From nobody Sat Jul 25 04:55:57 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5097282F13 for ; Fri, 17 Jul 2026 14:03:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784296987; cv=none; b=I4Lg7OPJ4rMvUMcO+Hz9KroJxY70qvXdjj6dOTf6N0+xWUAB9Q1JLvuKATnBJSEtTFjCibx5loHX5PckKqvb2INeofsAEVKxVCZ92X6AHZWt5i/MyAF0GeoJHIGuMxjcYaTSsKIFtCx0ugMJ2+FV7Ka3xKwdZklupodnimLci3w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784296987; c=relaxed/simple; bh=FTIUpYJulTDPMntpPJg3cHAwQl8IpGYir+ZH1v5UeXQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=nS0+qJgHRApGMdcDQR8tJrIisdLtksavznbJr4TmRso9OmWnidQ3ALvTHJBybJ61lWkiS8zyKgjqvnhd73MuZdZaVLoX54e9gYtm4aawN7CPR3KKVv/vlJ1VSCxjuTdHVpoaazWlrNSnaaKCWpFBV9p1QMnpdqZW7M0VgMkc6wc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=IlYQB/Aj; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="IlYQB/Aj" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784296984; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=VGJka35hl1u+NTZhYLLi9zxEwwQ2DlQIwAaKGDObA0o=; b=IlYQB/Aj1iTnQrBzNUnSw6SbTn+vsdhhb7E/7C0kDQkror7yHMvBmzBiZej6P4FTnZL+cW zvNNQS07uPkR9SceeisxDKtDAYd76tdQYA3MgDtfKdZeQWsbsbKD7gSy2tGD6WuHbTIw7n pOaqx4NTmGvZ8XXbzHuQrfL6Lr9KTPI= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-542-1W4X1tnkPoGaSo0U6wqzFg-1; Fri, 17 Jul 2026 10:02:58 -0400 X-MC-Unique: 1W4X1tnkPoGaSo0U6wqzFg-1 X-Mimecast-MFC-AGG-ID: 1W4X1tnkPoGaSo0U6wqzFg_1784296976 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1028D180074C; Fri, 17 Jul 2026 14:02:55 +0000 (UTC) Received: from [192.168.1.153] (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 39396180025B; Fri, 17 Jul 2026 14:02:38 +0000 (UTC) From: Albert Esteve Date: Fri, 17 Jul 2026 16:02:04 +0200 Subject: [PATCH v3 1/4] drm/panel: have drm_panel_add/remove manage a list reference Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260717-drm_refcount_wiring-v3-1-023900c32e01@redhat.com> References: <20260717-drm_refcount_wiring-v3-0-023900c32e01@redhat.com> In-Reply-To: <20260717-drm_refcount_wiring-v3-0-023900c32e01@redhat.com> To: Neil Armstrong , Jessica Zhang , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrzej Hajda , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Luca Ceresoli , Inki Dae , Jagan Teki , Marek Szyprowski , Laurentiu Palcu , Lucas Stach , Frank Li , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , Paul Cercueil , Linus Walleij , Marek Vasut , Stefan Agner , Tomi Valkeinen , Laurent Pinchart , Kieran Bingham , Geert Uytterhoeven , Magnus Damm , Biju Das , Sandy Huang , =?utf-8?q?Heiko_St=C3=BCbner?= , Andy Yan , Yannick Fertre , Raphael Gallais-Pou , Philippe Cornu , Maxime Coquelin , Alexandre Torgue , Chen-Yu Tsai , Samuel Holland , Jyri Sarha , Jingoo Han , Seung-Woo Kim , Kyungmin Park , Krzysztof Kozlowski , Peter Griffin , Alim Akhtar , Alison Wang , Paul Kocialkowski , Alain Volmat , Raphael Gallais-Pou , Thierry Reding , Mikko Perttunen , Jonathan Hunter Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, imx@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-mips@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-rockchip@lists.infradead.org, linux-stm32@st-md-mailman.stormreply.com, linux-sunxi@lists.linux.dev, linux-samsung-soc@vger.kernel.org, linux-tegra@vger.kernel.org, Albert Esteve X-Developer-Signature: v=1; a=ed25519-sha256; t=1784296938; l=1577; i=aesteve@redhat.com; s=20260303; h=from:subject:message-id; bh=FTIUpYJulTDPMntpPJg3cHAwQl8IpGYir+ZH1v5UeXQ=; b=YrbusurGGSB7YvjF6ZccKN+vcKVUHQpfLac942+Cranf6atmGaR9SI9po6YBiflKgqH3V3Uoc fE7eQSMY2CcDc+mWaONJx9YbrBOGvZ4cSQGsIw9XOJoVNKgKBXhpN1g X-Developer-Key: i=aesteve@redhat.com; a=ed25519; pk=YSFz6sOHd2L45+Fr8DIvHTi6lSIjhLZ5T+rkxspJt1s= X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 The global panel_list holds raw pointers to drm_panel objects. Nothing prevents a panel from being freed while it is still linked in the list: if a driver's probe calls drm_panel_add() and then fails at a later step, panel->list remains in panel_list. Any subsequent call to of_drm_find_panel() that iterates the list will dereference freed memory. Have drm_panel_add() acquire a reference via drm_panel_get() before inserting the panel into the list, and have drm_panel_remove() drop it via drm_panel_put() after removing the panel from the list. The global registry now holds a counted reference for as long as the panel is listed, ensuring the object outlives any concurrent lookup. Reviewed-by: Maxime Ripard Signed-off-by: Albert Esteve Reviewed-by: Luca Ceresoli --- drivers/gpu/drm/drm_panel.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c index 2c5649e433dfb..545fe93dc28fe 100644 --- a/drivers/gpu/drm/drm_panel.c +++ b/drivers/gpu/drm/drm_panel.c @@ -81,6 +81,7 @@ static void drm_panel_init(struct drm_panel *panel, struc= t device *dev, */ void drm_panel_add(struct drm_panel *panel) { + drm_panel_get(panel); mutex_lock(&panel_lock); list_add_tail(&panel->list, &panel_list); mutex_unlock(&panel_lock); @@ -98,6 +99,7 @@ void drm_panel_remove(struct drm_panel *panel) mutex_lock(&panel_lock); list_del_init(&panel->list); mutex_unlock(&panel_lock); + drm_panel_put(panel); } EXPORT_SYMBOL(drm_panel_remove); =20 --=20 2.55.0 From nobody Sat Jul 25 04:55:57 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 751AF274B3B for ; Fri, 17 Jul 2026 14:03:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784297001; cv=none; b=GNr+7I4shYVlMDVI9hNtsSH87QGIF32M9DBtrthreVHT9NiQ4fY2fy9OM8XoSqAX34jE2imHLaAv4597GU0Jrw9cpQq23+e9SXFHV/7b/xVpv4M9tJCgaKsxwATFAlZVWbmKWhZqk14U/3YhfIaKHNHJ9sf9QaPx+M5FdIImw7U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784297001; c=relaxed/simple; bh=KlwxMCqKbNdub6iKSU63/eaha0hKFaagaI1tIZ6B5Uc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ICzNH4HZ7nF+Ml6Vp2TPgMhgNI2HOUENih4Gvq67HV9qf6VvTYmA5P7jPnLeEwIxKkb0LDwTulGC61isQh4KLkrctVTBdVtWA/tg940bUajxUkjqFrU1MvW3OKm2SGodLzIRM2TMIRRWBKDgLpi8Ga/8gODPJkIU8hRFR0YMQU4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=COncwEAv; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="COncwEAv" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784296998; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=u9v3NFXDrTwWLaV8FxMoZ8NfYxT3wpKqp81fO1pkfuE=; b=COncwEAvAOzCM5i1fwMALuhHIK9pPoIwDFeNq53/ezENFqDR6XtdqUMPrq/QHuCw5vr0kX 42x16R+NY9trNspEL4f0tOnAB8pG/s6VmY6nKuvpEdZMMXUCbtW4C9Zw7PouslFTIQDZkf Vc3OFTByVAmf3yU+Ee63XDnXTf51iPs= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-166-P7_3btVnOda50SoI5oZtLA-1; Fri, 17 Jul 2026 10:03:15 -0400 X-MC-Unique: P7_3btVnOda50SoI5oZtLA-1 X-Mimecast-MFC-AGG-ID: P7_3btVnOda50SoI5oZtLA_1784296990 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 80A971945CB3; Fri, 17 Jul 2026 14:03:09 +0000 (UTC) Received: from [192.168.1.153] (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 8FF14180025C; Fri, 17 Jul 2026 14:02:55 +0000 (UTC) From: Albert Esteve Date: Fri, 17 Jul 2026 16:02:05 +0200 Subject: [PATCH v3 2/4] drm/bridge/panel: hold a reference to the wrapped panel Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260717-drm_refcount_wiring-v3-2-023900c32e01@redhat.com> References: <20260717-drm_refcount_wiring-v3-0-023900c32e01@redhat.com> In-Reply-To: <20260717-drm_refcount_wiring-v3-0-023900c32e01@redhat.com> To: Neil Armstrong , Jessica Zhang , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrzej Hajda , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Luca Ceresoli , Inki Dae , Jagan Teki , Marek Szyprowski , Laurentiu Palcu , Lucas Stach , Frank Li , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , Paul Cercueil , Linus Walleij , Marek Vasut , Stefan Agner , Tomi Valkeinen , Laurent Pinchart , Kieran Bingham , Geert Uytterhoeven , Magnus Damm , Biju Das , Sandy Huang , =?utf-8?q?Heiko_St=C3=BCbner?= , Andy Yan , Yannick Fertre , Raphael Gallais-Pou , Philippe Cornu , Maxime Coquelin , Alexandre Torgue , Chen-Yu Tsai , Samuel Holland , Jyri Sarha , Jingoo Han , Seung-Woo Kim , Kyungmin Park , Krzysztof Kozlowski , Peter Griffin , Alim Akhtar , Alison Wang , Paul Kocialkowski , Alain Volmat , Raphael Gallais-Pou , Thierry Reding , Mikko Perttunen , Jonathan Hunter Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, imx@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-mips@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-rockchip@lists.infradead.org, linux-stm32@st-md-mailman.stormreply.com, linux-sunxi@lists.linux.dev, linux-samsung-soc@vger.kernel.org, linux-tegra@vger.kernel.org, Albert Esteve X-Developer-Signature: v=1; a=ed25519-sha256; t=1784296938; l=2287; i=aesteve@redhat.com; s=20260303; h=from:subject:message-id; bh=KlwxMCqKbNdub6iKSU63/eaha0hKFaagaI1tIZ6B5Uc=; b=Fxd71ptDdnXg3JoJpPixwQzGTDiV+Biy0L12abT4HYwaF3RLxMz6DNuSuFzbtOgYKy66jdXMp 1QthBb+oBgvCqjzGxHXJ317YOokVT2FzgPwxGFDjWKFRUq39l4egfSn X-Developer-Key: i=aesteve@redhat.com; a=ed25519; pk=YSFz6sOHd2L45+Fr8DIvHTi6lSIjhLZ5T+rkxspJt1s= X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 drm_panel_bridge_add_typed() stores a pointer to the drm_panel it wraps, but never acquires a reference to it. If the panel device goes away while a panel_bridge still exists, the dangling pointer can be dereferenced through panel_bridge->panel. Acquire a reference in drm_panel_bridge_add_typed() with drm_panel_get() and release it in each teardown path. Reviewed-by: Maxime Ripard Signed-off-by: Albert Esteve --- drivers/gpu/drm/bridge/panel.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c index 4978ec98a0828..3bfa18167dd26 100644 --- a/drivers/gpu/drm/bridge/panel.c +++ b/drivers/gpu/drm/bridge/panel.c @@ -294,7 +294,7 @@ struct drm_bridge *drm_panel_bridge_add_typed(struct dr= m_panel *panel, return (void *)panel_bridge; =20 panel_bridge->connector_type =3D connector_type; - panel_bridge->panel =3D panel; + panel_bridge->panel =3D drm_panel_get(panel); =20 panel_bridge->bridge.of_node =3D panel->dev->of_node; panel_bridge->bridge.ops =3D DRM_BRIDGE_OP_MODES; @@ -316,6 +316,7 @@ EXPORT_SYMBOL(drm_panel_bridge_add_typed); void drm_panel_bridge_remove(struct drm_bridge *bridge) { struct panel_bridge *panel_bridge; + struct drm_panel *panel; =20 if (!bridge) return; @@ -326,10 +327,12 @@ void drm_panel_bridge_remove(struct drm_bridge *bridg= e) } =20 panel_bridge =3D drm_bridge_to_panel_bridge(bridge); + panel =3D panel_bridge->panel; =20 drm_bridge_remove(bridge); /* TODO remove this after reworking panel_bridge lifetime */ - devm_drm_put_bridge(panel_bridge->panel->dev, bridge); + devm_drm_put_bridge(panel->dev, bridge); + drm_panel_put(panel); } EXPORT_SYMBOL(drm_panel_bridge_remove); =20 @@ -357,11 +360,16 @@ EXPORT_SYMBOL(drm_panel_bridge_set_orientation); static void devm_drm_panel_bridge_release(struct device *dev, void *res) { struct drm_bridge *bridge =3D *(struct drm_bridge **)res; + struct panel_bridge *panel_bridge; + struct drm_panel *panel; =20 if (!bridge) return; =20 + panel_bridge =3D drm_bridge_to_panel_bridge(bridge); + panel =3D panel_bridge->panel; drm_bridge_remove(bridge); + drm_panel_put(panel); } =20 /** --=20 2.55.0 From nobody Sat Jul 25 04:55:57 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 656DD416137 for ; Fri, 17 Jul 2026 14:04:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784297084; cv=none; b=UiL8tJmHBEQGx6PzCeGhL0dD+ZRxfN182l3mu7RuRs64qt4M3bUhBMXoe1jgWkjmxoKAPUFgf+FsNhJ4/8Ps3h0DBd6+00S7yxJPj5OiVmvTN7TXs7LVhWnrrnT/utyaOnnyoGyPJXNBpn5eieQnhIdUqr8+YtkNpO2O37gPvlY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784297084; c=relaxed/simple; bh=3E/tqSH360XSqg1OCzjf9XdodE298Vql8IMXehxra3E=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=T2JmMESVFZyskmCgwqxKM/P5cslXq//GOskplvo5JWa4cxlaQncI61hSMOuRlplr7aTJ6B5w46NU+kFfcVZefKVWmkWFf/qv05wUFHplsUvywhv9j7pY2iKOPqg6aFHRHvOa4rq1d0X0zBQJkN/PMwDFQrmE9uExbRMY3Jo+wDo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=RKjpl7wb; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="RKjpl7wb" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784297079; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=YK0UElVQAi+rBDr+qdXgzYaaDbZtSZ/mtY5vOEzXsbY=; b=RKjpl7wbjfu2VTSqpBatpnZs13R04+cMfCeCCJ/zyj6qR3lQaLvHtOvvX8o+jx7980FCyG jmbzUyIbFQ1Uo5Te48gkdDfuA3ie9f7nOGgikIevvdEOgNdn2LVWsyDCx/Q+/q65cJaUM9 r1IuQZglmh083iwm/FQQjIicDi8k9Hw= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-453-yZJZwCxON7WL0TDbY4iHfw-1; Fri, 17 Jul 2026 10:03:27 -0400 X-MC-Unique: yZJZwCxON7WL0TDbY4iHfw-1 X-Mimecast-MFC-AGG-ID: yZJZwCxON7WL0TDbY4iHfw_1784297004 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E8BF219540CF; Fri, 17 Jul 2026 14:03:23 +0000 (UTC) Received: from [192.168.1.153] (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id BCEEC18005B3; Fri, 17 Jul 2026 14:03:09 +0000 (UTC) From: Albert Esteve Date: Fri, 17 Jul 2026 16:02:06 +0200 Subject: [PATCH v3 3/4] drm/panel: of_drm_find_panel() return a counted reference Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260717-drm_refcount_wiring-v3-3-023900c32e01@redhat.com> References: <20260717-drm_refcount_wiring-v3-0-023900c32e01@redhat.com> In-Reply-To: <20260717-drm_refcount_wiring-v3-0-023900c32e01@redhat.com> To: Neil Armstrong , Jessica Zhang , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrzej Hajda , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Luca Ceresoli , Inki Dae , Jagan Teki , Marek Szyprowski , Laurentiu Palcu , Lucas Stach , Frank Li , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , Paul Cercueil , Linus Walleij , Marek Vasut , Stefan Agner , Tomi Valkeinen , Laurent Pinchart , Kieran Bingham , Geert Uytterhoeven , Magnus Damm , Biju Das , Sandy Huang , =?utf-8?q?Heiko_St=C3=BCbner?= , Andy Yan , Yannick Fertre , Raphael Gallais-Pou , Philippe Cornu , Maxime Coquelin , Alexandre Torgue , Chen-Yu Tsai , Samuel Holland , Jyri Sarha , Jingoo Han , Seung-Woo Kim , Kyungmin Park , Krzysztof Kozlowski , Peter Griffin , Alim Akhtar , Alison Wang , Paul Kocialkowski , Alain Volmat , Raphael Gallais-Pou , Thierry Reding , Mikko Perttunen , Jonathan Hunter Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, imx@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-mips@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-rockchip@lists.infradead.org, linux-stm32@st-md-mailman.stormreply.com, linux-sunxi@lists.linux.dev, linux-samsung-soc@vger.kernel.org, linux-tegra@vger.kernel.org, Albert Esteve X-Developer-Signature: v=1; a=ed25519-sha256; t=1784296938; l=34080; i=aesteve@redhat.com; s=20260303; h=from:subject:message-id; bh=3E/tqSH360XSqg1OCzjf9XdodE298Vql8IMXehxra3E=; b=K0m1nQAlYkRE4QiygvbHDnFyW0AzrdUAC2GZFYXkMMjANVthJtAYC/F344HfpQg5tUMlkqfpU 7q/LsbQKzcVAghZalPT3FkEHEsUMuHyHzaeGAK7u2FaBGpz4XQf3kj/ X-Developer-Key: i=aesteve@redhat.com; a=ed25519; pk=YSFz6sOHd2L45+Fr8DIvHTi6lSIjhLZ5T+rkxspJt1s= X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Callers of of_drm_find_panel() and drm_of_find_panel_or_bridge() receive a pointer with no reference held, creating a window where the panel device can be unregistered and freed between the lookup and first use (e.g., drm_panel_prepare()). Fix the lookup function by acquiring a reference with drm_panel_get() before returning, under panel_lock. Callers are now responsible for calling drm_panel_put() when they no longer need the pointer. For bridge drivers that immediately wrap the panel in a panel_bridge (which acquires its own reference), release the lookup reference right after the bridge creation call. For analogix-anx6345, which stores the panel for direct use, release the reference in the i2c remove path. For platform drivers using analogix_dp_core with a component lifecycle (exynos_dp, rockchip analogix_dp), release the lookup reference in the platform remove() function. The panel_bridge created during bind() holds a separate reference that devm cleanup releases after remove() returns. Also fix devm_drm_of_get_bridge() and drmm_of_get_bridge() in bridge/panel.c itself, update a second batch of drivers calling of_drm_find_panel() or drm_of_find_panel_or_bridge() to release the lookup reference after wrapping the panel in a bridge, and handle the cases where a panel is found but cannot be used, dropping the reference immediately in those paths. Assisted-by: Claude:claude-opus-4-6 Acked-by: Maxime Ripard Signed-off-by: Albert Esteve --- drivers/gpu/drm/bridge/analogix/analogix-anx6345.c | 12 +++++++++++ drivers/gpu/drm/bridge/fsl-ldb.c | 1 + drivers/gpu/drm/bridge/lontium-lt9211.c | 1 + drivers/gpu/drm/bridge/lvds-codec.c | 1 + drivers/gpu/drm/bridge/panel.c | 8 ++++++-- drivers/gpu/drm/bridge/samsung-dsim.c | 1 + drivers/gpu/drm/bridge/ssd2825.c | 1 + drivers/gpu/drm/bridge/tc358767.c | 2 ++ drivers/gpu/drm/bridge/tc358768.c | 1 + drivers/gpu/drm/bridge/waveshare-dsi.c | 1 + drivers/gpu/drm/drm_of.c | 3 ++- drivers/gpu/drm/drm_panel.c | 12 +++++++---- drivers/gpu/drm/exynos/exynos_dp.c | 19 ++++++++++++++++- drivers/gpu/drm/exynos/exynos_drm_dpi.c | 3 +++ drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c | 18 ++++++++++++++++ drivers/gpu/drm/imx/dcss/dcss-kms.c | 3 +++ drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 4 +++- drivers/gpu/drm/logicvc/logicvc_interface.c | 12 +++++++++++ drivers/gpu/drm/mcde/mcde_drv.c | 1 + drivers/gpu/drm/mcde/mcde_dsi.c | 1 + drivers/gpu/drm/mxsfb/mxsfb_drv.c | 1 + drivers/gpu/drm/omapdrm/dss/output.c | 1 + drivers/gpu/drm/pl111/pl111_drv.c | 1 + drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.c | 1 + drivers/gpu/drm/renesas/rcar-du/rcar_lvds.c | 1 + drivers/gpu/drm/renesas/rz-du/rzg2l_du_encoder.c | 1 + drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 11 ++++++++++ drivers/gpu/drm/rockchip/rockchip_lvds.c | 4 ++++ drivers/gpu/drm/rockchip/rockchip_rgb.c | 3 +++ drivers/gpu/drm/sti/sti_dvo.c | 3 +++ drivers/gpu/drm/stm/ltdc.c | 1 + drivers/gpu/drm/stm/lvds.c | 12 ++++++++--- drivers/gpu/drm/sun4i/sun4i_lvds.c | 13 ++++++++++++ drivers/gpu/drm/sun4i/sun4i_rgb.c | 13 ++++++++++++ drivers/gpu/drm/sun4i/sun4i_tcon.c | 2 ++ drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 6 +++++- drivers/gpu/drm/tegra/dsi.c | 5 +++++ drivers/gpu/drm/tegra/output.c | 24 ++++++++++++++++++= +--- drivers/gpu/drm/tidss/tidss_kms.c | 16 ++++++++++----- drivers/gpu/drm/tve200/tve200_drv.c | 1 + 40 files changed, 204 insertions(+), 21 deletions(-) diff --git a/drivers/gpu/drm/bridge/analogix/analogix-anx6345.c b/drivers/g= pu/drm/bridge/analogix/analogix-anx6345.c index f3fe47b12edca..7330ccb2c74cf 100644 --- a/drivers/gpu/drm/bridge/analogix/analogix-anx6345.c +++ b/drivers/gpu/drm/bridge/analogix/analogix-anx6345.c @@ -658,6 +658,11 @@ static bool anx6345_get_chip_id(struct anx6345 *anx634= 5) return false; } =20 +static void anx6345_panel_put_action(void *data) +{ + drm_panel_put(data); +} + static int anx6345_i2c_probe(struct i2c_client *client) { struct anx6345 *anx6345; @@ -686,6 +691,13 @@ static int anx6345_i2c_probe(struct i2c_client *client) if (err) DRM_DEBUG("No panel found\n"); =20 + if (anx6345->panel) { + err =3D devm_add_action_or_reset(dev, anx6345_panel_put_action, + anx6345->panel); + if (err) + return err; + } + /* 1.2V digital core power regulator */ anx6345->dvdd12 =3D devm_regulator_get(dev, "dvdd12"); if (IS_ERR(anx6345->dvdd12)) { diff --git a/drivers/gpu/drm/bridge/fsl-ldb.c b/drivers/gpu/drm/bridge/fsl-= ldb.c index 9bfaa3f933709..27d7ba252927b 100644 --- a/drivers/gpu/drm/bridge/fsl-ldb.c +++ b/drivers/gpu/drm/bridge/fsl-ldb.c @@ -348,6 +348,7 @@ static int fsl_ldb_probe(struct platform_device *pdev) fsl_ldb->use_termination_resistor =3D true; =20 fsl_ldb->panel_bridge =3D devm_drm_panel_bridge_add(dev, panel); + drm_panel_put(panel); if (IS_ERR(fsl_ldb->panel_bridge)) return PTR_ERR(fsl_ldb->panel_bridge); =20 diff --git a/drivers/gpu/drm/bridge/lontium-lt9211.c b/drivers/gpu/drm/brid= ge/lontium-lt9211.c index 870175a848390..ae4aeba032a33 100644 --- a/drivers/gpu/drm/bridge/lontium-lt9211.c +++ b/drivers/gpu/drm/bridge/lontium-lt9211.c @@ -660,6 +660,7 @@ static int lt9211_parse_dt(struct lt9211 *ctx) return ret; if (panel) { panel_bridge =3D devm_drm_panel_bridge_add(dev, panel); + drm_panel_put(panel); if (IS_ERR(panel_bridge)) return PTR_ERR(panel_bridge); } diff --git a/drivers/gpu/drm/bridge/lvds-codec.c b/drivers/gpu/drm/bridge/l= vds-codec.c index e6a7147e141b6..72ac427e7b88b 100644 --- a/drivers/gpu/drm/bridge/lvds-codec.c +++ b/drivers/gpu/drm/bridge/lvds-codec.c @@ -154,6 +154,7 @@ static int lvds_codec_probe(struct platform_device *pde= v) lvds_codec->panel_bridge =3D devm_drm_panel_bridge_add_typed(dev, panel, lvds_codec->connector_type); + drm_panel_put(panel); if (IS_ERR(lvds_codec->panel_bridge)) return PTR_ERR(lvds_codec->panel_bridge); =20 diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c index 3bfa18167dd26..218445528a57a 100644 --- a/drivers/gpu/drm/bridge/panel.c +++ b/drivers/gpu/drm/bridge/panel.c @@ -515,8 +515,10 @@ struct drm_bridge *devm_drm_of_get_bridge(struct devic= e *dev, if (ret) return ERR_PTR(ret); =20 - if (panel) + if (panel) { bridge =3D devm_drm_panel_bridge_add(dev, panel); + drm_panel_put(panel); + } =20 return bridge; } @@ -549,8 +551,10 @@ struct drm_bridge *drmm_of_get_bridge(struct drm_devic= e *drm, if (ret) return ERR_PTR(ret); =20 - if (panel) + if (panel) { bridge =3D drmm_panel_bridge_add(drm, panel); + drm_panel_put(panel); + } =20 return bridge; } diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge= /samsung-dsim.c index 9ee0515074c78..0cd2a7e195061 100644 --- a/drivers/gpu/drm/bridge/samsung-dsim.c +++ b/drivers/gpu/drm/bridge/samsung-dsim.c @@ -1934,6 +1934,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_h= ost *host, panel =3D of_drm_find_panel(remote); if (!IS_ERR(panel)) { next_bridge =3D devm_drm_panel_bridge_add(dev, panel); + drm_panel_put(panel); if (IS_ERR(next_bridge)) { ret =3D PTR_ERR(next_bridge); next_bridge =3D NULL; // Inhibit the cleanup action on an ERR_PTR diff --git a/drivers/gpu/drm/bridge/ssd2825.c b/drivers/gpu/drm/bridge/ssd2= 825.c index 54ca6bd6883ae..ac6d9b9d1f9e1 100644 --- a/drivers/gpu/drm/bridge/ssd2825.c +++ b/drivers/gpu/drm/bridge/ssd2825.c @@ -301,6 +301,7 @@ static int ssd2825_dsi_host_attach(struct mipi_dsi_host= *host, struct mipi_dsi_d =20 if (panel) { bridge =3D drm_panel_bridge_add_typed(panel, DRM_MODE_CONNECTOR_DSI); + drm_panel_put(panel); if (IS_ERR(bridge)) return PTR_ERR(bridge); } diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc3= 58767.c index 7188935fdb826..29c0a58b907cc 100644 --- a/drivers/gpu/drm/bridge/tc358767.c +++ b/drivers/gpu/drm/bridge/tc358767.c @@ -2329,6 +2329,7 @@ static int tc_probe_dpi_bridge_endpoint(struct tc_dat= a *tc) =20 if (panel) { bridge =3D devm_drm_panel_bridge_add(dev, panel); + drm_panel_put(panel); if (IS_ERR(bridge)) return PTR_ERR(bridge); } @@ -2359,6 +2360,7 @@ static int tc_probe_edp_bridge_endpoint(struct tc_dat= a *tc) struct drm_bridge *panel_bridge; =20 panel_bridge =3D devm_drm_panel_bridge_add(dev, panel); + drm_panel_put(panel); if (IS_ERR(panel_bridge)) return PTR_ERR(panel_bridge); =20 diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc3= 58768.c index 0f2820b373029..560cf2ab12079 100644 --- a/drivers/gpu/drm/bridge/tc358768.c +++ b/drivers/gpu/drm/bridge/tc358768.c @@ -479,6 +479,7 @@ static int tc358768_dsi_host_attach(struct mipi_dsi_hos= t *host, if (panel) { bridge =3D drm_panel_bridge_add_typed(panel, DRM_MODE_CONNECTOR_DSI); + drm_panel_put(panel); if (IS_ERR(bridge)) return PTR_ERR(bridge); =20 diff --git a/drivers/gpu/drm/bridge/waveshare-dsi.c b/drivers/gpu/drm/bridg= e/waveshare-dsi.c index ded57f298d640..650d9be7ae661 100644 --- a/drivers/gpu/drm/bridge/waveshare-dsi.c +++ b/drivers/gpu/drm/bridge/waveshare-dsi.c @@ -163,6 +163,7 @@ static int ws_bridge_probe(struct i2c_client *i2c) return dev_err_probe(dev, ret, "Failed to find remote panel\n"); =20 ws->next_bridge =3D devm_drm_panel_bridge_add(dev, panel); + drm_panel_put(panel); if (IS_ERR(ws->next_bridge)) return PTR_ERR(ws->next_bridge); =20 diff --git a/drivers/gpu/drm/drm_of.c b/drivers/gpu/drm/drm_of.c index d03ada82eac96..1873a84514a68 100644 --- a/drivers/gpu/drm/drm_of.c +++ b/drivers/gpu/drm/drm_of.c @@ -225,7 +225,8 @@ EXPORT_SYMBOL_GPL(drm_of_encoder_active_endpoint); * @np: device tree node containing encoder output ports * @port: port in the device tree node * @endpoint: endpoint in the device tree node - * @panel: pointer to hold returned drm_panel, must not be NULL + * @panel: pointer to hold returned drm_panel, must not be NULL. On success + * the caller must call drm_panel_put() when done with the panel * @bridge: pointer to hold returned drm_bridge * * Given a DT node's port and endpoint number, find the connected node and diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c index 545fe93dc28fe..72cf86253c0cd 100644 --- a/drivers/gpu/drm/drm_panel.c +++ b/drivers/gpu/drm/drm_panel.c @@ -458,14 +458,17 @@ EXPORT_SYMBOL(__devm_drm_panel_alloc); =20 #ifdef CONFIG_OF /** - * of_drm_find_panel - look up a panel using a device tree node + * of_drm_find_panel - look up and reference a panel by device tree node * @np: device tree node of the panel * * Searches the set of registered panels for one that matches the given de= vice - * tree node. If a matching panel is found, return a pointer to it. + * tree node. If a matching panel is found, the panel's reference count is + * incremented before returning a pointer to it. The caller must call + * drm_panel_put() when it no longer needs the panel pointer. * - * Return: A pointer to the panel registered for the specified device tree - * node or an ERR_PTR() if no panel matching the device tree node can be f= ound. + * Return: A reference-counted pointer to the panel registered for the spe= cified + * device tree node or an ERR_PTR() if no panel matching the device tree n= ode + * can be found. * * Possible error codes returned by this function: * @@ -484,6 +487,7 @@ struct drm_panel *of_drm_find_panel(const struct device= _node *np) =20 list_for_each_entry(panel, &panel_list, list) { if (panel->dev->of_node =3D=3D np) { + drm_panel_get(panel); mutex_unlock(&panel_lock); return panel; } diff --git a/drivers/gpu/drm/exynos/exynos_dp.c b/drivers/gpu/drm/exynos/ex= ynos_dp.c index b805403281504..a418011f7d4d6 100644 --- a/drivers/gpu/drm/exynos/exynos_dp.c +++ b/drivers/gpu/drm/exynos/exynos_dp.c @@ -182,8 +182,15 @@ static int exynos_dp_probe(struct platform_device *pde= v) =20 out: dp->adp =3D analogix_dp_probe(dev, &dp->plat_data); - if (IS_ERR(dp->adp)) + if (IS_ERR(dp->adp)) { + /* + * The driver core does not invoke remove() for failed probes, + * so release the probe-time panel reference here. + */ + if (dp->plat_data.panel) + drm_panel_put(dp->plat_data.panel); return PTR_ERR(dp->adp); + } =20 if (dp->plat_data.panel || dp->plat_data.next_bridge) return component_add(&pdev->dev, &exynos_dp_ops); @@ -193,6 +200,16 @@ static int exynos_dp_probe(struct platform_device *pde= v) =20 static void exynos_dp_remove(struct platform_device *pdev) { + struct exynos_dp_device *dp =3D platform_get_drvdata(pdev); + + /* + * Release the probe-time reference from of_drm_find_panel(). If bind + * ran, the panel_bridge holds a second reference that devm cleanup + * will release when the bridge is destroyed after remove() returns. + */ + if (dp->plat_data.panel) + drm_panel_put(dp->plat_data.panel); + component_del(&pdev->dev, &exynos_dp_ops); } =20 diff --git a/drivers/gpu/drm/exynos/exynos_drm_dpi.c b/drivers/gpu/drm/exyn= os/exynos_drm_dpi.c index 0dc36df6ada34..9d15a0035ea99 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_dpi.c +++ b/drivers/gpu/drm/exynos/exynos_drm_dpi.c @@ -245,5 +245,8 @@ int exynos_dpi_remove(struct drm_encoder *encoder) =20 exynos_dpi_disable(&ctx->encoder); =20 + if (ctx->panel) + drm_panel_put(ctx->panel); + return 0; } diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c b/drivers/gpu/drm/fs= l-dcu/fsl_dcu_drm_rgb.c index 84eff7519e322..ec71fbbb0eb89 100644 --- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c +++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c @@ -109,6 +109,13 @@ static int fsl_dcu_attach_panel(struct fsl_dcu_drm_dev= ice *fsl_dev, return ret; } =20 +static void fsl_dcu_panel_put_action(void *data) +{ + struct drm_panel *panel =3D data; + + drm_panel_put(panel); +} + int fsl_dcu_create_outputs(struct fsl_dcu_drm_device *fsl_dev) { struct device_node *panel_node; @@ -124,6 +131,12 @@ int fsl_dcu_create_outputs(struct fsl_dcu_drm_device *= fsl_dev) if (IS_ERR(fsl_dev->connector.panel)) return PTR_ERR(fsl_dev->connector.panel); =20 + ret =3D devm_add_action_or_reset(fsl_dev->dev, + fsl_dcu_panel_put_action, + fsl_dev->connector.panel); + if (ret) + return ret; + return fsl_dcu_attach_panel(fsl_dev, fsl_dev->connector.panel); } =20 @@ -132,6 +145,11 @@ int fsl_dcu_create_outputs(struct fsl_dcu_drm_device *= fsl_dev) return ret; =20 if (panel) { + ret =3D devm_add_action_or_reset(fsl_dev->dev, + fsl_dcu_panel_put_action, panel); + if (ret) + return ret; + fsl_dev->connector.panel =3D panel; return fsl_dcu_attach_panel(fsl_dev, panel); } diff --git a/drivers/gpu/drm/imx/dcss/dcss-kms.c b/drivers/gpu/drm/imx/dcss= /dcss-kms.c index 50bd7f36d36dd..01e0c10b6ea1a 100644 --- a/drivers/gpu/drm/imx/dcss/dcss-kms.c +++ b/drivers/gpu/drm/imx/dcss/dcss-kms.c @@ -77,6 +77,9 @@ static int dcss_kms_bridge_connector_init(struct dcss_kms= _dev *kms) if (ret) return ret; =20 + if (panel) + drm_panel_put(panel); + if (!bridge) { dev_err(ddev->dev, "No bridge found %d.\n", ret); return -ENODEV; diff --git a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c b/drivers/gpu/drm/in= genic/ingenic-drm-drv.c index 42c86f195c66b..1887e01d29701 100644 --- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c +++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c @@ -1297,9 +1297,11 @@ static int ingenic_drm_bind(struct device *dev, bool= has_components) goto err_drvdata; } =20 - if (panel) + if (panel) { bridge =3D devm_drm_panel_bridge_add_typed(dev, panel, DRM_MODE_CONNECTOR_DPI); + drm_panel_put(panel); + } =20 ib =3D drmm_encoder_alloc(drm, struct ingenic_drm_bridge, encoder, NULL, DRM_MODE_ENCODER_DPI, NULL); diff --git a/drivers/gpu/drm/logicvc/logicvc_interface.c b/drivers/gpu/drm/= logicvc/logicvc_interface.c index 689049d395c0d..81f760dc07f8d 100644 --- a/drivers/gpu/drm/logicvc/logicvc_interface.c +++ b/drivers/gpu/drm/logicvc/logicvc_interface.c @@ -28,6 +28,11 @@ #define logicvc_interface_from_drm_connector(c) \ container_of(c, struct logicvc_interface, drm_connector) =20 +static void logicvc_panel_put_action(void *data) +{ + drm_panel_put(data); +} + static void logicvc_encoder_enable(struct drm_encoder *drm_encoder) { struct logicvc_drm *logicvc =3D logicvc_drm(drm_encoder->dev); @@ -160,6 +165,13 @@ int logicvc_interface_init(struct logicvc_drm *logicvc) if (ret =3D=3D -EPROBE_DEFER) goto error_early; =20 + if (interface->drm_panel) { + ret =3D devm_add_action_or_reset(dev, logicvc_panel_put_action, + interface->drm_panel); + if (ret) + goto error_early; + } + ret =3D drm_encoder_init(drm_dev, &interface->drm_encoder, &logicvc_encoder_funcs, encoder_type, NULL); if (ret) { diff --git a/drivers/gpu/drm/mcde/mcde_drv.c b/drivers/gpu/drm/mcde/mcde_dr= v.c index 5f2c462bad7e1..53275b575f0cb 100644 --- a/drivers/gpu/drm/mcde/mcde_drv.c +++ b/drivers/gpu/drm/mcde/mcde_drv.c @@ -153,6 +153,7 @@ static int mcde_modeset_init(struct drm_device *drm) if (panel) { bridge =3D drm_panel_bridge_add_typed(panel, DRM_MODE_CONNECTOR_DPI); + drm_panel_put(panel); if (IS_ERR(bridge)) { dev_err(drm->dev, "Could not connect panel bridge\n"); diff --git a/drivers/gpu/drm/mcde/mcde_dsi.c b/drivers/gpu/drm/mcde/mcde_ds= i.c index 47d45897ed069..d9a454f226f79 100644 --- a/drivers/gpu/drm/mcde/mcde_dsi.c +++ b/drivers/gpu/drm/mcde/mcde_dsi.c @@ -1124,6 +1124,7 @@ static int mcde_dsi_bind(struct device *dev, struct d= evice *master, if (panel) { bridge =3D drm_panel_bridge_add_typed(panel, DRM_MODE_CONNECTOR_DSI); + drm_panel_put(panel); if (IS_ERR(bridge)) { dev_err(dev, "error adding panel bridge\n"); return PTR_ERR(bridge); diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsf= b_drv.c index 9b8fbda85d28a..7cb19c15bf39e 100644 --- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c +++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c @@ -127,6 +127,7 @@ static int mxsfb_attach_bridge(struct mxsfb_drm_private= *mxsfb) if (panel) { bridge =3D devm_drm_panel_bridge_add_typed(drm->dev, panel, DRM_MODE_CONNECTOR_DPI); + drm_panel_put(panel); if (IS_ERR(bridge)) return PTR_ERR(bridge); } diff --git a/drivers/gpu/drm/omapdrm/dss/output.c b/drivers/gpu/drm/omapdrm= /dss/output.c index ca891aba38209..6e9bc605ee22f 100644 --- a/drivers/gpu/drm/omapdrm/dss/output.c +++ b/drivers/gpu/drm/omapdrm/dss/output.c @@ -43,6 +43,7 @@ int omapdss_device_init_output(struct omap_dss_device *ou= t, struct drm_bridge *bridge; =20 bridge =3D drm_panel_bridge_add(out->panel); + drm_panel_put(out->panel); if (IS_ERR(bridge)) { dev_err(out->dev, "unable to create panel bridge (%ld)\n", diff --git a/drivers/gpu/drm/pl111/pl111_drv.c b/drivers/gpu/drm/pl111/pl11= 1_drv.c index ac7b1d12a0f59..8ec659b3c08eb 100644 --- a/drivers/gpu/drm/pl111/pl111_drv.c +++ b/drivers/gpu/drm/pl111/pl111_drv.c @@ -145,6 +145,7 @@ static int pl111_modeset_init(struct drm_device *dev) if (panel) { bridge =3D drm_panel_bridge_add_typed(panel, DRM_MODE_CONNECTOR_Unknown); + drm_panel_put(panel); if (IS_ERR(bridge)) { ret =3D PTR_ERR(bridge); goto finish; diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.c b/drivers/gp= u/drm/renesas/rcar-du/rcar_du_encoder.c index db2088529b480..d8e7e9877ba86 100644 --- a/drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.c +++ b/drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.c @@ -69,6 +69,7 @@ int rcar_du_encoder_init(struct rcar_du_device *rcdu, =20 bridge =3D devm_drm_panel_bridge_add_typed(rcdu->dev, panel, DRM_MODE_CONNECTOR_DPI); + drm_panel_put(panel); if (IS_ERR(bridge)) return PTR_ERR(no_free_ptr(bridge)); =20 diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_lvds.c b/drivers/gpu/drm/= renesas/rcar-du/rcar_lvds.c index 154410745a74b..cc2996f044721 100644 --- a/drivers/gpu/drm/renesas/rcar-du/rcar_lvds.c +++ b/drivers/gpu/drm/renesas/rcar-du/rcar_lvds.c @@ -791,6 +791,7 @@ static int rcar_lvds_parse_dt(struct rcar_lvds *lvds) if (lvds->panel) { lvds->next_bridge =3D devm_drm_panel_bridge_add(lvds->dev, lvds->panel); + drm_panel_put(lvds->panel); if (IS_ERR_OR_NULL(lvds->next_bridge)) { ret =3D -EINVAL; goto done; diff --git a/drivers/gpu/drm/renesas/rz-du/rzg2l_du_encoder.c b/drivers/gpu= /drm/renesas/rz-du/rzg2l_du_encoder.c index f50d166b764f5..3d0999e4fcfdf 100644 --- a/drivers/gpu/drm/renesas/rz-du/rzg2l_du_encoder.c +++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_du_encoder.c @@ -90,6 +90,7 @@ int rzg2l_du_encoder_init(struct rzg2l_du_device *rcdu, =20 bridge =3D devm_drm_panel_bridge_add_typed(rcdu->dev, panel, DRM_MODE_CONNECTOR_DPI); + drm_panel_put(panel); if (IS_ERR(bridge)) return PTR_ERR(no_free_ptr(bridge)); =20 diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/= drm/rockchip/analogix_dp-rockchip.c index 06072efd7fca3..4b2795a6caf8c 100644 --- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c +++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c @@ -27,6 +27,7 @@ #include #include #include +#include #include #include #include @@ -472,6 +473,16 @@ static int rockchip_dp_probe(struct platform_device *p= dev) =20 static void rockchip_dp_remove(struct platform_device *pdev) { + struct rockchip_dp_device *dp =3D platform_get_drvdata(pdev); + + /* + * Release the probe-time reference from of_drm_find_panel(). If bind + * ran, the panel_bridge holds a second reference that devm cleanup + * will release when the bridge is destroyed after remove() returns. + */ + if (dp->plat_data.panel) + drm_panel_put(dp->plat_data.panel); + component_del(&pdev->dev, &rockchip_dp_component_ops); } =20 diff --git a/drivers/gpu/drm/rockchip/rockchip_lvds.c b/drivers/gpu/drm/roc= kchip/rockchip_lvds.c index 7a0c4fa29f2f0..d99dc708572e1 100644 --- a/drivers/gpu/drm/rockchip/rockchip_lvds.c +++ b/drivers/gpu/drm/rockchip/rockchip_lvds.c @@ -605,6 +605,8 @@ static int rockchip_lvds_bind(struct device *dev, struc= t device *master, =20 if (lvds->panel) { lvds->bridge =3D drm_panel_bridge_add_typed(lvds->panel, DRM_MODE_CONNEC= TOR_LVDS); + drm_panel_put(lvds->panel); + lvds->panel =3D NULL; if (IS_ERR(lvds->bridge)) { ret =3D PTR_ERR(lvds->bridge); goto err_free_encoder; @@ -641,6 +643,8 @@ static int rockchip_lvds_bind(struct device *dev, struc= t device *master, err_free_encoder: drm_encoder_cleanup(encoder); err_put_remote: + if (lvds->panel) + drm_panel_put(lvds->panel); of_node_put(remote); err_put_port: of_node_put(port); diff --git a/drivers/gpu/drm/rockchip/rockchip_rgb.c b/drivers/gpu/drm/rock= chip/rockchip_rgb.c index add3123e5ce70..c908ea4cfa67a 100644 --- a/drivers/gpu/drm/rockchip/rockchip_rgb.c +++ b/drivers/gpu/drm/rockchip/rockchip_rgb.c @@ -131,6 +131,8 @@ struct rockchip_rgb *rockchip_rgb_init(struct device *d= ev, if (ret < 0) { DRM_DEV_ERROR(drm_dev->dev, "failed to initialize encoder: %d\n", ret); + if (panel) + drm_panel_put(panel); return ERR_PTR(ret); } =20 @@ -139,6 +141,7 @@ struct rockchip_rgb *rockchip_rgb_init(struct device *d= ev, if (panel) { bridge =3D drm_panel_bridge_add_typed(panel, DRM_MODE_CONNECTOR_LVDS); + drm_panel_put(panel); if (IS_ERR(bridge)) return ERR_CAST(bridge); } diff --git a/drivers/gpu/drm/sti/sti_dvo.c b/drivers/gpu/drm/sti/sti_dvo.c index 7484d3c3f4ed5..64a9da0362fb8 100644 --- a/drivers/gpu/drm/sti/sti_dvo.c +++ b/drivers/gpu/drm/sti/sti_dvo.c @@ -492,6 +492,9 @@ static void sti_dvo_unbind(struct device *dev, { struct sti_dvo *dvo =3D dev_get_drvdata(dev); =20 + if (dvo->panel) + drm_panel_put(dvo->panel); + drm_bridge_remove(&dvo->bridge); } =20 diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c index 95fcfa48d8be3..daf198edb42f5 100644 --- a/drivers/gpu/drm/stm/ltdc.c +++ b/drivers/gpu/drm/stm/ltdc.c @@ -1982,6 +1982,7 @@ int ltdc_load(struct drm_device *ddev) =20 if (panel) { bridge =3D drmm_panel_bridge_add(ddev, panel); + drm_panel_put(panel); if (IS_ERR(bridge)) { drm_err(ddev, "panel-bridge endpoint %d\n", i); ret =3D PTR_ERR(bridge); diff --git a/drivers/gpu/drm/stm/lvds.c b/drivers/gpu/drm/stm/lvds.c index 50a878688e477..f887a708afb73 100644 --- a/drivers/gpu/drm/stm/lvds.c +++ b/drivers/gpu/drm/stm/lvds.c @@ -1068,20 +1068,20 @@ static int lvds_probe(struct platform_device *pdev) if (IS_ERR(lvds->base)) { ret =3D PTR_ERR(lvds->base); dev_err(dev, "Unable to get regs %d\n", ret); - return ret; + goto err_put_panel; } =20 lvds->pclk =3D devm_clk_get(dev, "pclk"); if (IS_ERR(lvds->pclk)) { ret =3D PTR_ERR(lvds->pclk); dev_err(dev, "Unable to get peripheral clock: %d\n", ret); - return ret; + goto err_put_panel; } =20 ret =3D clk_prepare_enable(lvds->pclk); if (ret) { dev_err(dev, "%s: Failed to enable peripheral clk\n", __func__); - return ret; + goto err_put_panel; } =20 rstc =3D devm_reset_control_get_exclusive(dev, NULL); @@ -1181,6 +1181,9 @@ static int lvds_probe(struct platform_device *pdev) =20 err_lvds_probe: clk_disable_unprepare(lvds->pclk); +err_put_panel: + if (lvds->panel) + drm_panel_put(lvds->panel); =20 return ret; } @@ -1189,6 +1192,9 @@ static void lvds_remove(struct platform_device *pdev) { struct stm_lvds *lvds =3D platform_get_drvdata(pdev); =20 + if (lvds->panel) + drm_panel_put(lvds->panel); + lvds_pixel_clk_unregister(lvds); =20 drm_bridge_remove(&lvds->lvds_bridge); diff --git a/drivers/gpu/drm/sun4i/sun4i_lvds.c b/drivers/gpu/drm/sun4i/sun= 4i_lvds.c index 6716e895ae8a4..e1b342c922224 100644 --- a/drivers/gpu/drm/sun4i/sun4i_lvds.c +++ b/drivers/gpu/drm/sun4i/sun4i_lvds.c @@ -18,6 +18,11 @@ #include "sun4i_tcon.h" #include "sun4i_lvds.h" =20 +static void sun4i_panel_put_action(void *data) +{ + drm_panel_put(data); +} + struct sun4i_lvds { struct drm_connector connector; struct drm_encoder encoder; @@ -113,6 +118,14 @@ int sun4i_lvds_init(struct drm_device *drm, struct sun= 4i_tcon *tcon) return 0; } =20 + if (lvds->panel) { + ret =3D devm_add_action_or_reset(tcon->dev, + sun4i_panel_put_action, + lvds->panel); + if (ret) + return ret; + } + drm_encoder_helper_add(&lvds->encoder, &sun4i_lvds_enc_helper_funcs); ret =3D drm_simple_encoder_init(drm, &lvds->encoder, diff --git a/drivers/gpu/drm/sun4i/sun4i_rgb.c b/drivers/gpu/drm/sun4i/sun4= i_rgb.c index dfb6acc42f02e..0066bec5a9e5a 100644 --- a/drivers/gpu/drm/sun4i/sun4i_rgb.c +++ b/drivers/gpu/drm/sun4i/sun4i_rgb.c @@ -43,6 +43,11 @@ drm_encoder_to_sun4i_rgb(struct drm_encoder *encoder) encoder); } =20 +static void sun4i_panel_put_action(void *data) +{ + drm_panel_put(data); +} + static int sun4i_rgb_get_modes(struct drm_connector *connector) { struct sun4i_rgb *rgb =3D @@ -205,6 +210,14 @@ int sun4i_rgb_init(struct drm_device *drm, struct sun4= i_tcon *tcon) return 0; } =20 + if (rgb->panel) { + ret =3D devm_add_action_or_reset(tcon->dev, + sun4i_panel_put_action, + rgb->panel); + if (ret) + return ret; + } + drm_encoder_helper_add(&rgb->encoder, &sun4i_rgb_enc_helper_funcs); ret =3D drm_simple_encoder_init(drm, &rgb->encoder, diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun= 4i_tcon.c index 960e83c8291da..d4c1723c5e3d8 100644 --- a/drivers/gpu/drm/sun4i/sun4i_tcon.c +++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c @@ -1326,6 +1326,8 @@ static int sun4i_tcon_probe(struct platform_device *p= dev) ret =3D drm_of_find_panel_or_bridge(node, 1, 0, &panel, &bridge); if (ret =3D=3D -EPROBE_DEFER) return ret; + if (panel) + drm_panel_put(panel); } =20 return component_add(&pdev->dev, &sun4i_tcon_ops); diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i= /sun6i_mipi_dsi.c index c35b70d83e53b..09c2a48b59128 100644 --- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c @@ -967,8 +967,10 @@ static int sun6i_dsi_attach(struct mipi_dsi_host *host, =20 if (IS_ERR(panel)) return PTR_ERR(panel); - if (!dsi->drm || !dsi->drm->registered) + if (!dsi->drm || !dsi->drm->registered) { + drm_panel_put(panel); return -EPROBE_DEFER; + } =20 dsi->panel =3D panel; dsi->device =3D device; @@ -985,6 +987,8 @@ static int sun6i_dsi_detach(struct mipi_dsi_host *host, { struct sun6i_dsi *dsi =3D host_to_sun6i_dsi(host); =20 + if (dsi->panel) + drm_panel_put(dsi->panel); dsi->panel =3D NULL; dsi->device =3D NULL; =20 diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c index 7f25c50621c94..500d7afd86db1 100644 --- a/drivers/gpu/drm/tegra/dsi.c +++ b/drivers/gpu/drm/tegra/dsi.c @@ -1498,6 +1498,10 @@ static int tegra_dsi_host_attach(struct mipi_dsi_hos= t *host, if (!dsi->master) { struct tegra_output *output =3D &dsi->output; =20 + /* + * tegra_output_probe() never populates a panel for DSI + * outputs, so output->panel is always NULL here. + */ output->panel =3D of_drm_find_panel(device->dev.of_node); if (IS_ERR(output->panel)) output->panel =3D NULL; @@ -1516,6 +1520,7 @@ static int tegra_dsi_host_detach(struct mipi_dsi_host= *host, struct tegra_output *output =3D &dsi->output; =20 if (output->panel && &device->dev =3D=3D output->panel->dev) { + drm_panel_put(output->panel); output->panel =3D NULL; =20 if (output->connector.dev) diff --git a/drivers/gpu/drm/tegra/output.c b/drivers/gpu/drm/tegra/output.c index 49e4f63a5550d..d0ba3bd0aab8f 100644 --- a/drivers/gpu/drm/tegra/output.c +++ b/drivers/gpu/drm/tegra/output.c @@ -117,11 +117,19 @@ int tegra_output_probe(struct tegra_output *output) */ WARN_ON(output->panel || output->bridge); =20 + if (output->panel) { + drm_panel_put(output->panel); + output->panel =3D NULL; + } + output->panel =3D of_drm_find_panel(panel); of_node_put(panel); =20 - if (IS_ERR(output->panel)) - return PTR_ERR(output->panel); + if (IS_ERR(output->panel)) { + err =3D PTR_ERR(output->panel); + output->panel =3D NULL; + return err; + } } =20 ddc =3D of_parse_phandle(output->of_node, "nvidia,ddc-i2c-bus", 0); @@ -131,7 +139,7 @@ int tegra_output_probe(struct tegra_output *output) =20 if (!output->ddc) { err =3D -EPROBE_DEFER; - return err; + goto put_i2c; } } =20 @@ -185,6 +193,11 @@ int tegra_output_probe(struct tegra_output *output) return 0; =20 put_i2c: + if (output->panel) { + drm_panel_put(output->panel); + output->panel =3D NULL; + } + if (output->ddc) i2c_put_adapter(output->ddc); =20 @@ -195,6 +208,11 @@ int tegra_output_probe(struct tegra_output *output) =20 void tegra_output_remove(struct tegra_output *output) { + if (output->panel) { + drm_panel_put(output->panel); + output->panel =3D NULL; + } + if (output->hpd_gpio) free_irq(output->hpd_irq, output); =20 diff --git a/drivers/gpu/drm/tidss/tidss_kms.c b/drivers/gpu/drm/tidss/tids= s_kms.c index 1512ee2574b66..70c14c3be10d5 100644 --- a/drivers/gpu/drm/tidss/tidss_kms.c +++ b/drivers/gpu/drm/tidss/tidss_kms.c @@ -162,6 +162,7 @@ static int tidss_dispc_modeset_init(struct tidss_device= *tidss) =20 if (panel) { u32 conn_type; + int ret; =20 dev_dbg(dev, "Setting up panel for port %d\n", i); =20 @@ -176,7 +177,8 @@ static int tidss_dispc_modeset_init(struct tidss_device= *tidss) break; default: WARN_ON(1); - return -EINVAL; + ret =3D -EINVAL; + goto put_panel; } =20 if (panel->connector_type !=3D conn_type) { @@ -184,16 +186,20 @@ static int tidss_dispc_modeset_init(struct tidss_devi= ce *tidss) "%s: Panel %s has incompatible connector type for vp%d (%d !=3D %d)\n= ", __func__, dev_name(panel->dev), i, panel->connector_type, conn_type); - return -EINVAL; + ret =3D -EINVAL; + goto put_panel; } =20 bridge =3D devm_drm_panel_bridge_add(dev, panel); - if (IS_ERR(bridge)) { + ret =3D PTR_ERR_OR_ZERO(bridge); + if (ret) dev_err(dev, "failed to set up panel bridge for port %d\n", i); - return PTR_ERR(bridge); - } +put_panel: + drm_panel_put(panel); + if (ret) + return ret; } =20 pipes[num_pipes].hw_videoport =3D i; diff --git a/drivers/gpu/drm/tve200/tve200_drv.c b/drivers/gpu/drm/tve200/t= ve200_drv.c index 562f3f11812a3..f858c58ccb994 100644 --- a/drivers/gpu/drm/tve200/tve200_drv.c +++ b/drivers/gpu/drm/tve200/tve200_drv.c @@ -84,6 +84,7 @@ static int tve200_modeset_init(struct drm_device *dev) if (panel) { bridge =3D drm_panel_bridge_add_typed(panel, DRM_MODE_CONNECTOR_Unknown); + drm_panel_put(panel); if (IS_ERR(bridge)) { ret =3D PTR_ERR(bridge); goto out_bridge; --=20 2.55.0 From nobody Sat Jul 25 04:55:57 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 504191CEAC2 for ; Fri, 17 Jul 2026 14:03:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784297028; cv=none; b=GlkM2uNoXUmLdO1znJhRc+ROGn+WlZ8okMST0EMW3Y1dNov6C9VVyECDWXSwAq69G5HGNmP+GeMJBX+P3lt8PvK1hL3cEGV0PTC6glCrbkIkCH52kQ4B2rDRVQnLsi4pRCM+IczsTw7hcCCvk0rYdG3I4AUmneHtG0dGN4qTt44= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784297028; c=relaxed/simple; bh=ex8HZdHS1q/bkU1HItgMEr14uQTiGY8DQ0yP+8KWPg4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=V7YSsIQpyadyqlmrYPimPTluNQf57sO7ciiftwG6GHjNco+bQxXbzXItaoXFFM/hEsssOA93cGz/GDU0iJ1L58uNKlaoSbWJP/ilhVFsP+qiwC0GCGgLd3jPwPUQxeuIZ0tTFikpm5mY8RfkNpH7as4QRn6gqS64n7XLvhk1plQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=cw9da1Vn; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="cw9da1Vn" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784297026; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=SaIYeA/Jygw7ChE2lz/n+i9CMUk9dImhyfQVRWidUS0=; b=cw9da1VnB1d13qKGiV+DR1uaeGISH4LMtD06ycLAfg8bDvKVY1jPAeXkmdTSRcuqAJm+3W EcdmCtBkCPNPcopnJyGGiTId9CfIQRickuf8tFtaXo3D1472bns5n65DJ2mC3ttEIq/mFS 6jGeQfDuhPoeSCXMZuEsXc7WZfuCZaw= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-557-Bfn509VpOhywaQGT298pQw-1; Fri, 17 Jul 2026 10:03:40 -0400 X-MC-Unique: Bfn509VpOhywaQGT298pQw-1 X-Mimecast-MFC-AGG-ID: Bfn509VpOhywaQGT298pQw_1784297018 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id C3B5F18007EF; Fri, 17 Jul 2026 14:03:37 +0000 (UTC) Received: from [192.168.1.153] (headnet05.pony-001.prod.iad2.dc.redhat.com [10.2.32.117]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 5682B18005B3; Fri, 17 Jul 2026 14:03:24 +0000 (UTC) From: Albert Esteve Date: Fri, 17 Jul 2026 16:02:07 +0200 Subject: [PATCH v3 4/4] drm/panel: find_panel_by_fwnode() return a counted reference Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260717-drm_refcount_wiring-v3-4-023900c32e01@redhat.com> References: <20260717-drm_refcount_wiring-v3-0-023900c32e01@redhat.com> In-Reply-To: <20260717-drm_refcount_wiring-v3-0-023900c32e01@redhat.com> To: Neil Armstrong , Jessica Zhang , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrzej Hajda , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Luca Ceresoli , Inki Dae , Jagan Teki , Marek Szyprowski , Laurentiu Palcu , Lucas Stach , Frank Li , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , Paul Cercueil , Linus Walleij , Marek Vasut , Stefan Agner , Tomi Valkeinen , Laurent Pinchart , Kieran Bingham , Geert Uytterhoeven , Magnus Damm , Biju Das , Sandy Huang , =?utf-8?q?Heiko_St=C3=BCbner?= , Andy Yan , Yannick Fertre , Raphael Gallais-Pou , Philippe Cornu , Maxime Coquelin , Alexandre Torgue , Chen-Yu Tsai , Samuel Holland , Jyri Sarha , Jingoo Han , Seung-Woo Kim , Kyungmin Park , Krzysztof Kozlowski , Peter Griffin , Alim Akhtar , Alison Wang , Paul Kocialkowski , Alain Volmat , Raphael Gallais-Pou , Thierry Reding , Mikko Perttunen , Jonathan Hunter Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, imx@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-mips@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-rockchip@lists.infradead.org, linux-stm32@st-md-mailman.stormreply.com, linux-sunxi@lists.linux.dev, linux-samsung-soc@vger.kernel.org, linux-tegra@vger.kernel.org, Albert Esteve X-Developer-Signature: v=1; a=ed25519-sha256; t=1784296938; l=2362; i=aesteve@redhat.com; s=20260303; h=from:subject:message-id; bh=ex8HZdHS1q/bkU1HItgMEr14uQTiGY8DQ0yP+8KWPg4=; b=Wcce0+dlDbxIuiF5oRxS8RYLj+33umEtxbC6TZM1cuTwUBliy7161daQ/+tCXoUYL4W3a37d/ 0s6+jw8bH9ICEbkzQuS6NDHRpePGlnBJV0pWJFJJycLYHlBwtjWs2V+ X-Developer-Key: i=aesteve@redhat.com; a=ed25519; pk=YSFz6sOHd2L45+Fr8DIvHTi6lSIjhLZ5T+rkxspJt1s= X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 find_panel_by_fwnode() is the fwnode-based counterpart to of_drm_find_panel(), used internally by drm_panel_add_follower(). Like of_drm_find_panel(), it returned an unrefcounted pointer, leaving a window where the panel could be freed between the lookup and first use. drm_panel_add_follower() worked around the missing panel kref by calling get_device() on the panel's underlying struct device. However, get_device() only prevents the device kobject from being freed. It does not prevent the panel's kzalloc()'d container memory from being released when the kref reaches zero. Apply the same fix: call drm_panel_get() under panel_lock before returning. Since find_panel_by_fwnode() now transfers a counted reference to drm_panel_add_follower(), drm_panel_remove_follower() must balance it with a matching drm_panel_put(). Acked-by: Maxime Ripard Signed-off-by: Albert Esteve Reviewed-by: Luca Ceresoli --- drivers/gpu/drm/drm_panel.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c index 72cf86253c0cd..a00ae98ed0956 100644 --- a/drivers/gpu/drm/drm_panel.c +++ b/drivers/gpu/drm/drm_panel.c @@ -542,7 +542,13 @@ int of_drm_get_panel_orientation(const struct device_n= ode *np, EXPORT_SYMBOL(of_drm_get_panel_orientation); #endif =20 -/* Find panel by fwnode. This should be identical to of_drm_find_panel(). = */ +/* + * Find panel by fwnode, returning a counted reference. + * + * Behaves identically to of_drm_find_panel(). On success the returned + * pointer has been passed through drm_panel_get(); the caller must call + * drm_panel_put() when done with it. + */ static struct drm_panel *find_panel_by_fwnode(const struct fwnode_handle *= fwnode) { struct drm_panel *panel; @@ -554,6 +560,7 @@ static struct drm_panel *find_panel_by_fwnode(const str= uct fwnode_handle *fwnode =20 list_for_each_entry(panel, &panel_list, list) { if (dev_fwnode(panel->dev) =3D=3D fwnode) { + drm_panel_get(panel); mutex_unlock(&panel_lock); return panel; } @@ -690,6 +697,7 @@ void drm_panel_remove_follower(struct drm_panel_followe= r *follower) mutex_unlock(&panel->follower_lock); =20 put_device(panel->dev); + drm_panel_put(panel); } EXPORT_SYMBOL(drm_panel_remove_follower); =20 --=20 2.55.0