From 3fdeae134ba956aacbd87d5532c025913c98fc49 Mon Sep 17 00:00:00 2001 From: Luca Ceresoli Date: Tue, 16 Dec 2025 18:58:39 +0100 Subject: [PATCH] drm/bridge: add next_bridge pointer to struct drm_bridge Many bridge drivers store a next_bridge pointer in their private data and use it for attach and sometimes other purposes. This is going to be risky when bridge hot-unplug is used. Considering this example scenario: 1. pipeline: encoder --> bridge A --> bridge B --> bridge C 2. encoder takes a reference to bridge B 3. bridge B takes a next_bridge reference to bridge C 4. encoder calls (bridge B)->b_foo(), which in turns references next_bridge, e.g.: b_foo() { bar(b->next_bridge); } If bridges B and C are removed, bridge C can be freed but B is still allocated because the encoder holds a reference to B. So when step 4 happens, 'b->next-bridge' would be a use-after-free. Calling drm_bridge_put() in the B bridge .remove function does not solve the problem as it leaves a (potentially long) risk window between B removal and the final deallocation of B. A safe moment to put the B reference is in __drm_bridge_free(), when the last reference has been put. This can be done by drivers in the .destroy func. However to avoid the need for so many drivers to implement a .destroy func, just offer a next_bridge pointer to all bridges that is automatically put it in __drm_bridge_free(), exactly when the .destroy func is called. Suggested-by: Maxime Ripard Link: https://lore.kernel.org/all/20251201-thick-jasmine-oarfish-1eceb0@houat/ Reviewed-by: Maxime Ripard Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-6-b5165fab8058@bootlin.com Signed-off-by: Luca Ceresoli --- drivers/gpu/drm/drm_bridge.c | 2 ++ include/drm/drm_bridge.h | 11 +++++++++++ 2 files changed, 13 insertions(+) diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c index 64aa69dcf46f..6dcf8f6d3ecf 100644 --- a/drivers/gpu/drm/drm_bridge.c +++ b/drivers/gpu/drm/drm_bridge.c @@ -275,6 +275,8 @@ static void __drm_bridge_free(struct kref *kref) if (bridge->funcs->destroy) bridge->funcs->destroy(bridge); + drm_bridge_put(bridge->next_bridge); + kfree(bridge->container); } diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h index 42ec33116d18..3e6cbfa9dc44 100644 --- a/include/drm/drm_bridge.h +++ b/include/drm/drm_bridge.h @@ -1279,6 +1279,17 @@ struct drm_bridge { * @hpd_cb. */ void *hpd_data; + + /** + * @next_bridge: Pointer to the following bridge, automatically put + * when this bridge is freed (i.e. at destroy time). This is for + * drivers needing to store a pointer to the next bridge in the + * chain, and ensures any code still holding a reference to this + * bridge after its removal cannot use-after-free the next + * bridge. Any other bridge pointers stored by the driver must be + * put in the .destroy callback by driver code. + */ + struct drm_bridge *next_bridge; }; static inline struct drm_bridge * -- 2.47.3