The drm_panel subsystem provides kref-based reference counting [1] (drm_panel_get/put) but almost nothing in the tree actually uses it. This results in a systemic use-after-free pattern throughout the codebase.
This series aims to close all those issues. Patches 1-2: fix the infrastructure. drm_panel_add/remove now keep a counted reference for the list entry. drm_panel_bridge_add_typed() now holds a counted reference for the lifetime of the panel_bridge. Patch 3: change the semantics of of_drm_find_panel() and find_panel_by_fwnode(). They now acquire a reference before returning, under panel_lock. Callers are responsible for calling drm_panel_put() when they no longer need the pointer. Patches 4-5: update all in-tree callers of of_drm_find_panel() and drm_of_find_panel_or_bridge() to release the reference at the appropriate point. Two patterns are repeated in these fixes: - Bridge-wrapping: the panel is passed to devm_drm_panel_bridge_add() or equivalent, which acquires its own reference. The caller (including devm_drm_of_get_bridge() and drmm_of_get_bridge()) releases its lookup reference immediately after. - Store-and-use: the panel pointer is kept in a driver struct and used directly for the device lifetime. The reference is released in the remove/unbind path, or via devm_add_action_or_reset() where no explicit teardown function exists. In order to catch all places in the tree that required releasing the reference, the search was assisted by an AI model. Specifically, a Coccinelle script was designed to address the trivial changes (not included in the series). Although a few required manual fixes, with goto labels or bracket additions. Additionally, the model helped to discern implicit teardown paths that were addressed with devm_add_action_or_reset() calls. Thus, these commits have the Assisted-by label following the project guidelines. No functional change is intended for any driver. The reference counting only affects object lifetime; panel operations are unaffected. [1] https://lore.kernel.org/all/[email protected]/ Signed-off-by: Albert Esteve <[email protected]> --- Albert Esteve (5): drm/panel: have drm_panel_add/remove manage a list reference drm/bridge/panel: hold a reference to the wrapped panel drm/panel: make *find_panel*() return a counted reference drm/bridge: release panel reference on all lookup exit paths drm: release panel reference after panel bridge creation drivers/gpu/drm/bridge/analogix/analogix-anx6345.c | 3 +++ drivers/gpu/drm/bridge/panel.c | 18 ++++++++++++---- drivers/gpu/drm/drm_panel.c | 24 +++++++++++++++++----- drivers/gpu/drm/exynos/exynos_dp.c | 10 +++++++++ drivers/gpu/drm/exynos/exynos_drm_dpi.c | 3 +++ drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c | 18 ++++++++++++++++ drivers/gpu/drm/imx/dcss/dcss-kms.c | 3 +++ drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 4 +++- drivers/gpu/drm/logicvc/logicvc_interface.c | 12 +++++++++++ drivers/gpu/drm/mcde/mcde_drv.c | 1 + drivers/gpu/drm/mcde/mcde_dsi.c | 1 + drivers/gpu/drm/mxsfb/mxsfb_drv.c | 1 + drivers/gpu/drm/omapdrm/dss/output.c | 1 + drivers/gpu/drm/pl111/pl111_drv.c | 1 + drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.c | 1 + drivers/gpu/drm/renesas/rcar-du/rcar_lvds.c | 1 + drivers/gpu/drm/renesas/rz-du/rzg2l_du_encoder.c | 1 + drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 11 ++++++++++ drivers/gpu/drm/rockchip/rockchip_lvds.c | 1 + drivers/gpu/drm/rockchip/rockchip_rgb.c | 1 + drivers/gpu/drm/sti/sti_dvo.c | 3 +++ drivers/gpu/drm/stm/ltdc.c | 1 + drivers/gpu/drm/stm/lvds.c | 3 +++ drivers/gpu/drm/sun4i/sun4i_lvds.c | 13 ++++++++++++ drivers/gpu/drm/sun4i/sun4i_rgb.c | 13 ++++++++++++ drivers/gpu/drm/sun4i/sun4i_tcon.c | 2 ++ drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 2 ++ drivers/gpu/drm/tegra/dsi.c | 1 + drivers/gpu/drm/tegra/output.c | 3 +++ drivers/gpu/drm/tidss/tidss_kms.c | 16 ++++++++++----- drivers/gpu/drm/tve200/tve200_drv.c | 1 + 31 files changed, 159 insertions(+), 15 deletions(-) --- base-commit: 502d801f0ab03e4f32f9a33d203154ce84887921 change-id: 20260513-drm_refcount_wiring-4e5e757e9047 Best regards, -- Albert Esteve <[email protected]>
