From nobody Wed Dec 17 08:50:37 2025 Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 86B283570A0 for ; Tue, 11 Nov 2025 12:01:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.85.4 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862501; cv=none; b=kY5Uw5vq3xViM/2m/+o+h2zW6ckYPm4UEdJtLBmJfbygU6FtKSZMAFfE4EUffCNWH0NZH6WiVu0G4bGzFll9h4Yh0UTeyQ3VLFOp1VbltD4ra2D1unFE5iLCZ6VNTD/Y64zn0ZJKUDe5A899d6+EGfXO3yxDPd9fBCI3biSNdAw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862501; c=relaxed/simple; bh=xUPpOKK7DQhW4FTyGwu88aTs6YPnXL36m4PzyQr2ymE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=qtMisNPI8thVAYSrHC2shJqn2WoKt3TN+gj03YqiymaFYwaOUTZKTUGWedhmhr+khytSbeCfrL7pbWreBwlo6HgFGwL++eyI3FwadOAOA9SmHTn1V3YcGrUPVgsRUmOmuOKw8GmBfmBFmlROe1loiRMljdQh6ORsWcMy98AW6ec= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=s0oWb7a4; arc=none smtp.client-ip=185.246.85.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="s0oWb7a4" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id ECE4E4E41627; Tue, 11 Nov 2025 12:01:30 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 9B7DC606FB; Tue, 11 Nov 2025 12:01:30 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 0CFF410371942; Tue, 11 Nov 2025 13:01:27 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1762862489; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=caYAPf6iewWTVEYkDv72AgsM1cq+8VKXAzMNFg+RhVE=; b=s0oWb7a4OaPHX0gRDTBb9NN711RRduEmHAIlDZHgEI7uj884WiJjMNm8TGid3RmPnpqD3b sFfCtnNYpIk2crGbwgl2oDooHeILJtD+qVKZE+JrdlRKys9JOxwR9rEIh0vfk4HOtH9wce n0+azbhIEfqoQF2ItveAiVljZZn17xA2AKmI7Bzp1VFrEEzK+ZkNUavs/4IatWx2PWzWeX LIR+4NeeZggmMhZImk/JPI1KhSaDlQoq1gGQzw6wgJOq7MF4UxsEPbjOj23xYqy6Wburnw /2Kw4U7vaTHAzDZsUYb118Zt+S09SFfDTz8Inw1SHsF5/P/2mohhl2aEUmtUlA== From: Luca Ceresoli Date: Tue, 11 Nov 2025 13:01:21 +0100 Subject: [PATCH v4 1/7] drm/encoder: add mutex to protect the bridge chain Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-1-12b13eb8c0f8@bootlin.com> References: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> In-Reply-To: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec Cc: Hui Pu , Thomas Petazzoni , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Luca Ceresoli X-Mailer: b4 0.14.2 X-Last-TLS-Session-Version: TLSv1.3 The per-encoder bridge chain is currently assumed to be static once it is fully initialized. Work is in progress to add hot-pluggable bridges, breaking that assumption. With bridge removal, the encoder chain can change without notice, removing tail bridges. This can be problematic while iterating over the chain. Add a mutex to be taken whenever looping or changing the encoder chain. Reviewed-by: Maxime Ripard Signed-off-by: Luca Ceresoli --- Changes in v3: - Removed the drm_encoder_chain_[un]lock() wrappers Changes in v2: - Added documentation to new APIs --- drivers/gpu/drm/drm_encoder.c | 2 ++ include/drm/drm_encoder.h | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/drivers/gpu/drm/drm_encoder.c b/drivers/gpu/drm/drm_encoder.c index 8f2bc6a28482229fd0b030a1958f87753ad7885f..3261f142baea30c516499d23dbf= 8d0acf5952cd6 100644 --- a/drivers/gpu/drm/drm_encoder.c +++ b/drivers/gpu/drm/drm_encoder.c @@ -129,6 +129,7 @@ static int __drm_encoder_init(struct drm_device *dev, } =20 INIT_LIST_HEAD(&encoder->bridge_chain); + mutex_init(&encoder->bridge_chain_mutex); list_add_tail(&encoder->head, &dev->mode_config.encoder_list); encoder->index =3D dev->mode_config.num_encoder++; =20 @@ -202,6 +203,7 @@ void drm_encoder_cleanup(struct drm_encoder *encoder) kfree(encoder->name); list_del(&encoder->head); dev->mode_config.num_encoder--; + mutex_destroy(&encoder->bridge_chain_mutex); =20 memset(encoder, 0, sizeof(*encoder)); } diff --git a/include/drm/drm_encoder.h b/include/drm/drm_encoder.h index 977a9381c8ba943b4d3e021635ea14856df8a17d..eded7c34481a2e9b4a127300462= 7a03f4035b24f 100644 --- a/include/drm/drm_encoder.h +++ b/include/drm/drm_encoder.h @@ -25,6 +25,7 @@ =20 #include #include +#include #include #include #include @@ -189,6 +190,9 @@ struct drm_encoder { */ struct list_head bridge_chain; =20 + /** @bridge_chain_mutex: protect bridge_chain from changes while iteratin= g */ + struct mutex bridge_chain_mutex; + const struct drm_encoder_funcs *funcs; const struct drm_encoder_helper_funcs *helper_private; =20 --=20 2.51.1 From nobody Wed Dec 17 08:50:37 2025 Received: from smtpout-04.galae.net (smtpout-04.galae.net [185.171.202.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8985035772B for ; Tue, 11 Nov 2025 12:01:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.171.202.116 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862503; cv=none; b=Ua5/fHledzKoUDnUvjwkvkcMXoucIKQsaVuH0yWP6kCV/URo8A8844sitycaDugCkaDBX6hgixREJ+r6HobjRMd7FEsc4r4p0APHbNTf0uhi5J254SMLwO8WrDE1Y9PN8Dley0kqt3BvjE8uzmFHHLME0V0H/AfNwVG4IY37vWo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862503; c=relaxed/simple; bh=cl+0OCUJ7wlBWXYicLD2edESzgK/McLZRPNcUjSZHM4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=GUJQJXvifNvYIf6sCqpHdxQJV/wL9eIL8EkhMyBUzeCpM1PnNtn6OIVMQdDxOFGUJCxBbGoQKomgraaNxrwKOXN0gl2O5iar3t1x2ntK2yLkLSVnxmfJCC08WXQ36HQ35EEj/rWEfTLuDPivROCh45A4r/HELb5O9JxKUrgx7Wc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=jE1OSm5y; arc=none smtp.client-ip=185.171.202.116 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="jE1OSm5y" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-04.galae.net (Postfix) with ESMTPS id 6DA56C0F546; Tue, 11 Nov 2025 12:01:11 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id EE7DA606FB; Tue, 11 Nov 2025 12:01:32 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 2A93910371933; Tue, 11 Nov 2025 13:01:29 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1762862492; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=XLEqNgh5N3lz6djpQkE5/JDnQm/X6niKflAMS3ZTPAg=; b=jE1OSm5ybU8jOtKabZS/NxkqVqRDd1kdBZbA9GYYHAKxfAbPvAZPYZ9FVuth35mja/b7+L Nz9y/h3DFCdNX2NdjA61/SpUf3Ct88L2ozH6Eyp/pcSraXLtnZkSaBHEi5dxH2I6kw8eWD Xi4Y6phJ9Neh4f6Ruz2uM+P/Rx8eoYVCHG+e+TeAjJZ7b/RFPHCFXAWRzF37/PJx9i9nzm mcQKdB97+DYaYRu+xWV0+jyUUqbc20sg7m/LJdkcdnXUI4I2luEcQ2tGeTS5lfufq0SGXP NUyUW1/G0io1lHLMjBDl8SuEEQdzw4vTnsWG8m+0h5IxQRfpErkWK6lCSZvywQ== From: Luca Ceresoli Date: Tue, 11 Nov 2025 13:01:22 +0100 Subject: [PATCH v4 2/7] drm/encoder: drm_encoder_cleanup: lock the encoder chain mutex during removal Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-2-12b13eb8c0f8@bootlin.com> References: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> In-Reply-To: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec Cc: Hui Pu , Thomas Petazzoni , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Luca Ceresoli X-Mailer: b4 0.14.2 X-Last-TLS-Session-Version: TLSv1.3 drm_encoder_cleanup() modifies the encoder chain by removing bridges via drm_bridge_detach(). Protect this whole operation by taking the mutex, so that: * any users iterating over the chain will not access it during the change * other code willing to modify the list (drm_bridge_attach()) will wait until drm_encoder_cleanup() is done Note that the _safe macro in use here is providing a different and orthogonal kind of protection than the mutex: 1. list_for_each_entry_safe() allows removing the current entry from the list it is iterating on, synchronously; the non-safe version would be unable to find the next entry after the current entry has been removed 2. the mutex being added allows to ensure that the list is not used asynchronously by other code while it is being modified; this prevents such other concurrent code to derail because it is iterating over an element while it is removed The _safe macro, which works by taking the "next" pointer in addition to the "current" one, is insufficient to provide the protection at item 2 above. This is visible e.g. when the "next" element is removed by other concurrent code. This is what would happen without the added mutex: 1. start loop: list_for_each_entry_safe(pos, n, ...) sets: pos =3D list_first_entry() =3D (bridge 1) n =3D list_next_entry(pos) =3D (bridge 2) 2. enter the loop 1st time, do something with *pos (bridge 1) 3. in the meanwhile bridge 2 is hot-unplugged -> another thread removes bridge 2 -> drm_bridge_detach() -> list_del() sets (bridge 2)->next =3D LIST_POISON1 4. loop iteration 1 finishes, list_for_each_entry_safe() sets: pos =3D n (previously set to bridge 2) n =3D (bridge 2)->next =3D LIST_POISON1 5. enter the loop 2nd time, do something with *pos (bridge 2) 6. loop iteration 2 finishes, list_for_each_entry_safe() sets: pos =3D n =3D LIST_POISON1 =3D=3D> bug! However, simply adding mutex_[un]lock(&encoder->bridge_chain_mutex) before/after the list_for_each_entry_safe() seems a simple and good solution, but it is introducing a possible ABBA deadlock (found by PROVE_LOCKING). The two code paths involved are: * drm_encoder_cleanup(): - takes the bridge_chain_mutex (A) - calls drm_bridge_detach -> drm_atomic_private_obj_fini -> DRM_MODESET_LOCK_ALL_BEGIN() which takes all locks in the acquisition context (B) * drm_mode_getconnector() (and other code paths): - calls drm_helper_probe_single_connector_modes() which: - takes a drm_modeset_lock in the acquisition context (B) - calls __drm_helper_update_and_validate -> drm_bridge_chain_mode_valid -> drm_for_each_bridge_in_chain_from() which takes the bridge_chain_mutex (A) To avoid this potential ABBA deadlock, move all list items to a temporary list while holding the bridge_chain_mutex, then detach all elements from the temporary list without the mutex. Signed-off-by: Luca Ceresoli --- Changes in v3: - Prevent ABBA deadlock by using a temporary list - Improve commit message Changes in v2: - Expanded commit messge with rationale, as discussed --- drivers/gpu/drm/drm_encoder.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_encoder.c b/drivers/gpu/drm/drm_encoder.c index 3261f142baea30c516499d23dbf8d0acf5952cd6..0d5dbed06db4461263d28b47e15= 2dc55a7a88bb4 100644 --- a/drivers/gpu/drm/drm_encoder.c +++ b/drivers/gpu/drm/drm_encoder.c @@ -189,14 +189,26 @@ void drm_encoder_cleanup(struct drm_encoder *encoder) { struct drm_device *dev =3D encoder->dev; struct drm_bridge *bridge, *next; + LIST_HEAD(tmplist); =20 /* Note that the encoder_list is considered to be static; should we * remove the drm_encoder at runtime we would have to decrement all * the indices on the drm_encoder after us in the encoder_list. */ =20 - list_for_each_entry_safe(bridge, next, &encoder->bridge_chain, - chain_node) + /* + * We need the bridge_chain_mutex to modify the chain, but + * drm_bridge_detach() will call DRM_MODESET_LOCK_ALL_BEGIN() (in + * drm_modeset_lock_fini()), resulting in a possible ABBA circular + * deadlock. Avoid it by first moving all the bridges to a + * temporary list holding the lock, and then calling + * drm_bridge_detach() without the lock. + */ + mutex_lock(&encoder->bridge_chain_mutex); + list_cut_before(&tmplist, &encoder->bridge_chain, &encoder->bridge_chain); + mutex_unlock(&encoder->bridge_chain_mutex); + + list_for_each_entry_safe(bridge, next, &tmplist, chain_node) drm_bridge_detach(bridge); =20 drm_mode_object_unregister(dev, &encoder->base); --=20 2.51.1 From nobody Wed Dec 17 08:50:37 2025 Received: from smtpout-04.galae.net (smtpout-04.galae.net [185.171.202.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2D01B358D01 for ; Tue, 11 Nov 2025 12:01:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.171.202.116 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862504; cv=none; b=uhjb61HGXkZP83ocwyjYW9wRDVgLw5xvqUWPgirLbENj3FzjBJFn4cj+UBKXSK0OUvVZZhF0z0eS+lvnjBAbBB8a/Sk+8HtAEL7H45oFuDieXVpOftueGutx1SCe9zqmCzwVcMjx1DpY4R3dD2ogItJ4zD7c4YwMu3kecj1C5CI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862504; c=relaxed/simple; bh=1clLNtEjwoVOKR5NKC+W2AEfzxwh8weW58OA/GwlBLU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=H1QFhnSnq5XuCI6BEUS8W/opKBjW8so/E/LmAn44lDT6XrGTS0+zytE/XrWb06xbEyt1Jdnl1BYsIUQSiSD7WnoUFuzFMPVvkAQ52UzM+tIuWXzVO8PgxrDmj8UmQqNP2b5Oes7/CBA2+54DlsBhQbtQlpQ54Slt5Y71BB2z3sE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=h+GBEUer; arc=none smtp.client-ip=185.171.202.116 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="h+GBEUer" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-04.galae.net (Postfix) with ESMTPS id D3440C0F547; Tue, 11 Nov 2025 12:01:13 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 5EDEF606FB; Tue, 11 Nov 2025 12:01:35 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 885C110371757; Tue, 11 Nov 2025 13:01:32 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1762862494; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=TA4TZzdHdTlEwf3ZFsWUEX0NQNey9iL6sbyvv48f/cQ=; b=h+GBEUer8cMBIfQmoPpCeJekDGUYKE98C+sDX0n5/CZ94fy/iFSBaQbvTa0WJgzi6vnA/N QdjFKlUxCB7HHuv35IoRCo/TfkN0Spei1dAGj0fuEncxy5soGR5a+brT+jsc82k94uFb4X u1ltUZq3fdxC4p4/VMqgSmsMRRGl6GZtx8oXm3A4Mh2ulVZCaBY7Yq5RJMFBm+EJLLlWn3 jGaI7CP1BjgvhaRUUXHfYxZsmiZXGRZPK0oJVId0C9Tdv/ZqchHJFw0c90fB4f2p+anNXt ty9maGcDltboPSIyzJPMlyfDtz33/QK1r/+aJNOjsELPW5Rsik8YU2ww0UIjxQ== From: Luca Ceresoli Date: Tue, 11 Nov 2025 13:01:23 +0100 Subject: [PATCH v4 3/7] drm/bridge: drm_bridge_attach: lock the encoder chain mutex during insertion Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-3-12b13eb8c0f8@bootlin.com> References: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> In-Reply-To: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec Cc: Hui Pu , Thomas Petazzoni , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Luca Ceresoli X-Mailer: b4 0.14.2 X-Last-TLS-Session-Version: TLSv1.3 drm_bridge_attach() modifies the encoder bridge chain, so take a mutex around such operations to allow users of the chain to protect themselves from chain modifications while iterating. Reviewed-by: Maxime Ripard Signed-off-by: Luca Ceresoli --- Changes in v3: - Lock encoder->bridge_chain_mutex directly, no wrappers Changes in v2: - Removed comment before on drm_bridge_detach() --- drivers/gpu/drm/drm_bridge.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c index 8f355df883d8ac8de9d361ec302f4ccbf3bca0d6..c8389383e0d286c0d576ae1864e= e783e002d44be 100644 --- a/drivers/gpu/drm/drm_bridge.c +++ b/drivers/gpu/drm/drm_bridge.c @@ -462,10 +462,12 @@ int drm_bridge_attach(struct drm_encoder *encoder, st= ruct drm_bridge *bridge, bridge->dev =3D encoder->dev; bridge->encoder =3D encoder; =20 + mutex_lock(&encoder->bridge_chain_mutex); if (previous) list_add(&bridge->chain_node, &previous->chain_node); else list_add(&bridge->chain_node, &encoder->bridge_chain); + mutex_unlock(&encoder->bridge_chain_mutex); =20 if (bridge->funcs->attach) { ret =3D bridge->funcs->attach(bridge, encoder, flags); @@ -496,7 +498,9 @@ int drm_bridge_attach(struct drm_encoder *encoder, stru= ct drm_bridge *bridge, err_reset_bridge: bridge->dev =3D NULL; bridge->encoder =3D NULL; + mutex_lock(&encoder->bridge_chain_mutex); list_del(&bridge->chain_node); + mutex_unlock(&encoder->bridge_chain_mutex); =20 if (ret !=3D -EPROBE_DEFER) DRM_ERROR("failed to attach bridge %pOF to encoder %s: %d\n", --=20 2.51.1 From nobody Wed Dec 17 08:50:37 2025 Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DE79C2EA72A for ; Tue, 11 Nov 2025 12:01:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.84.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862501; cv=none; b=gWpVVBzMnrBA5IyT3evmRqH8Vo+WUJa2r8Y3rUs+NQqNRV7V/nK07qETdicJ+YSoXdQk9K1PXfE+CUpdj9FzEGXdHD1gqdcSQA5jomCFDvoBEIprPfwj8/+sJ1XfhGtgx78AzCFIdzMsM6PfDZI2AUrXlrFuCCdhiOGX9PomNbE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862501; c=relaxed/simple; bh=JfnPGJvlzDY+pbdtjQRWOhCWnnhKgX9EM+kNJXmSfjM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=rP0QAGmKnFwK3H4mAzvoKJwTt6pY5v6mN+rF7NJUOQ3wJiHOCr4/TXltfGzui4uPN86rogDNcFeMexiV9TQsUK+45gNFtz2k9QSJh2MQAeoTCWFZi94UC58PlatAwjdiEd2500sZ/FMn5QGTTVTFG1BdcGis5OTGXSYVbgzgfe8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=rnYO8BHY; arc=none smtp.client-ip=185.246.84.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="rnYO8BHY" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 2DCF01A19D8; Tue, 11 Nov 2025 12:01:38 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id CB5AA606FB; Tue, 11 Nov 2025 12:01:37 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id EE6FC103717C8; Tue, 11 Nov 2025 13:01:34 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1762862496; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=6pfjJ81nnolgb/uD5TBdkstcxP4F650uxunra4Y0LDQ=; b=rnYO8BHYZGtxseNeZEeKVIv7rtULRJBTGw3VVrFbiNgiTZi5mh1zAoMVvdXa4Q6Kk7Uzy+ rKQhAjnPp4CYuu08cvqcGQfB1/tRMgIkR0nqvOdRKSgawWN7e8TWS5OompHscG66TU/d5g Nl7v27u9t7wwi5SHX6aHz3HMWao9TX2X/Qghqawq7oil2hwmBHZQy2LiWfuAg95nCB7IuR nfijQSpT2I6r70vq1ygteg5KWbmXmGELypGKqKrkjbn/mmrZfEmxOx6UFyALlSNUVUGP7S xZNu94/ahQTk0DPbL3DhA3+/5IlfCGdu1V+mtaV73E5zNgmxVyx0nP5nBWuiiQ== From: Luca Ceresoli Date: Tue, 11 Nov 2025 13:01:24 +0100 Subject: [PATCH v4 4/7] drm/bridge: lock the encoder chain in scoped for_each loops Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-4-12b13eb8c0f8@bootlin.com> References: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> In-Reply-To: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec Cc: Hui Pu , Thomas Petazzoni , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Luca Ceresoli X-Mailer: b4 0.14.2 X-Last-TLS-Session-Version: TLSv1.3 drm_for_each_bridge_in_chain_scoped() and drm_for_each_bridge_in_chain_from() currently get/put the bridge at each iteration. But they don't protect the encoder chain, so it could change (bridges added/removed) while some code is iterating over the list itself. Such code can then derail on incorrect pointers. To make iterations safe, augment these for_each macros to lock the encoder chain mutex at the beginning and unlock it at the end of the loop (be it at the end of the list, or earlier due to a 'break' or 'return' statement). This change requires more operations when starting and ending the loop. To avoid making the macros even more complex, move these operations to helper functions. Also remname some of the existing helper functions for consistency. Signed-off-by: Luca Ceresoli --- Changed in v4: - Slightly improve kerneldoc to clarify a bridge reference is held in addition to the mutex Changed in v3: - Re-add drm_bridge_get/put() Changed in v2: - Fixed infinite loop in drm_for_each_bridge_in_chain_scoped() when encoder->bridge_chain is empty, reported here: https://lore.kernel.org/lkml/202509301358.38036b85-lkp@intel.com/ - Slightly improved commit message --- include/drm/drm_bridge.h | 73 +++++++++++++++++++++++++++++++-------------= ---- 1 file changed, 47 insertions(+), 26 deletions(-) diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h index 0ff7ab4aa8689a022458f935a7ffb23a2b715802..3d26dde1ac812d44faaf352e91f= ea2f7aecd77cd 100644 --- a/include/drm/drm_bridge.h +++ b/include/drm/drm_bridge.h @@ -1440,26 +1440,37 @@ drm_bridge_chain_get_last_bridge(struct drm_encoder= *encoder) struct drm_bridge, chain_node)); } =20 -/** - * drm_bridge_get_next_bridge_and_put - Get the next bridge in the chain - * and put the previous - * @bridge: bridge object - * - * Same as drm_bridge_get_next_bridge() but additionally puts the @bridge. - * - * RETURNS: - * the next bridge in the chain after @bridge, or NULL if @bridge is the l= ast. - */ -static inline struct drm_bridge * -drm_bridge_get_next_bridge_and_put(struct drm_bridge *bridge) +/* Internal to drm_for_each_bridge_in_chain*() */ +static inline struct drm_bridge *__drm_for_each_bridge_in_chain_next(struc= t drm_bridge *bridge) { struct drm_bridge *next =3D drm_bridge_get_next_bridge(bridge); =20 + if (!next) + mutex_unlock(&bridge->encoder->bridge_chain_mutex); + drm_bridge_put(bridge); =20 return next; } =20 +/* Internal to drm_for_each_bridge_in_chain*() */ +DEFINE_FREE(__drm_for_each_bridge_in_chain_cleanup, struct drm_bridge *, + if (_T) { mutex_unlock(&_T->encoder->bridge_chain_mutex); drm_bridge_put(= _T); }) + +/* Internal to drm_for_each_bridge_in_chain_scoped() */ +static inline struct drm_bridge * +__drm_for_each_bridge_in_chain_scoped_start(struct drm_encoder *encoder) +{ + mutex_lock(&encoder->bridge_chain_mutex); + + struct drm_bridge *bridge =3D drm_bridge_chain_get_first_bridge(encoder); + + if (!bridge) + mutex_unlock(&encoder->bridge_chain_mutex); + + return bridge; +} + /** * drm_for_each_bridge_in_chain_scoped - iterate over all bridges attached * to an encoder @@ -1469,14 +1480,24 @@ drm_bridge_get_next_bridge_and_put(struct drm_bridg= e *bridge) * * Iterate over all bridges present in the bridge chain attached to @encod= er. * - * Automatically gets/puts the bridge reference while iterating, and puts - * the reference even if returning or breaking in the middle of the loop. + * Automatically gets/puts the bridge reference while iterating and locks + * the encoder chain mutex to prevent chain modifications while iterating. */ -#define drm_for_each_bridge_in_chain_scoped(encoder, bridge) \ - for (struct drm_bridge *bridge __free(drm_bridge_put) =3D \ - drm_bridge_chain_get_first_bridge(encoder); \ - bridge; \ - bridge =3D drm_bridge_get_next_bridge_and_put(bridge)) +#define drm_for_each_bridge_in_chain_scoped(encoder, bridge) \ + for (struct drm_bridge *bridge __free(__drm_for_each_bridge_in_chain_clea= nup) =3D \ + __drm_for_each_bridge_in_chain_scoped_start((encoder)); \ + bridge; \ + bridge =3D __drm_for_each_bridge_in_chain_next(bridge)) \ + +/* Internal to drm_for_each_bridge_in_chain_from() */ +static inline struct drm_bridge * +__drm_for_each_bridge_in_chain_from_start(struct drm_bridge *bridge) +{ + drm_bridge_get(bridge); + mutex_lock(&bridge->encoder->bridge_chain_mutex); + + return bridge; +} =20 /** * drm_for_each_bridge_in_chain_from - iterate over all bridges starting @@ -1488,14 +1509,14 @@ drm_bridge_get_next_bridge_and_put(struct drm_bridg= e *bridge) * Iterate over all bridges in the encoder chain starting from * @first_bridge, included. * - * Automatically gets/puts the bridge reference while iterating, and puts - * the reference even if returning or breaking in the middle of the loop. + * Automatically gets/puts the bridge reference while iterating and locks + * the encoder chain mutex to prevent chain modifications while iterating. */ -#define drm_for_each_bridge_in_chain_from(first_bridge, bridge) \ - for (struct drm_bridge *bridge __free(drm_bridge_put) =3D \ - drm_bridge_get(first_bridge); \ - bridge; \ - bridge =3D drm_bridge_get_next_bridge_and_put(bridge)) +#define drm_for_each_bridge_in_chain_from(first_bridge, bridge) \ + for (struct drm_bridge *bridge __free(__drm_for_each_bridge_in_chain_clea= nup) =3D \ + __drm_for_each_bridge_in_chain_from_start(first_bridge); \ + bridge; \ + bridge =3D __drm_for_each_bridge_in_chain_next(bridge)) \ =20 enum drm_mode_status drm_bridge_chain_mode_valid(struct drm_bridge *bridge, --=20 2.51.1 From nobody Wed Dec 17 08:50:37 2025 Received: from smtpout-04.galae.net (smtpout-04.galae.net [185.171.202.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 780F13587C6 for ; Tue, 11 Nov 2025 12:01:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.171.202.116 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862503; cv=none; b=lZFF0AHiGxa3qPtEIw3tRcxCc0dN8GUvPgaD1OEmbfuUSOc6AYlqijY0G6ggUav4Zv6DY2L44o8oa0hL5g5fAfuOf1DNMmxMvBrZ7zuanLn8CpKanrKCbpQPefSJgLfffsYcENm8vqJvO2IoKoeMwd1fkqTGfF5GYF5MCaMVYc4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862503; c=relaxed/simple; bh=LB+IQzj/RyfVCejVXNOII9LYP9ZlKVcMW0+E8mu9ozU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=kd7RE17VWyDixHxy8xXIKWwzGpI/WqZ/sv2DlpN01aE/HCchBauZ/tjQjFl1se6Okxd1L1i+fySmvJbnm9HghcgQKvK+79LifehELWlxhHfAyiNmS877AzoZ1xsqANEhc+9YZwSQpTtwu4glj+o1d2GTdjqcHn0hqsNX4q94IiM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=nd/M9dum; arc=none smtp.client-ip=185.171.202.116 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="nd/M9dum" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-04.galae.net (Postfix) with ESMTPS id 54CBDC0F544; Tue, 11 Nov 2025 12:01:18 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id D7034606FB; Tue, 11 Nov 2025 12:01:39 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 4444810371945; Tue, 11 Nov 2025 13:01:37 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1762862499; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=vFc4z5mhwogLuh5bJMqJoG/EPcrk5zOmeXK43n/q6e4=; b=nd/M9dumS9jfFht1mi1IHQgUT9ADWmkX7fbbov4XhGU3THhePmrttRfyvNPWebICWPplgY fzT2UVCdvp7xLLtzkbPoZp32qfNGGsmTjcolnWvqZq+cfor+DgmP0GnWLiTG81LEeTtRTr 1QZJR/uM1E+2KVGxbVafCGx37ERKphrNah8sFJCq/ahQGCi+MVlOFbHAcSMBN3JOjolqZd exs7AHHN6Ru671X7pZAJ7Sikr6IeTHO2yM+SwOYrUfMh5DwrG1ZynpaTcP/7dPFzdRX6Pl bMF1i6Q8jtzTYdTZHomu4jHPczrvZ3Aii/T9+NJyMzKN6hmC4AEG0KIGZ4i07g== From: Luca Ceresoli Date: Tue, 11 Nov 2025 13:01:25 +0100 Subject: [PATCH v4 5/7] drm/bridge: prevent encoder chain changes while iterating with list_for_each_entry_from() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-5-12b13eb8c0f8@bootlin.com> References: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> In-Reply-To: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec Cc: Hui Pu , Thomas Petazzoni , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Luca Ceresoli X-Mailer: b4 0.14.2 X-Last-TLS-Session-Version: TLSv1.3 These loops in drm_bridge.c iterate over the encoder chain using list_for_each_entry_from(), which does not prevent changes to the bridge chain while iterating over it. Convert most of those loops to instead use drm_for_each_bridge_in_chain_from(), which locks the chain. This also simplifies code. All the "simple" loops are converted here. The only ones not touched are those in drm_atomic_bridge_chain_pre_enable() and drm_atomic_bridge_chain_post_disable(), because they have nested loops which are not well handled by drm_for_each_bridge_in_chain_from(). Those two functions are handled by a separate commit. Signed-off-by: Luca Ceresoli --- drivers/gpu/drm/drm_bridge.c | 35 ++++++++++++----------------------- 1 file changed, 12 insertions(+), 23 deletions(-) diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c index c8389383e0d286c0d576ae1864ee783e002d44be..9b4a075b5361c34c61316c6e52f= e55c8928fbc13 100644 --- a/drivers/gpu/drm/drm_bridge.c +++ b/drivers/gpu/drm/drm_bridge.c @@ -627,7 +627,7 @@ void drm_bridge_detach(struct drm_bridge *bridge) /** * drm_bridge_chain_mode_valid - validate the mode against all bridges in = the * encoder chain. - * @bridge: bridge control structure + * @first_bridge: bridge control structure * @info: display info against which the mode shall be validated * @mode: desired mode to be validated * @@ -641,17 +641,14 @@ void drm_bridge_detach(struct drm_bridge *bridge) * MODE_OK on success, drm_mode_status Enum error code on failure */ enum drm_mode_status -drm_bridge_chain_mode_valid(struct drm_bridge *bridge, +drm_bridge_chain_mode_valid(struct drm_bridge *first_bridge, const struct drm_display_info *info, const struct drm_display_mode *mode) { - struct drm_encoder *encoder; - - if (!bridge) + if (!first_bridge) return MODE_OK; =20 - encoder =3D bridge->encoder; - list_for_each_entry_from(bridge, &encoder->bridge_chain, chain_node) { + drm_for_each_bridge_in_chain_from(first_bridge, bridge) { enum drm_mode_status ret; =20 if (!bridge->funcs->mode_valid) @@ -669,7 +666,7 @@ EXPORT_SYMBOL(drm_bridge_chain_mode_valid); /** * drm_bridge_chain_mode_set - set proposed mode for all bridges in the * encoder chain - * @bridge: bridge control structure + * @first_bridge: bridge control structure * @mode: desired mode to be set for the encoder chain * @adjusted_mode: updated mode that works for this encoder chain * @@ -678,20 +675,16 @@ EXPORT_SYMBOL(drm_bridge_chain_mode_valid); * * Note: the bridge passed should be the one closest to the encoder */ -void drm_bridge_chain_mode_set(struct drm_bridge *bridge, +void drm_bridge_chain_mode_set(struct drm_bridge *first_bridge, const struct drm_display_mode *mode, const struct drm_display_mode *adjusted_mode) { - struct drm_encoder *encoder; - - if (!bridge) + if (!first_bridge) return; =20 - encoder =3D bridge->encoder; - list_for_each_entry_from(bridge, &encoder->bridge_chain, chain_node) { + drm_for_each_bridge_in_chain_from(first_bridge, bridge) if (bridge->funcs->mode_set) bridge->funcs->mode_set(bridge, mode, adjusted_mode); - } } EXPORT_SYMBOL(drm_bridge_chain_mode_set); =20 @@ -915,7 +908,7 @@ EXPORT_SYMBOL(drm_atomic_bridge_chain_pre_enable); =20 /** * drm_atomic_bridge_chain_enable - enables all bridges in the encoder cha= in - * @bridge: bridge control structure + * @first_bridge: bridge control structure * @state: atomic state being committed * * Calls &drm_bridge_funcs.atomic_enable (falls back on @@ -925,22 +918,18 @@ EXPORT_SYMBOL(drm_atomic_bridge_chain_pre_enable); * * Note: the bridge passed should be the one closest to the encoder */ -void drm_atomic_bridge_chain_enable(struct drm_bridge *bridge, +void drm_atomic_bridge_chain_enable(struct drm_bridge *first_bridge, struct drm_atomic_state *state) { - struct drm_encoder *encoder; - - if (!bridge) + if (!first_bridge) return; =20 - encoder =3D bridge->encoder; - list_for_each_entry_from(bridge, &encoder->bridge_chain, chain_node) { + drm_for_each_bridge_in_chain_from(first_bridge, bridge) if (bridge->funcs->atomic_enable) { bridge->funcs->atomic_enable(bridge, state); } else if (bridge->funcs->enable) { bridge->funcs->enable(bridge); } - } } EXPORT_SYMBOL(drm_atomic_bridge_chain_enable); =20 --=20 2.51.1 From nobody Wed Dec 17 08:50:37 2025 Received: from smtpout-04.galae.net (smtpout-04.galae.net [185.171.202.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA9D03590A8 for ; Tue, 11 Nov 2025 12:01:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.171.202.116 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862506; cv=none; b=jwXmeLlTXniONQHeSSq7B2Py5ZDlnF+74/THC+Acd6DAQscWyR9Fj9nnQTVbViwX09nNHPbI5kQYsJts1WQgpDLG6y7IbaHHjtum7jozp/99ioz4VFXd+GMLjwsRS3Yu4bDMNNLYSSjqgBnL7yP6Dm7TUVB89TuYj+PdHYXmhWI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862506; c=relaxed/simple; bh=D3Ky43SG0yUCfk5/3CdZYfibE7F9mhWd0r679ZWIvF0=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=pPI9gSwQjeoRRpchQj9q5xmQ0+9wPerja4Hs0q/xc3D8H0cJVX68r4vXortr8uyT5p58GjBrmJNAVKkR+kkViNbLkqg8IHCRC/R1ghtylid4MKRZATOsc/NCmAOgmwXgi5Kbsiv5pkzC1h6OLQw+CmuOnJkd/36HbfaLS6zZoHM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=FK5myhmI; arc=none smtp.client-ip=185.171.202.116 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="FK5myhmI" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-04.galae.net (Postfix) with ESMTPS id D9E50C0F549; Tue, 11 Nov 2025 12:01:20 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 67971606FB; Tue, 11 Nov 2025 12:01:42 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 6F92110371943; Tue, 11 Nov 2025 13:01:39 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1762862501; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=VCb6Za5QIMArGVZWZ65WRJEbuxnkXAP2zkUiIdvfPJ8=; b=FK5myhmIuHP1WQO7y3LVKzunlWPfdR7lmOK6U1yRf093pTQ2G7baVlzuikvwq1B7fZ3fZr X/oYlxa1an04EUT8LqZS6BPBYf9+sAHp1R0T2YNFEe4R6k4AYISWCnRRAJaXbezo/5f+KG pU+AsxrNnuzL9TtumjdqNcfWoYPKFTdNpZv3dVP2BEYhFhTRvKyXrtP7hAZ08tXbZAVklY xT61IKYFMRsLldjri9ITs+PmvFGk9q5sogL2qcU1/hxUWjQMQZRxGG+W6i3FZgngBYPCgd ZYSdoJrKIleYpCfsmuUIBx10HD5sD41jx+RBw6L8FeG08wDuHxeajPRNgXdUOQ== From: Luca Ceresoli Date: Tue, 11 Nov 2025 13:01:26 +0100 Subject: [PATCH v4 6/7] drm/bridge: prevent encoder chain changes while iterating with list_for_each_entry_reverse() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-6-12b13eb8c0f8@bootlin.com> References: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> In-Reply-To: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec Cc: Hui Pu , Thomas Petazzoni , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Luca Ceresoli X-Mailer: b4 0.14.2 X-Last-TLS-Session-Version: TLSv1.3 These loops in drm_bridge.c iterate over the encoder chain using list_for_each_entry_reverse(), which does not prevent changes to the bridge chain while iterating over it. Take the encoder chain mutex while iterating to avoid chain changes while iterating. All the "simple" loops are converted. drm_atomic_bridge_chain_pre_enable() and drm_atomic_bridge_chain_post_disable() are handled by a separate commit. Signed-off-by: Luca Ceresoli --- Changes in v3: - Lock encoder->bridge_chain_mutex directly, no wrappers Changes in v2: none --- drivers/gpu/drm/drm_bridge.c | 40 ++++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 18 deletions(-) diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c index 9b4a075b5361c34c61316c6e52fe55c8928fbc13..eca138eadbc579013db3f588e26= 0489a026baf67 100644 --- a/drivers/gpu/drm/drm_bridge.c +++ b/drivers/gpu/drm/drm_bridge.c @@ -710,6 +710,7 @@ void drm_atomic_bridge_chain_disable(struct drm_bridge = *bridge, return; =20 encoder =3D bridge->encoder; + mutex_lock(&encoder->bridge_chain_mutex); list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) { if (iter->funcs->atomic_disable) { iter->funcs->atomic_disable(iter, state); @@ -720,6 +721,7 @@ void drm_atomic_bridge_chain_disable(struct drm_bridge = *bridge, if (iter =3D=3D bridge) break; } + mutex_unlock(&encoder->bridge_chain_mutex); } EXPORT_SYMBOL(drm_atomic_bridge_chain_disable); =20 @@ -1224,25 +1226,27 @@ int drm_atomic_bridge_chain_check(struct drm_bridge= *bridge, return ret; =20 encoder =3D bridge->encoder; - list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) { - int ret; - - /* - * Bus flags are propagated by default. If a bridge needs to - * tweak the input bus flags for any reason, it should happen - * in its &drm_bridge_funcs.atomic_check() implementation such - * that preceding bridges in the chain can propagate the new - * bus flags. - */ - drm_atomic_bridge_propagate_bus_flags(iter, conn, - crtc_state->state); - - ret =3D drm_atomic_bridge_check(iter, crtc_state, conn_state); - if (ret) - return ret; + scoped_guard(mutex, &encoder->bridge_chain_mutex) { + list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) { + int ret; + + /* + * Bus flags are propagated by default. If a bridge needs to + * tweak the input bus flags for any reason, it should happen + * in its &drm_bridge_funcs.atomic_check() implementation such + * that preceding bridges in the chain can propagate the new + * bus flags. + */ + drm_atomic_bridge_propagate_bus_flags(iter, conn, + crtc_state->state); + + ret =3D drm_atomic_bridge_check(iter, crtc_state, conn_state); + if (ret) + return ret; =20 - if (iter =3D=3D bridge) - break; + if (iter =3D=3D bridge) + break; + } } =20 return 0; --=20 2.51.1 From nobody Wed Dec 17 08:50:37 2025 Received: from smtpout-04.galae.net (smtpout-04.galae.net [185.171.202.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DE8E93587A3 for ; Tue, 11 Nov 2025 12:01:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.171.202.116 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862507; cv=none; b=CHcapcNw9KY0ikBMeRSXCApujHi6l+TgIPxDpRRFt5k6Q//W+BOEXXGMtti3VKpnL/9xkMAnwBNz9be7daBn3823Co5LteYkV1LCEVkJTRvj9/uhiUAA0EPXZc9H8GlXS4ZzBk11at73GRpKDSUIlHVz2/+pKaZHTJrwupWx7oY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762862507; c=relaxed/simple; bh=pTVtwtaHZlz4jvjtf4bXZ8F5B4dNQekstKY773ofiwc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=lR0k3O8MEMz/zwwEmCzC4o2S+TnpVsfrsCM87+8AMJBXy0uQ46zUxDj6/Z/8dxfmzCRHO/dB+lZPQVpPgmv1rG2IfBr8lfX9GbFUkQGJcSV9JPCgXee3b1xkm8LW4Kk5ccYHcae3LWaLu0Cn4KTMHXfmSMtuFwyV/Ayeh/eRY1Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=mkjuM7uc; arc=none smtp.client-ip=185.171.202.116 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="mkjuM7uc" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-04.galae.net (Postfix) with ESMTPS id 209F2C0F544; Tue, 11 Nov 2025 12:01:23 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id A2678606FB; Tue, 11 Nov 2025 12:01:44 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id E17F01037194B; Tue, 11 Nov 2025 13:01:41 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1762862503; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=PnYF/WVZ8teADO7+ckgdcFUlsnZ8kt+JkbUC+EyFzls=; b=mkjuM7ucmizitTP2HZ89qJvFxamtghtTBXhh+wSny5JLPy6QGXMR33TgwJDQJuBuxrQgGx OTE3WsJ8dQIWPD3OXd4u9bYK1XWghAAeH5TpK3m0nuHXZqXDygy70hSiInvPgXD5BxgZbz ZhYJAEA0Jo1hz3cvjkEsMB0LmsTH/nkjVrp6ZFJl6n48uf+kPH48JpytIip2jjpgx8Ctzk mAsLMbqUrS5R22mi92nRxvtjwdCKxR+R22u3U2+1Y1Q016XK8HEo5DL+My3BiIiKVUIvms JGr+Mvy7fAYnNkvqfUwsIxM/f8VAfqglNPSaZyIbsbKzrmjTqN8A50hyX/V0pA== From: Luca Ceresoli Date: Tue, 11 Nov 2025 13:01:27 +0100 Subject: [PATCH v4 7/7] drm/bridge: prevent encoder chain changes in pre_enable/post_disable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-7-12b13eb8c0f8@bootlin.com> References: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> In-Reply-To: <20251111-drm-bridge-alloc-encoder-chain-mutex-v4-0-12b13eb8c0f8@bootlin.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec Cc: Hui Pu , Thomas Petazzoni , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Luca Ceresoli X-Mailer: b4 0.14.2 X-Last-TLS-Session-Version: TLSv1.3 Take the encoder chain mutex while iterating over the encoder chain in drm_atomic_bridge_chain_pre_enable() and drm_atomic_bridge_chain_post_disable() to ensure the lists won't change while being inspected. These functions have nested list_for_each_*() loops, which makes them complicated. list_for_each_entry_from() loops could be replaced by drm_for_each_bridge_in_chain_from(), but it would not work in a nested way in its current implementation. Besides, there is no "_reverse" variant of drm_for_each_bridge_in_chain_from(). Keep code simple and readable by explicitly locking around the outer loop. Thankfully there are no break or return points inside the loops, so the change is trivial and readable. Reviewed-by: Maxime Ripard Signed-off-by: Luca Ceresoli --- Changes in v3: - Lock encoder->bridge_chain_mutex directly, no wrappers - Improved commit message Changes in v2: - Improved commit message --- drivers/gpu/drm/drm_bridge.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c index eca138eadbc579013db3f588e260489a026baf67..76895b0f84d3828034c965b3786= c24bfe8b31bfd 100644 --- a/drivers/gpu/drm/drm_bridge.c +++ b/drivers/gpu/drm/drm_bridge.c @@ -769,6 +769,7 @@ void drm_atomic_bridge_chain_post_disable(struct drm_br= idge *bridge, =20 encoder =3D bridge->encoder; =20 + mutex_lock(&encoder->bridge_chain_mutex); list_for_each_entry_from(bridge, &encoder->bridge_chain, chain_node) { limit =3D NULL; =20 @@ -817,6 +818,7 @@ void drm_atomic_bridge_chain_post_disable(struct drm_br= idge *bridge, /* Jump all bridges that we have already post_disabled */ bridge =3D limit; } + mutex_unlock(&encoder->bridge_chain_mutex); } EXPORT_SYMBOL(drm_atomic_bridge_chain_post_disable); =20 @@ -863,6 +865,7 @@ void drm_atomic_bridge_chain_pre_enable(struct drm_brid= ge *bridge, =20 encoder =3D bridge->encoder; =20 + mutex_lock(&encoder->bridge_chain_mutex); list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) { if (iter->pre_enable_prev_first) { next =3D iter; @@ -905,6 +908,7 @@ void drm_atomic_bridge_chain_pre_enable(struct drm_brid= ge *bridge, if (iter =3D=3D bridge) break; } + mutex_unlock(&encoder->bridge_chain_mutex); } EXPORT_SYMBOL(drm_atomic_bridge_chain_pre_enable); =20 --=20 2.51.1