From 17805a15d1751f5d6bb06f924f9bed216feb8db7 Mon Sep 17 00:00:00 2001 From: Luca Ceresoli Date: Mon, 15 Sep 2025 12:12:46 +0200 Subject: [PATCH] drm/bridge: add list of removed refcounted bridges Between drm_bridge_add() and drm_bridge_remove() bridges are registered to the DRM core via the global bridge_list and visible in /sys/kernel/debug/dri/bridges. However between drm_bridge_remove() and the last drm_bridge_put() memory is still allocated even though the bridge is not registered, i.e. not in bridges_list, and also not visible in debugfs. This prevents debugging refcounted bridges lifetime, especially leaks due to a missing drm_bridge_put(). In order to allow debugfs to also show the removed bridges, move such bridges into a new ad-hoc list until they are eventually freed. Note this requires adding INIT_LIST_HEAD(&bridge->list) in the bridge initialization code. The lack of such init was not exposing any bug so far, but it would with the new code, for example when a bridge is allocated and then freed without calling drm_bridge_add(), which is common on probe errors. drm_bridge_add() needs special care for bridges being added after having been previously added and then removed. This happens for example for many non-DCS DSI host bridge drivers like samsung-dsim which drm_bridge_add/remove() themselves every time the DSI device does a DSI attaches/detach. When the DSI device is hot-pluggable this happens multiple times in the lifetime of the DSI host bridge. On every attach after the first one, drm_bridge_add() finds bridge->list in the removed list, not at the initialized state as drm_bridge_add() currently expects. Add a list_del_init() to remove the bridge from the lingering list and bring bridge->list back to the initialized state. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250915-drm-bridge-debugfs-removed-v9-1-6e5c0aff5de9@bootlin.com Signed-off-by: Luca Ceresoli --- drivers/gpu/drm/drm_bridge.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c index 5f265e8b4d49a..034dbe7203bfc 100644 --- a/drivers/gpu/drm/drm_bridge.c +++ b/drivers/gpu/drm/drm_bridge.c @@ -197,15 +197,22 @@ * driver. */ +/* Protect bridge_list and bridge_lingering_list */ static DEFINE_MUTEX(bridge_lock); static LIST_HEAD(bridge_list); +static LIST_HEAD(bridge_lingering_list); static void __drm_bridge_free(struct kref *kref) { struct drm_bridge *bridge = container_of(kref, struct drm_bridge, refcount); + mutex_lock(&bridge_lock); + list_del(&bridge->list); + mutex_unlock(&bridge_lock); + if (bridge->funcs->destroy) bridge->funcs->destroy(bridge); + kfree(bridge->container); } @@ -273,6 +280,7 @@ void *__devm_drm_bridge_alloc(struct device *dev, size_t size, size_t offset, return ERR_PTR(-ENOMEM); bridge = container + offset; + INIT_LIST_HEAD(&bridge->list); bridge->container = container; bridge->funcs = funcs; kref_init(&bridge->refcount); @@ -300,6 +308,14 @@ void drm_bridge_add(struct drm_bridge *bridge) drm_bridge_get(bridge); + /* + * If the bridge was previously added and then removed, it is now + * in bridge_lingering_list. Remove it or bridge_lingering_list will be + * corrupted when adding this bridge to bridge_list below. + */ + if (!list_empty(&bridge->list)) + list_del_init(&bridge->list); + mutex_init(&bridge->hpd_mutex); if (bridge->ops & DRM_BRIDGE_OP_HDMI) @@ -343,7 +359,7 @@ EXPORT_SYMBOL(devm_drm_bridge_add); void drm_bridge_remove(struct drm_bridge *bridge) { mutex_lock(&bridge_lock); - list_del_init(&bridge->list); + list_move_tail(&bridge->list, &bridge_lingering_list); mutex_unlock(&bridge_lock); mutex_destroy(&bridge->hpd_mutex); -- 2.47.3