[PATCH] tda998x: Check ref count before invoking drm_connector_cleanup in unbind

[PATCH] tda998x: Check ref count before invoking drm_connector_cleanup in unbind

[Ayan Kumar Halder]

In a situation when the reference count of the drm connector is greater than 1,
the unbind function should not invoke drm_connector_cleanup as this will lead
to an inconsistent state where the drm_crtc_state->connector_mask still has
a bitmask referring to the stale connector. Later, when drm driver invokes
drm_atomic_helper_shutdown() which invokes ---> drm_atomic_helper_disable_all()
 ---> drm_atomic_commit() --> drm_atomic_check_only() -->
drm_atomic_helper_check() --> drm_atomic_helper_check_modeset(). This returns
an error due to enabled/connectors mismatch.

In such a scenario, one should just return from _unbind() and let the drm driver
subsequently invoke drm_atomic_helper_shutdown. This will reset the
drm_crtc_state->connector_mask and will shutdown the crtcs. It will also decrement
the reference count of the connectors to 1. Subsequently, drm_mode_config_cleanup
will get invoked which will do the following :-

1. Decrement the reference count for each of the connectors. Thus the ref count
will reach 0 and drm_connector_funcs->destroy() gets called. Thus,
tda998x_connector_destroy() gets invoked which calls drm_connector_cleanup

2. Invokes the destroy callback for each encoder. Thus tda998x_encoder_destroy()
gets invoked.

Signed-off-by: Ayan Kumar Halder <ayan.halder@arm.com>
---
 drivers/gpu/drm/i2c/tda998x_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index 9e67a7b..8ad1cc7 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -1709,6 +1709,9 @@ static void tda998x_unbind(struct device *dev, struct device *master,
 {
 	struct tda998x_priv *priv = dev_get_drvdata(dev);
 
+	if (kref_read(&priv->connector.base.refcount) > 1)
+		return;
+
 	drm_connector_cleanup(&priv->connector);
 	drm_encoder_cleanup(&priv->encoder);
 	tda998x_destroy(priv);
-- 
2.7.4

[PATCH] tda998x: Check ref count before invoking drm_connector_cleanup in unbind

[Ayan Kumar Halder]

In a situation when the reference count of the drm connector is greater than 1,
the unbind function should not invoke drm_connector_cleanup as this will lead
to an inconsistent state where the drm_crtc_state->connector_mask still has
a bitmask referring to the stale connector. Later, when drm driver invokes
drm_atomic_helper_shutdown() which invokes ---> drm_atomic_helper_disable_all()
 ---> drm_atomic_commit() --> drm_atomic_check_only() -->
drm_atomic_helper_check() --> drm_atomic_helper_check_modeset(). This returns
an error due to enabled/connectors mismatch.

In such a scenario, one should just return from _unbind() and let the drm driver
subsequently invoke drm_atomic_helper_shutdown. This will reset the
drm_crtc_state->connector_mask and will shutdown the crtcs. It will also decrement
the reference count of the connectors to 1. Subsequently, drm_mode_config_cleanup
will get invoked which will do the following :-

1. Decrement the reference count for each of the connectors. Thus the ref count
will reach 0 and drm_connector_funcs->destroy() gets called. Thus,
tda998x_connector_destroy() gets invoked which calls drm_connector_cleanup

2. Invokes the destroy callback for each encoder. Thus tda998x_encoder_destroy()
gets invoked.

Signed-off-by: Ayan Kumar Halder <ayan.halder@arm.com>
---
 drivers/gpu/drm/i2c/tda998x_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index 9e67a7b..8ad1cc7 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -1709,6 +1709,9 @@ static void tda998x_unbind(struct device *dev, struct device *master,
 {
 	struct tda998x_priv *priv = dev_get_drvdata(dev);
 
+	if (kref_read(&priv->connector.base.refcount) > 1)
+		return;
+
 	drm_connector_cleanup(&priv->connector);
 	drm_encoder_cleanup(&priv->encoder);
 	tda998x_destroy(priv);
-- 
2.7.4

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] tda998x: Check ref count before invoking drm_connector_cleanup in unbind

[Russell King - ARM Linux]

On Thu, Apr 12, 2018 at 03:42:32PM +0100, Ayan Kumar Halder wrote:
> In a situation when the reference count of the drm connector is greater than 1,
> the unbind function should not invoke drm_connector_cleanup as this will lead
> to an inconsistent state where the drm_crtc_state->connector_mask still has
> a bitmask referring to the stale connector. Later, when drm driver invokes
> drm_atomic_helper_shutdown() which invokes ---> drm_atomic_helper_disable_all()
>  ---> drm_atomic_commit() --> drm_atomic_check_only() -->
> drm_atomic_helper_check() --> drm_atomic_helper_check_modeset(). This returns
> an error due to enabled/connectors mismatch.
> 
> In such a scenario, one should just return from _unbind() and let the drm driver
> subsequently invoke drm_atomic_helper_shutdown. This will reset the
> drm_crtc_state->connector_mask and will shutdown the crtcs. It will also decrement
> the reference count of the connectors to 1. Subsequently, drm_mode_config_cleanup
> will get invoked which will do the following :-

If the device is still in-use after unbind() has been called, that is
_very_ bad news, and probably means that the "host" driver is not
calling component_unbind() at the right point.

Any resources claimed in the bind() callback using devm functions
will be freed, which will include (eg) the drm_encoder structure and
in fact the drm_connector.  So what you have here is a use-after-free
bug, and your change does nothing for that.

Please fix the "host" driver instead.

-- 
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 8.8Mbps down 630kbps up
According to speedtest.net: 8.21Mbps down 510kbps up

[PATCH v2] drm/arm/malidp: Ensure that the crtcs are shutdown before removing any encoder/connector

[Ayan Kumar Halder]

One needs to ensure that the crtcs are shutdown so that the
drm_crtc_state->connector_mask reflects that no connectors
are currently active. Further, it reduces the reference
count for each connector. This ensures that the connectors
and encoders can be cleanly removed either when _unbind
is called for the corresponding drivers or by
drm_mode_config_cleanup().

Signed-off-by: Ayan Kumar Halder <ayan.halder@arm.com>
---

Changes in v2:
 - Reset the connectors' mask and the reference counts in drm_device
before unbinding any of its components (ie connectors and 
encoders).

---
 drivers/gpu/drm/arm/malidp_drv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/arm/malidp_drv.c b/drivers/gpu/drm/arm/malidp_drv.c
index 8d20faa..0a788d7 100644
--- a/drivers/gpu/drm/arm/malidp_drv.c
+++ b/drivers/gpu/drm/arm/malidp_drv.c
@@ -278,7 +278,6 @@ static int malidp_init(struct drm_device *drm)
 
 static void malidp_fini(struct drm_device *drm)
 {
-	drm_atomic_helper_shutdown(drm);
 	drm_mode_config_cleanup(drm);
 }
 
@@ -646,6 +645,7 @@ static int malidp_bind(struct device *dev)
 	malidp_de_irq_fini(drm);
 	drm->irq_enabled = false;
 irq_init_fail:
+	drm_atomic_helper_shutdown(drm);
 	component_unbind_all(dev, drm);
 bind_fail:
 	of_node_put(malidp->crtc.port);
@@ -681,6 +681,7 @@ static void malidp_unbind(struct device *dev)
 	malidp_se_irq_fini(drm);
 	malidp_de_irq_fini(drm);
 	drm->irq_enabled = false;
+	drm_atomic_helper_shutdown(drm);
 	component_unbind_all(dev, drm);
 	of_node_put(malidp->crtc.port);
 	malidp->crtc.port = NULL;
-- 
2.7.4

Re: [PATCH v2] drm/arm/malidp: Ensure that the crtcs are shutdown before removing any encoder/connector

[Liviu Dudau]

On Fri, Apr 13, 2018 at 04:29:48PM +0100, Ayan Kumar Halder wrote:
> One needs to ensure that the crtcs are shutdown so that the
> drm_crtc_state->connector_mask reflects that no connectors
> are currently active. Further, it reduces the reference
> count for each connector. This ensures that the connectors
> and encoders can be cleanly removed either when _unbind
> is called for the corresponding drivers or by
> drm_mode_config_cleanup().

Describing what the code does is nice and good, however it is also
useful to have a description of what the patch fixes, or why the fix
provided by the patch is better.

In this case, we need drm_atomic_helper_shutdown() to be called before
component_unbind_all() otherwise the connectors attached to the
component device will have the wrong reference count value and will not
be cleanly cleared up.

> 
> Signed-off-by: Ayan Kumar Halder <ayan.halder@arm.com>

With the updated commit message:

Acked-by: Liviu Dudau <liviu.dudau@arm.com>

> ---
> 
> Changes in v2:
>  - Reset the connectors' mask and the reference counts in drm_device
> before unbinding any of its components (ie connectors and 
> encoders).
> 
> ---
>  drivers/gpu/drm/arm/malidp_drv.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/arm/malidp_drv.c b/drivers/gpu/drm/arm/malidp_drv.c
> index 8d20faa..0a788d7 100644
> --- a/drivers/gpu/drm/arm/malidp_drv.c
> +++ b/drivers/gpu/drm/arm/malidp_drv.c
> @@ -278,7 +278,6 @@ static int malidp_init(struct drm_device *drm)
>  
>  static void malidp_fini(struct drm_device *drm)
>  {
> -	drm_atomic_helper_shutdown(drm);
>  	drm_mode_config_cleanup(drm);
>  }
>  
> @@ -646,6 +645,7 @@ static int malidp_bind(struct device *dev)
>  	malidp_de_irq_fini(drm);
>  	drm->irq_enabled = false;
>  irq_init_fail:
> +	drm_atomic_helper_shutdown(drm);
>  	component_unbind_all(dev, drm);
>  bind_fail:
>  	of_node_put(malidp->crtc.port);
> @@ -681,6 +681,7 @@ static void malidp_unbind(struct device *dev)
>  	malidp_se_irq_fini(drm);
>  	malidp_de_irq_fini(drm);
>  	drm->irq_enabled = false;
> +	drm_atomic_helper_shutdown(drm);
>  	component_unbind_all(dev, drm);
>  	of_node_put(malidp->crtc.port);
>  	malidp->crtc.port = NULL;
> -- 
> 2.7.4
> 

-- 
====================
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯

Re: [PATCH v2] drm/arm/malidp: Ensure that the crtcs are shutdown before removing any encoder/connector

[Liviu Dudau]

On Fri, Apr 13, 2018 at 04:29:48PM +0100, Ayan Kumar Halder wrote:
> One needs to ensure that the crtcs are shutdown so that the
> drm_crtc_state->connector_mask reflects that no connectors
> are currently active. Further, it reduces the reference
> count for each connector. This ensures that the connectors
> and encoders can be cleanly removed either when _unbind
> is called for the corresponding drivers or by
> drm_mode_config_cleanup().

Describing what the code does is nice and good, however it is also
useful to have a description of what the patch fixes, or why the fix
provided by the patch is better.

In this case, we need drm_atomic_helper_shutdown() to be called before
component_unbind_all() otherwise the connectors attached to the
component device will have the wrong reference count value and will not
be cleanly cleared up.

> 
> Signed-off-by: Ayan Kumar Halder <ayan.halder@arm.com>

With the updated commit message:

Acked-by: Liviu Dudau <liviu.dudau@arm.com>

> ---
> 
> Changes in v2:
>  - Reset the connectors' mask and the reference counts in drm_device
> before unbinding any of its components (ie connectors and 
> encoders).
> 
> ---
>  drivers/gpu/drm/arm/malidp_drv.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/arm/malidp_drv.c b/drivers/gpu/drm/arm/malidp_drv.c
> index 8d20faa..0a788d7 100644
> --- a/drivers/gpu/drm/arm/malidp_drv.c
> +++ b/drivers/gpu/drm/arm/malidp_drv.c
> @@ -278,7 +278,6 @@ static int malidp_init(struct drm_device *drm)
>  
>  static void malidp_fini(struct drm_device *drm)
>  {
> -	drm_atomic_helper_shutdown(drm);
>  	drm_mode_config_cleanup(drm);
>  }
>  
> @@ -646,6 +645,7 @@ static int malidp_bind(struct device *dev)
>  	malidp_de_irq_fini(drm);
>  	drm->irq_enabled = false;
>  irq_init_fail:
> +	drm_atomic_helper_shutdown(drm);
>  	component_unbind_all(dev, drm);
>  bind_fail:
>  	of_node_put(malidp->crtc.port);
> @@ -681,6 +681,7 @@ static void malidp_unbind(struct device *dev)
>  	malidp_se_irq_fini(drm);
>  	malidp_de_irq_fini(drm);
>  	drm->irq_enabled = false;
> +	drm_atomic_helper_shutdown(drm);
>  	component_unbind_all(dev, drm);
>  	of_node_put(malidp->crtc.port);
>  	malidp->crtc.port = NULL;
> -- 
> 2.7.4
> 

-- 
====================
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel