modifies
connector->force_joined_pipes:

drivers/gpu/drm/i915/display/intel_display_debugfs.c:i915_joiner_write() {
    ...
    connector->force_joined_pipes = force_joined_pipes;
    ...
}

Meanwhile, this read in intel_dp_has_joiner() during an atomic modeset
happens without holding any lock shared with the debugfs write path.

This problem wasn't introduced by this patch, but this commit expands a
similar pattern found in intel_dp_joiner_candidate_valid(), where a
double-read can cause a TOCTOU flaw if the compiler reloads the value
between reads:

drivers/gpu/drm/i915/display/intel_dp.c:intel_dp_joiner_candidate_valid() {
    ...
    if (connector->force_joined_pipes && connector->force_joined_pipes != num_joined_pipes)
        return false;
    ...
}

Could a lock or READ_ONCE() and WRITE_ONCE() annotations be added to
safely serialize or annotate these accesses?

> +			pipe_joiner_enable = true;
> +
> +		if (!pipe_joiner_enable)
> +			return false;
> +	}
>  
>  	return DISPLAY_VER(display) >= 12 ||
>  		(DISPLAY_VER(display) == 11 &&

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012124145.1960050-1-mika.kahola@intel.com?part=6