In a situation when the reference count of the drm connector is greater than 1,
the unbind function should not invoke drm_connector_cleanup as this will lead
to an inconsistent state where the drm_crtc_state->connector_mask still has
a bitmask referring to the stale connector. Later, when drm driver invokes
drm_atomic_helper_shutdown() which invokes ---> drm_atomic_helper_disable_all()
---> drm_atomic_commit() --> drm_atomic_check_only() -->
drm_atomic_helper_check() --> drm_atomic_helper_check_modeset(). This returns
an error due to enabled/connectors mismatch.
In such a scenario, one should just return from _unbind() and let the drm driver
subsequently invoke drm_atomic_helper_shutdown. This will reset the
drm_crtc_state->connector_mask and will shutdown the crtcs. It will also decrement
the reference count of the connectors to 1. Subsequently, drm_mode_config_cleanup
will get invoked which will do the following :-
1. Decrement the reference count for each of the connectors. Thus the ref count
will reach 0 and drm_connector_funcs->destroy() gets called. Thus,
tda998x_connector_destroy() gets invoked which calls drm_connector_cleanup
2. Invokes the destroy callback for each encoder. Thus tda998x_encoder_destroy()
gets invoked.
Signed-off-by: Ayan Kumar Halder <[email protected]>
---
drivers/gpu/drm/i2c/tda998x_drv.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index 9e67a7b..8ad1cc7 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -1709,6 +1709,9 @@ static void tda998x_unbind(struct device *dev, struct device *master,
{
struct tda998x_priv *priv = dev_get_drvdata(dev);
+ if (kref_read(&priv->connector.base.refcount) > 1)
+ return;
+
drm_connector_cleanup(&priv->connector);
drm_encoder_cleanup(&priv->encoder);
tda998x_destroy(priv);
--
2.7.4
On Thu, Apr 12, 2018 at 03:42:32PM +0100, Ayan Kumar Halder wrote:
> In a situation when the reference count of the drm connector is greater than 1,
> the unbind function should not invoke drm_connector_cleanup as this will lead
> to an inconsistent state where the drm_crtc_state->connector_mask still has
> a bitmask referring to the stale connector. Later, when drm driver invokes
> drm_atomic_helper_shutdown() which invokes ---> drm_atomic_helper_disable_all()
> ---> drm_atomic_commit() --> drm_atomic_check_only() -->
> drm_atomic_helper_check() --> drm_atomic_helper_check_modeset(). This returns
> an error due to enabled/connectors mismatch.
>
> In such a scenario, one should just return from _unbind() and let the drm driver
> subsequently invoke drm_atomic_helper_shutdown. This will reset the
> drm_crtc_state->connector_mask and will shutdown the crtcs. It will also decrement
> the reference count of the connectors to 1. Subsequently, drm_mode_config_cleanup
> will get invoked which will do the following :-
If the device is still in-use after unbind() has been called, that is
_very_ bad news, and probably means that the "host" driver is not
calling component_unbind() at the right point.
Any resources claimed in the bind() callback using devm functions
will be freed, which will include (eg) the drm_encoder structure and
in fact the drm_connector. So what you have here is a use-after-free
bug, and your change does nothing for that.
Please fix the "host" driver instead.
--
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 8.8Mbps down 630kbps up
According to speedtest.net: 8.21Mbps down 510kbps up
One needs to ensure that the crtcs are shutdown so that the
drm_crtc_state->connector_mask reflects that no connectors
are currently active. Further, it reduces the reference
count for each connector. This ensures that the connectors
and encoders can be cleanly removed either when _unbind
is called for the corresponding drivers or by
drm_mode_config_cleanup().
Signed-off-by: Ayan Kumar Halder <[email protected]>
---
Changes in v2:
- Reset the connectors' mask and the reference counts in drm_device
before unbinding any of its components (ie connectors and
encoders).
---
drivers/gpu/drm/arm/malidp_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/arm/malidp_drv.c b/drivers/gpu/drm/arm/malidp_drv.c
index 8d20faa..0a788d7 100644
--- a/drivers/gpu/drm/arm/malidp_drv.c
+++ b/drivers/gpu/drm/arm/malidp_drv.c
@@ -278,7 +278,6 @@ static int malidp_init(struct drm_device *drm)
static void malidp_fini(struct drm_device *drm)
{
- drm_atomic_helper_shutdown(drm);
drm_mode_config_cleanup(drm);
}
@@ -646,6 +645,7 @@ static int malidp_bind(struct device *dev)
malidp_de_irq_fini(drm);
drm->irq_enabled = false;
irq_init_fail:
+ drm_atomic_helper_shutdown(drm);
component_unbind_all(dev, drm);
bind_fail:
of_node_put(malidp->crtc.port);
@@ -681,6 +681,7 @@ static void malidp_unbind(struct device *dev)
malidp_se_irq_fini(drm);
malidp_de_irq_fini(drm);
drm->irq_enabled = false;
+ drm_atomic_helper_shutdown(drm);
component_unbind_all(dev, drm);
of_node_put(malidp->crtc.port);
malidp->crtc.port = NULL;
--
2.7.4
On Fri, Apr 13, 2018 at 04:29:48PM +0100, Ayan Kumar Halder wrote:
> One needs to ensure that the crtcs are shutdown so that the
> drm_crtc_state->connector_mask reflects that no connectors
> are currently active. Further, it reduces the reference
> count for each connector. This ensures that the connectors
> and encoders can be cleanly removed either when _unbind
> is called for the corresponding drivers or by
> drm_mode_config_cleanup().
Describing what the code does is nice and good, however it is also
useful to have a description of what the patch fixes, or why the fix
provided by the patch is better.
In this case, we need drm_atomic_helper_shutdown() to be called before
component_unbind_all() otherwise the connectors attached to the
component device will have the wrong reference count value and will not
be cleanly cleared up.
>
> Signed-off-by: Ayan Kumar Halder <[email protected]>
With the updated commit message:
Acked-by: Liviu Dudau <[email protected]>
> ---
>
> Changes in v2:
> - Reset the connectors' mask and the reference counts in drm_device
> before unbinding any of its components (ie connectors and
> encoders).
>
> ---
> drivers/gpu/drm/arm/malidp_drv.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/arm/malidp_drv.c b/drivers/gpu/drm/arm/malidp_drv.c
> index 8d20faa..0a788d7 100644
> --- a/drivers/gpu/drm/arm/malidp_drv.c
> +++ b/drivers/gpu/drm/arm/malidp_drv.c
> @@ -278,7 +278,6 @@ static int malidp_init(struct drm_device *drm)
>
> static void malidp_fini(struct drm_device *drm)
> {
> - drm_atomic_helper_shutdown(drm);
> drm_mode_config_cleanup(drm);
> }
>
> @@ -646,6 +645,7 @@ static int malidp_bind(struct device *dev)
> malidp_de_irq_fini(drm);
> drm->irq_enabled = false;
> irq_init_fail:
> + drm_atomic_helper_shutdown(drm);
> component_unbind_all(dev, drm);
> bind_fail:
> of_node_put(malidp->crtc.port);
> @@ -681,6 +681,7 @@ static void malidp_unbind(struct device *dev)
> malidp_se_irq_fini(drm);
> malidp_de_irq_fini(drm);
> drm->irq_enabled = false;
> + drm_atomic_helper_shutdown(drm);
> component_unbind_all(dev, drm);
> of_node_put(malidp->crtc.port);
> malidp->crtc.port = NULL;
> --
> 2.7.4
>
--
====================
| I would like to |
| fix the world, |
| but they're not |
| giving me the |
\ source code! /
---------------
¯\_(ツ)_/¯