+1
−0
+41
−0
Loading
drm_for_each_bridge_in_chain() iterates ofer the bridges in an encoder chain without protecting the lifetime of the bridges using drm_bridge_get/put(). This creates a risk window where the bridge could be freed while iterating on it. Users of drm_for_each_bridge_in_chain() cannot solve this reliably. Add variant of drm_for_each_bridge_in_chain() that gets/puts the bridge reference at the beginning/end of each iteration, and puts it if breaking ot of the loop. Note that this requires adding a new drm_bridge_get_next_bridge_and_put() function because, unlike similar functions as __of_get_next_child(), drm_bridge_get_next_bridge() gets the "next" pointer but does not put the "prev" pointer. Unfortunately drm_bridge_get_next_bridge() cannot be modified to put the "prev" pointer because some of its users rely on this, such as drm_atomic_bridge_propagate_bus_flags(). Also deprecate drm_for_each_bridge_in_chain(), in preparation for removing it after converting all users to the scoped version. Reviewed-by:Maxime Ripard <mripard@kernel.org> Link: https://lore.kernel.org/r/20250808-drm-bridge-alloc-getput-for_each_bridge-v2-3-edb6ee81edf1@bootlin.com Signed-off-by:
Luca Ceresoli <luca.ceresoli@bootlin.com>