[PATCH v5 09/10] drm/bridge: samsung-dsim: refcount the out_bridge
From: Luca Ceresoli <luca.ceresoli@bootlin.com>
Date: 2024-12-31 10:40:39
Also in:
dri-devel, lkml
Subsystem:
drm driver for samsung mipi dsim bridge, drm drivers, drm drivers and misc gpu patches, drm drivers for bridge chips, the rest · Maintainers:
Inki Dae, Jagan Teki, Marek Szyprowski, David Airlie, Simona Vetter, Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, Andrzej Hajda, Neil Armstrong, Robert Foss, Linus Torvalds
Refcount the out_bridge to avoid a use-after-free in case it is hot-unplugged. Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> --- This patch was added in v5. --- drivers/gpu/drm/bridge/samsung-dsim.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c
index c4d1563fd32019efde523dfc0863be044c05a826..4d32c453265931b5aecdc125623368fecacf4be3 100644
--- a/drivers/gpu/drm/bridge/samsung-dsim.c
+++ b/drivers/gpu/drm/bridge/samsung-dsim.c@@ -1756,6 +1756,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host, return ret; } + drm_bridge_get(out_bridge); dsi->out_bridge = out_bridge; DRM_DEV_INFO(dev, "Attached %s device (lanes:%d bpp:%d mode-flags:0x%lx)\n",
@@ -1774,13 +1775,13 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host, if (!(device->mode_flags & MIPI_DSI_MODE_VIDEO)) { ret = samsung_dsim_register_te_irq(dsi, &device->dev); if (ret) - return ret; + goto err_put_bridge; } if (pdata->host_ops && pdata->host_ops->attach) { ret = pdata->host_ops->attach(dsi, device); if (ret) - return ret; + goto err_put_bridge; } dsi->lanes = device->lanes;
@@ -1788,6 +1789,10 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host, dsi->mode_flags = device->mode_flags; return 0; + +err_put_bridge: + drm_bridge_put_and_clear(dsi->out_bridge); + return ret; } static void samsung_dsim_unregister_te_irq(struct samsung_dsim *dsi)
@@ -1804,7 +1809,7 @@ static int samsung_dsim_host_detach(struct mipi_dsi_host *host, struct samsung_dsim *dsi = host_to_dsi(host); const struct samsung_dsim_plat_data *pdata = dsi->plat_data; - dsi->out_bridge = NULL; + drm_bridge_put_and_clear(dsi->out_bridge); if (pdata->host_ops && pdata->host_ops->detach) pdata->host_ops->detach(dsi, device);
--
2.34.1