Re: [PATCH v2 9/9] drm/debugfs: hold device reference for the lifetime of open files

Alvin Sun <[email protected]>
Newsgroups org.freedesktop.lists.dri-devel,dev.linux.lists.driver-core,org.kernel.vger.rust-for-linux
Message-ID <[email protected]>
On 8/4/26 01:56, Danilo Krummrich wrote:
> On Thu Jul 30, 2026 at 7:05 PM CEST, Alvin Sun wrote:
>> Hold a device reference (via drm_dev_get/put) across the lifetime of open
>> debugfs files. Prevents use-after-free when a device is unregistered while
>> a debugfs file remains open. Both drm_debugfs_open (legacy info_list)
>> and drm_debugfs_entry_open (drm_debugfs_add_file) paths are covered.
>>
>> Fixes: 1c9cacbea8805 ("drm/debugfs: create device-centered debugfs functions")
>> Fixes: 28a62277e06f9 ("drm: Convert proc files to seq_file and introduce debugfs")
>>
>> Signed-off-by: Alvin Sun <[email protected]>
>> ---
>>   drivers/gpu/drm/drm_debugfs.c | 42 ++++++++++++++++++++++++++++++++++++++----
>>   1 file changed, 38 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
>> index 38cf6ce387cc8..5262a708f1602 100644
>> --- a/drivers/gpu/drm/drm_debugfs.c
>> +++ b/drivers/gpu/drm/drm_debugfs.c
>> @@ -159,11 +159,28 @@ static const struct drm_debugfs_info drm_debugfs_list[] = {
>>   static int drm_debugfs_open(struct inode *inode, struct file *file)
>>   {
>>   	struct drm_info_node *node = inode->i_private;
>> +	struct drm_device *dev = node->minor->dev;
>> +	int ret;
>>   
>>   	if (!device_is_registered(node->minor->kdev))
>>   		return -ENODEV;
>>   
>> -	return single_open(file, node->info_ent->show, node);
>> +	drm_dev_get(dev);
>> +
>> +	ret = single_open(file, node->info_ent->show, node);
>> +	if (ret)
>> +		drm_dev_put(dev);
>> +
>> +	return ret;
>> +}
>> +
>> +static int drm_debugfs_release(struct inode *inode, struct file *file)
>> +{
>> +	struct drm_info_node *node =
>> +		((struct seq_file *)file->private_data)->private;
>> +
>> +	drm_dev_put(node->minor->dev);
>> +	return single_release(inode, file);
>>   }
> This isn't needed; in drm_dev_unregister() we call debugfs_remove_recursive(),
> which already waits for all in-flight file operations. The DRM device itself is
> guaranteed to be valid as long as it is registered.

Thanks for the review. Sorry for the delay — I was on vacation the last 
few days.

v3 is ready, incorporating the feedback, and I'll send it out shortly.

Best regards,
Alvin
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.