Re: [PATCH v2 9/9] drm/debugfs: hold device reference for the lifetime of open files

On Thu Jul 30, 2026 at 7:05 PM CEST, Alvin Sun wrote:
> Hold a device reference (via drm_dev_get/put) across the lifetime of open
> debugfs files. Prevents use-after-free when a device is unregistered whil=
e
> a debugfs file remains open. Both drm_debugfs_open (legacy info_list)
> and drm_debugfs_entry_open (drm_debugfs_add_file) paths are covered.
>
> Fixes: 1c9cacbea8805 ("drm/debugfs: create device-centered debugfs functi=
ons")
> Fixes: 28a62277e06f9 ("drm: Convert proc files to seq_file and introduce =
debugfs")
>
> Signed-off-by: Alvin Sun <[email protected]>
> ---
>  drivers/gpu/drm/drm_debugfs.c | 42 +++++++++++++++++++++++++++++++++++++=
+----
>  1 file changed, 38 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.=
c
> index 38cf6ce387cc8..5262a708f1602 100644
> --- a/drivers/gpu/drm/drm_debugfs.c
> +++ b/drivers/gpu/drm/drm_debugfs.c
> @@ -159,11 +159,28 @@ static const struct drm_debugfs_info drm_debugfs_li=
st[] =3D {
>  static int drm_debugfs_open(struct inode *inode, struct file *file)
>  {
>  	struct drm_info_node *node =3D inode->i_private;
> +	struct drm_device *dev =3D node->minor->dev;
> +	int ret;
> =20
>  	if (!device_is_registered(node->minor->kdev))
>  		return -ENODEV;
> =20
> -	return single_open(file, node->info_ent->show, node);
> +	drm_dev_get(dev);
> +
> +	ret =3D single_open(file, node->info_ent->show, node);
> +	if (ret)
> +		drm_dev_put(dev);
> +
> +	return ret;
> +}
> +
> +static int drm_debugfs_release(struct inode *inode, struct file *file)
> +{
> +	struct drm_info_node *node =3D
> +		((struct seq_file *)file->private_data)->private;
> +
> +	drm_dev_put(node->minor->dev);
> +	return single_release(inode, file);
>  }

This isn't needed; in drm_dev_unregister() we call debugfs_remove_recursive=
(),
which already waits for all in-flight file operations. The DRM device itsel=
f is
guaranteed to be valid as long as it is registered.