From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C6E8720E03F; Mon, 13 Oct 2025 16:25:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.85.4 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760372704; cv=none; b=O6nZTw7PrTL93RfZIm6iRuWo1pnY2iENgTeCR/7f0dnN89cklTCBuqhlRE+rTtuoe96VxAFQvMLu/A+BK/Cbdbfn8imz9v71kbeYGTeuyWyVGSuyTEfKS0oBOZrcvFhRxE04Zig6QHUlWIhuHyBnEMI2i4TJkDSEowNrdAh6iN4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760372704; c=relaxed/simple; bh=LL/jGdgQJ90AWuzd5LGIpGz74iyqDUJabfmgYeb+peI=; h=From:Subject:Date:Message-Id:MIME-Version:Content-Type:To:Cc; b=QLZL+hWMjKP7k4w6XmAH7DS/q9i2BC5wO98J9Ku/H0ekim9STQKlCBtNKREzp2t9eT1EPB+mAT67yyNz4Zz7AcUrHesmEJrvaaL/Rn+Y7gI9FQyMnidy+Mn7fWWgKc0ZHbQclkfn6GsF0qiFQcdPlLIrmsOI848nr3+5vSTFOEA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=04OTVAjT; arc=none smtp.client-ip=185.246.85.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="04OTVAjT" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id D89684E4102F; Mon, 13 Oct 2025 16:24:59 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 9DF6A6067B; Mon, 13 Oct 2025 16:24:59 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 98BE7102F2240; Mon, 13 Oct 2025 18:24:32 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1760372697; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding; bh=PC31koJdVp7I18KJXXznsupuFReAJu7dqL5WcMJcy3A=; b=04OTVAjTiOEFsDi5yuKJEPPMia+eupmavbDoA7y9ukJCInFmK1cylzLMINZpgRiKkjS12R LHD1uKGL0p4tiUjnB760f9sOkZbD072dMYy2ndR8Q1xN4kIu4ig4qZnV8CdJkckoMLui+D NV8q+5fjRt5FWWtTT5Pz1ZATGth7vynV5yEPDJcODpBltuIZj5/1X/Aa4+8Tv+CrIJSdZz CT/iRbBrdfgm0YaFNloPsvdwqK1mQEQzLU+8Ibg7GMTbfYllbtOreoa6w4psXE2nlABLY9 b4JA2+aW1E5j1pbLPT5DLwhnEulgEwtuOly7fAUjaROdsK8sqTwtzOd/1iomrg== From: Luca Ceresoli Subject: [PATCH 0/2] drm/atomic: protect bridge private_obj during bridge removal Date: Mon, 13 Oct 2025 18:24:21 +0200 Message-Id: <20251013-drm-bridge-atomic-vs-remove-private_obj-v1-0-1fc2e58102e0@bootlin.com> Precedence: bulk X-Mailing-List: linux-mips@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit X-B4-Tracking: v=1; b=H4sIALUn7WgC/x2N0QqDMAwAf0XyvEDbIW7+iozRNtFlUCuplIH47 ys+Hgd3BxRW4QJjd4BylSJ5bWBvHcSPXxdGocbgjOutsXckTRhUqBm/5yQRa0HllCvjplL9zu8 cvkjD0z1MHzhQhFbblGf5XafpdZ5/1Mbq7nkAAAA= X-Change-ID: 20251013-drm-bridge-atomic-vs-remove-private_obj-d792805bebdc To: Harry Wentland , Leo Li , Rodrigo Siqueira , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= , David Airlie , Simona Vetter , Liviu Dudau , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Paul Cercueil , Rob Clark , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , Tomi Valkeinen , Thierry Reding , Mikko Perttunen , Jonathan Hunter , Dave Stevenson , =?utf-8?q?Ma=C3=ADra_Canal?= , Raspberry Pi Kernel Maintenance Cc: Hui Pu , Thomas Petazzoni , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, linux-mips@vger.kernel.org, linux-arm-msm@vger.kernel.org, freedreno@lists.freedesktop.org, linux-tegra@vger.kernel.org, Luca Ceresoli X-Mailer: b4 0.14.2 X-Last-TLS-Session-Version: TLSv1.3 This series avoids a race between DRM bridge removal and usage of the bridge private_obj during DRM_MODESET_LOCK_ALL_BEGIN/END() and other locking operations. This is part of the work towards removal of bridges from a still existing DRM pipeline without use-after-free. The grand plan was discussed in [0]. Here's the work breakdown (➜ marks the current series): 1. … add refcounting to DRM bridges (struct drm_bridge) (based on devm_drm_bridge_alloc() [0]) A. ✔ add new alloc API and refcounting (v6.16) B. ✔ convert all bridge drivers to new API (v6.17) C. ✔ kunit tests (v6.17) D. ✔ add get/put to drm_bridge_add/remove() + attach/detach() and warn on old allocation pattern (v6.17) E. … add get/put on drm_bridge accessors 1. ✔ drm_bridge_chain_get_first_bridge(), add cleanup action (v6.18) 2. ✔ drm_bridge_get_prev_bridge() (v6.18) 3. ✔ drm_bridge_get_next_bridge() (v6.19) 4. ✔ drm_for_each_bridge_in_chain() (v6.19) 5. ✔ drm_bridge_connector_init (v6.19) 6. … protect encoder bridge chain with a mutex 7. of_drm_find_bridge 8. drm_of_find_panel_or_bridge, *_of_get_bridge 9. … enforce drm_bridge_add before drm_bridge_attach F. ✔ debugfs improvements 1. ✔ add top-level 'bridges' file (v6.16) 2. ✔ show refcount and list lingering bridges (v6.19) 2. ➜ handle gracefully atomic updates during bridge removal A. … Add drm_dev_enter/exit() to protect device resources B. ➜ protect private_obj removal from list 3. … DSI host-device driver interaction 4. ✔ removing the need for the "always-disconnected" connector 5. finish the hotplug bridge work, moving code to the core and potentially removing the hotplug-bridge itself (this needs to be clarified as points 1-3 are developed) [0] https://lore.kernel.org/lkml/20250206-hotplug-drm-bridge-v6-0-9d6f2c9c3058@bootlin.com/#t The need for this series emerged during testing of DRM bridge hot-plugging. Very rarely on hot-unplug the following warning has appeared: WARNING: CPU: 0 PID: 123 at include/drm/drm_modeset_lock.h:114 drm_atomic_private_obj_fini+0x64/0x80 ... Call trace: drm_atomic_private_obj_fini+0x64/0x80 drm_bridge_detach+0x38/0x98 The actual change is in patch 2 along with a detailed explanation. Patch 1 is just a preparation step. Signed-off-by: Luca Ceresoli --- Luca Ceresoli (2): drm/atomic: pass drm_device pointer to drm_atomic_private_obj_fini() drm_atomic_private_obj_fini: protect private_obj removal from list drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- drivers/gpu/drm/arm/display/komeda/komeda_private_obj.c | 2 +- drivers/gpu/drm/display/drm_dp_mst_topology.c | 2 +- drivers/gpu/drm/display/drm_dp_tunnel.c | 2 +- drivers/gpu/drm/drm_atomic.c | 9 ++++++++- drivers/gpu/drm/drm_bridge.c | 2 +- drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 2 +- drivers/gpu/drm/ingenic/ingenic-ipu.c | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c | 2 +- drivers/gpu/drm/omapdrm/omap_drv.c | 2 +- drivers/gpu/drm/tegra/hub.c | 2 +- drivers/gpu/drm/vc4/vc4_kms.c | 6 +++--- include/drm/drm_atomic.h | 3 ++- 14 files changed, 24 insertions(+), 16 deletions(-) --- base-commit: 3b80ba4fb2d81c77cfef535b202162cbb8aa1f6e change-id: 20251013-drm-bridge-atomic-vs-remove-private_obj-d792805bebdc Best regards, -- Luca Ceresoli