The global panel_list holds raw pointers to drm_panel objects. Nothing prevents a panel from being freed while it is still linked in the list: if a driver's probe calls drm_panel_add() and then fails at a later step, panel->list remains in panel_list. Any subsequent call to of_drm_find_panel() that iterates the list will dereference freed memory.
Have drm_panel_add() acquire a reference via drm_panel_get() before inserting the panel into the list, and have drm_panel_remove() drop it via drm_panel_put() after removing the panel from the list. The global registry now holds a counted reference for as long as the panel is listed, ensuring the object outlives any concurrent lookup. Signed-off-by: Albert Esteve <[email protected]> --- drivers/gpu/drm/drm_panel.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c index 2c5649e433dfb..545fe93dc28fe 100644 --- a/drivers/gpu/drm/drm_panel.c +++ b/drivers/gpu/drm/drm_panel.c @@ -81,6 +81,7 @@ static void drm_panel_init(struct drm_panel *panel, struct device *dev, */ void drm_panel_add(struct drm_panel *panel) { + drm_panel_get(panel); mutex_lock(&panel_lock); list_add_tail(&panel->list, &panel_list); mutex_unlock(&panel_lock); @@ -98,6 +99,7 @@ void drm_panel_remove(struct drm_panel *panel) mutex_lock(&panel_lock); list_del_init(&panel->list); mutex_unlock(&panel_lock); + drm_panel_put(panel); } EXPORT_SYMBOL(drm_panel_remove); -- 2.54.0
