Commit 17805a15 authored by Luca Ceresoli's avatar Luca Ceresoli
Browse files

drm/bridge: add list of removed refcounted bridges 



Between drm_bridge_add() and drm_bridge_remove() bridges are registered to
the DRM core via the global bridge_list and visible in
/sys/kernel/debug/dri/bridges. However between drm_bridge_remove() and the
last drm_bridge_put() memory is still allocated even though the bridge is
not registered, i.e. not in bridges_list, and also not visible in
debugfs. This prevents debugging refcounted bridges lifetime, especially
leaks due to a missing drm_bridge_put().

In order to allow debugfs to also show the removed bridges, move such
bridges into a new ad-hoc list until they are eventually freed.

Note this requires adding INIT_LIST_HEAD(&bridge->list) in the bridge
initialization code. The lack of such init was not exposing any bug so far,
but it would with the new code, for example when a bridge is allocated and
then freed without calling drm_bridge_add(), which is common on probe
errors.

drm_bridge_add() needs special care for bridges being added after having
been previously added and then removed.  This happens for example for many
non-DCS DSI host bridge drivers like samsung-dsim which
drm_bridge_add/remove() themselves every time the DSI device does a DSI
attaches/detach. When the DSI device is hot-pluggable this happens multiple
times in the lifetime of the DSI host bridge.  On every attach after the
first one, drm_bridge_add() finds bridge->list in the removed list, not at
the initialized state as drm_bridge_add() currently expects. Add a
list_del_init() to remove the bridge from the lingering list and bring
bridge->list back to the initialized state.

Reviewed-by: default avatarMaxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250915-drm-bridge-debugfs-removed-v9-1-6e5c0aff5de9@bootlin.com


Signed-off-by: default avatarLuca Ceresoli <luca.ceresoli@bootlin.com>
parent 9133bc3f

drivers/gpu/drm/drm_bridge.c

+17 −1
Original line number Diff line number Diff line
@@ -197,15 +197,22 @@ 
 * driver.

 */



/* Protect bridge_list and bridge_lingering_list */

static DEFINE_MUTEX(bridge_lock);

static LIST_HEAD(bridge_list);

static LIST_HEAD(bridge_lingering_list);



static void __drm_bridge_free(struct kref *kref)

{

	struct drm_bridge *bridge = container_of(kref, struct drm_bridge, refcount);



	mutex_lock(&bridge_lock);

	list_del(&bridge->list);

	mutex_unlock(&bridge_lock);



	if (bridge->funcs->destroy)

		bridge->funcs->destroy(bridge);



	kfree(bridge->container);

}
@@ -273,6 +280,7 @@ void *__devm_drm_bridge_alloc(struct device *dev, size_t size, size_t offset, 
		return ERR_PTR(-ENOMEM);



	bridge = container + offset;

	INIT_LIST_HEAD(&bridge->list);

	bridge->container = container;

	bridge->funcs = funcs;

	kref_init(&bridge->refcount);
@@ -300,6 +308,14 @@ void drm_bridge_add(struct drm_bridge *bridge) 


	drm_bridge_get(bridge);



	/*

	 * If the bridge was previously added and then removed, it is now

	 * in bridge_lingering_list. Remove it or bridge_lingering_list will be

	 * corrupted when adding this bridge to bridge_list below.

	 */

	if (!list_empty(&bridge->list))

		list_del_init(&bridge->list);



	mutex_init(&bridge->hpd_mutex);



	if (bridge->ops & DRM_BRIDGE_OP_HDMI)
@@ -343,7 +359,7 @@ EXPORT_SYMBOL(devm_drm_bridge_add); 
void drm_bridge_remove(struct drm_bridge *bridge)

{

	mutex_lock(&bridge_lock);

	list_del_init(&bridge->list);

	list_move_tail(&bridge->list, &bridge_lingering_list);

	mutex_unlock(&bridge_lock);



	mutex_destroy(&bridge->hpd_mutex);