[PATCH] drm: rcar-du: add missing put_device() call in rcar_du_vsp_init()

[PATCH] drm: rcar-du: add missing put_device() call in rcar_du_vsp_init()

[Yu Kuai]

if of_find_device_by_node() succeed, rcar_du_vsp_init() doesn't have
a corresponding put_device(). Thus add a jump target to fix the exception
handling for this function implementation.

Fixes: 6d62ef3ac30b ("drm: rcar-du: Expose the VSP1 compositor through KMS planes")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
---
 drivers/gpu/drm/rcar-du/rcar_du_vsp.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
index f1a81c9b184d..172ee3f3b21c 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
@@ -352,14 +352,16 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
 
 	/* Find the VSP device and initialize it. */
 	pdev = of_find_device_by_node(np);
-	if (!pdev)
-		return -ENXIO;
+	if (!pdev) {
+		ret = -ENXIO;
+		goto put_device;
+	}
 
 	vsp->vsp = &pdev->dev;
 
 	ret = vsp1_du_init(vsp->vsp);
 	if (ret < 0)
-		return ret;
+		goto put_device;
 
 	 /*
 	  * The VSP2D (Gen3) has 5 RPFs, but the VSP1D (Gen2) is limited to
@@ -369,8 +371,10 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
 
 	vsp->planes = devm_kcalloc(rcdu->dev, vsp->num_planes,
 				   sizeof(*vsp->planes), GFP_KERNEL);
-	if (!vsp->planes)
-		return -ENOMEM;
+	if (!vsp->planes) {
+		ret = -ENOMEM;
+		goto put_device;
+	}
 
 	for (i = 0; i < vsp->num_planes; ++i) {
 		enum drm_plane_type type = i < num_crtcs
@@ -387,7 +391,7 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
 					       ARRAY_SIZE(rcar_du_vsp_formats),
 					       NULL, type, NULL);
 		if (ret < 0)
-			return ret;
+			goto put_device;
 
 		drm_plane_helper_add(&plane->plane,
 				     &rcar_du_vsp_plane_helper_funcs);
@@ -403,4 +407,7 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
 	}
 
 	return 0;
+put_device:
+	put_device(&pdev->dev);
+	return ret;
 }
-- 
2.25.4

Re: [PATCH] drm: rcar-du: add missing put_device() call in rcar_du_vsp_init()

[Laurent Pinchart]

Hi Yu,

Thank you for the patch.

On Thu, Sep 10, 2020 at 09:23:54PM +0800, Yu Kuai wrote:
> if of_find_device_by_node() succeed, rcar_du_vsp_init() doesn't have
> a corresponding put_device(). Thus add a jump target to fix the exception
> handling for this function implementation.
> 
> Fixes: 6d62ef3ac30b ("drm: rcar-du: Expose the VSP1 compositor through KMS planes")
> Signed-off-by: Yu Kuai <yukuai3@huawei.com>
> ---
>  drivers/gpu/drm/rcar-du/rcar_du_vsp.c | 19 +++++++++++++------
>  1 file changed, 13 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
> index f1a81c9b184d..172ee3f3b21c 100644
> --- a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
> +++ b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
> @@ -352,14 +352,16 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
>  
>  	/* Find the VSP device and initialize it. */
>  	pdev = of_find_device_by_node(np);
> -	if (!pdev)
> -		return -ENXIO;
> +	if (!pdev) {
> +		ret = -ENXIO;
> +		goto put_device;
> +	}

This change isn't needed, and will actually cause a crash, as pdev is
NULL.

>  
>  	vsp->vsp = &pdev->dev;
>  
>  	ret = vsp1_du_init(vsp->vsp);
>  	if (ret < 0)
> -		return ret;
> +		goto put_device;
>  
>  	 /*
>  	  * The VSP2D (Gen3) has 5 RPFs, but the VSP1D (Gen2) is limited to
> @@ -369,8 +371,10 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
>  
>  	vsp->planes = devm_kcalloc(rcdu->dev, vsp->num_planes,
>  				   sizeof(*vsp->planes), GFP_KERNEL);
> -	if (!vsp->planes)
> -		return -ENOMEM;
> +	if (!vsp->planes) {
> +		ret = -ENOMEM;
> +		goto put_device;
> +	}
>  
>  	for (i = 0; i < vsp->num_planes; ++i) {
>  		enum drm_plane_type type = i < num_crtcs
> @@ -387,7 +391,7 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
>  					       ARRAY_SIZE(rcar_du_vsp_formats),
>  					       NULL, type, NULL);
>  		if (ret < 0)
> -			return ret;
> +			goto put_device;
>  
>  		drm_plane_helper_add(&plane->plane,
>  				     &rcar_du_vsp_plane_helper_funcs);
> @@ -403,4 +407,7 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
>  	}
>  
>  	return 0;

I would add a blank line here.

> +put_device:

And maybe name the label "error" ?

> +	put_device(&pdev->dev);
> +	return ret;
>  }

We need more than this, we also need to call put_device() when the
driver is unloaded. The way to handle cleanup in DRM is through
drmm_add_action() nowadays, and I think we could thus simply replace the
change above with a cleanup action that is run both in the error path
and at driver remove.

I'll post a proposal in a reply to this e-mail.

-- 
Regards,

Laurent Pinchart

[PATCH] drm: rcar-du: Put reference to VSP device

[Laurent Pinchart]

The reference to the VSP device acquired with of_find_device_by_node()
in rcar_du_vsp_init() is never released. Fix it with a drmm action,
which gets run both in the probe error path and in the remove path.

Fixes: 6d62ef3ac30b ("drm: rcar-du: Expose the VSP1 compositor through KMS planes")
Reported-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
---
 drivers/gpu/drm/rcar-du/rcar_du_vsp.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
index f1a81c9b184d..fa09b3ae8b9d 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
@@ -13,6 +13,7 @@
 #include <drm/drm_fourcc.h>
 #include <drm/drm_gem_cma_helper.h>
 #include <drm/drm_gem_framebuffer_helper.h>
+#include <drm/drm_managed.h>
 #include <drm/drm_plane_helper.h>
 #include <drm/drm_vblank.h>
 
@@ -341,6 +342,13 @@ static const struct drm_plane_funcs rcar_du_vsp_plane_funcs = {
 	.atomic_destroy_state = rcar_du_vsp_plane_atomic_destroy_state,
 };
 
+static void rcar_du_vsp_cleanup(struct drm_device *dev, void *res)
+{
+	struct rcar_du_vsp *vsp = res;
+
+	put_device(vsp->vsp);
+}
+
 int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
 		     unsigned int crtcs)
 {
@@ -357,6 +365,10 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
 
 	vsp->vsp = &pdev->dev;
 
+	ret = drmm_add_action(rcdu->ddev, rcar_du_vsp_cleanup, vsp);
+	if (ret < 0)
+		return ret;
+
 	ret = vsp1_du_init(vsp->vsp);
 	if (ret < 0)
 		return ret;
-- 
Regards,

Laurent Pinchart

Re: [PATCH] drm: rcar-du: Put reference to VSP device

[Kieran Bingham]

Hi Laurent,

On 16/09/2020 00:38, Laurent Pinchart wrote:
> The reference to the VSP device acquired with of_find_device_by_node()
> in rcar_du_vsp_init() is never released. Fix it with a drmm action,
> which gets run both in the probe error path and in the remove path.
> 
> Fixes: 6d62ef3ac30b ("drm: rcar-du: Expose the VSP1 compositor through KMS planes")
> Reported-by: Yu Kuai <yukuai3@huawei.com>
> Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>

Looks nice and clean!

Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>

> ---
>  drivers/gpu/drm/rcar-du/rcar_du_vsp.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
> index f1a81c9b184d..fa09b3ae8b9d 100644
> --- a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
> +++ b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
> @@ -13,6 +13,7 @@
>  #include <drm/drm_fourcc.h>
>  #include <drm/drm_gem_cma_helper.h>
>  #include <drm/drm_gem_framebuffer_helper.h>
> +#include <drm/drm_managed.h>
>  #include <drm/drm_plane_helper.h>
>  #include <drm/drm_vblank.h>
>  
> @@ -341,6 +342,13 @@ static const struct drm_plane_funcs rcar_du_vsp_plane_funcs = {
>  	.atomic_destroy_state = rcar_du_vsp_plane_atomic_destroy_state,
>  };
>  
> +static void rcar_du_vsp_cleanup(struct drm_device *dev, void *res)
> +{
> +	struct rcar_du_vsp *vsp = res;
> +
> +	put_device(vsp->vsp);

Ugh the asymmetry of the put_device is a bit annoying, because it's not
initially clear that the of_find_device_by_node() call 'gets' a reference.

(Or at least not until you find:
  https://lore.kernel.org/patchwork/patch/731284/)

It is stated in the commit message though so that's fine, and although I
thought perhaps a comment here might be useful to declare that it
releases the reference taken by of_find_device_by_node(), I'm not sure
it even adds that much value ... so either way.


> +}
> +
>  int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
>  		     unsigned int crtcs)
>  {
> @@ -357,6 +365,10 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
>  
>  	vsp->vsp = &pdev->dev;
>  
> +	ret = drmm_add_action(rcdu->ddev, rcar_du_vsp_cleanup, vsp);
> +	if (ret < 0)
> +		return ret;
> +
>  	ret = vsp1_du_init(vsp->vsp);
>  	if (ret < 0)
>  		return ret;
> 

Re: [PATCH] drm: rcar-du: Put reference to VSP device

[Laurent Pinchart]

Hi Kieran,

On Wed, Sep 16, 2020 at 11:26:36AM +0100, Kieran Bingham wrote:
> On 16/09/2020 00:38, Laurent Pinchart wrote:
> > The reference to the VSP device acquired with of_find_device_by_node()
> > in rcar_du_vsp_init() is never released. Fix it with a drmm action,
> > which gets run both in the probe error path and in the remove path.
> > 
> > Fixes: 6d62ef3ac30b ("drm: rcar-du: Expose the VSP1 compositor through KMS planes")
> > Reported-by: Yu Kuai <yukuai3@huawei.com>
> > Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
> 
> Looks nice and clean!
> 
> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
> 
> > ---
> >  drivers/gpu/drm/rcar-du/rcar_du_vsp.c | 12 ++++++++++++
> >  1 file changed, 12 insertions(+)
> > 
> > diff --git a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
> > index f1a81c9b184d..fa09b3ae8b9d 100644
> > --- a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
> > +++ b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
> > @@ -13,6 +13,7 @@
> >  #include <drm/drm_fourcc.h>
> >  #include <drm/drm_gem_cma_helper.h>
> >  #include <drm/drm_gem_framebuffer_helper.h>
> > +#include <drm/drm_managed.h>
> >  #include <drm/drm_plane_helper.h>
> >  #include <drm/drm_vblank.h>
> >  
> > @@ -341,6 +342,13 @@ static const struct drm_plane_funcs rcar_du_vsp_plane_funcs = {
> >  	.atomic_destroy_state = rcar_du_vsp_plane_atomic_destroy_state,
> >  };
> >  
> > +static void rcar_du_vsp_cleanup(struct drm_device *dev, void *res)
> > +{
> > +	struct rcar_du_vsp *vsp = res;
> > +
> > +	put_device(vsp->vsp);
> 
> Ugh the asymmetry of the put_device is a bit annoying, because it's not
> initially clear that the of_find_device_by_node() call 'gets' a reference.
> 
> (Or at least not until you find:
>   https://lore.kernel.org/patchwork/patch/731284/)
> 
> It is stated in the commit message though so that's fine, and although I
> thought perhaps a comment here might be useful to declare that it
> releases the reference taken by of_find_device_by_node(), I'm not sure
> it even adds that much value ... so either way.

I think that the fact that drmm_add_action() is called right after
of_find_device_by_node() makes this explicit enough.

> > +}
> > +
> >  int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
> >  		     unsigned int crtcs)
> >  {
> > @@ -357,6 +365,10 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np,
> >  
> >  	vsp->vsp = &pdev->dev;
> >  
> > +	ret = drmm_add_action(rcdu->ddev, rcar_du_vsp_cleanup, vsp);
> > +	if (ret < 0)
> > +		return ret;
> > +
> >  	ret = vsp1_du_init(vsp->vsp);
> >  	if (ret < 0)
> >  		return ret;
> > 
> 

-- 
Regards,

Laurent Pinchart