Re: [PATCH v2 9/9] drm/debugfs: hold device reference for the lifetime of open files
Alvin Sun <[email protected]>
| Newsgroups | dev.linux.lists.driver-core,org.freedesktop.lists.dri-devel,org.kernel.vger.rust-for-linux |
|---|---|
| Message-ID | <[email protected]> |
On 8/4/26 01:56, Danilo Krummrich wrote:
> On Thu Jul 30, 2026 at 7:05 PM CEST, Alvin Sun wrote:
>> Hold a device reference (via drm_dev_get/put) across the lifetime of open
>> debugfs files. Prevents use-after-free when a device is unregistered while
>> a debugfs file remains open. Both drm_debugfs_open (legacy info_list)
>> and drm_debugfs_entry_open (drm_debugfs_add_file) paths are covered.
>>
>> Fixes: 1c9cacbea8805 ("drm/debugfs: create device-centered debugfs functions")
>> Fixes: 28a62277e06f9 ("drm: Convert proc files to seq_file and introduce debugfs")
>>
>> Signed-off-by: Alvin Sun <[email protected]>
>> ---
>> drivers/gpu/drm/drm_debugfs.c | 42 ++++++++++++++++++++++++++++++++++++++----
>> 1 file changed, 38 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
>> index 38cf6ce387cc8..5262a708f1602 100644
>> --- a/drivers/gpu/drm/drm_debugfs.c
>> +++ b/drivers/gpu/drm/drm_debugfs.c
>> @@ -159,11 +159,28 @@ static const struct drm_debugfs_info drm_debugfs_list[] = {
>> static int drm_debugfs_open(struct inode *inode, struct file *file)
>> {
>> struct drm_info_node *node = inode->i_private;
>> + struct drm_device *dev = node->minor->dev;
>> + int ret;
>>
>> if (!device_is_registered(node->minor->kdev))
>> return -ENODEV;
>>
>> - return single_open(file, node->info_ent->show, node);
>> + drm_dev_get(dev);
>> +
>> + ret = single_open(file, node->info_ent->show, node);
>> + if (ret)
>> + drm_dev_put(dev);
>> +
>> + return ret;
>> +}
>> +
>> +static int drm_debugfs_release(struct inode *inode, struct file *file)
>> +{
>> + struct drm_info_node *node =
>> + ((struct seq_file *)file->private_data)->private;
>> +
>> + drm_dev_put(node->minor->dev);
>> + return single_release(inode, file);
>> }
> This isn't needed; in drm_dev_unregister() we call debugfs_remove_recursive(),
> which already waits for all in-flight file operations. The DRM device itself is
> guaranteed to be valid as long as it is registered.
Thanks for the review. Sorry for the delay — I was on vacation the last
few days.
v3 is ready, incorporating the feedback, and I'll send it out shortly.
Best regards,
Alvin