On Thu Jul 30, 2026 at 7:05 PM CEST, Alvin Sun wrote:
> Hold a device reference (via drm_dev_get/put) across the lifetime of open
> debugfs files. Prevents use-after-free when a device is unregistered while
> a debugfs file remains open. Both drm_debugfs_open (legacy info_list)
> and drm_debugfs_entry_open (drm_debugfs_add_file) paths are covered.
>
> Fixes: 1c9cacbea8805 ("drm/debugfs: create device-centered debugfs functions")
> Fixes: 28a62277e06f9 ("drm: Convert proc files to seq_file and introduce
> debugfs")
>
> Signed-off-by: Alvin Sun <[email protected]>
> ---
> drivers/gpu/drm/drm_debugfs.c | 42 ++++++++++++++++++++++++++++++++++++++----
> 1 file changed, 38 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
> index 38cf6ce387cc8..5262a708f1602 100644
> --- a/drivers/gpu/drm/drm_debugfs.c
> +++ b/drivers/gpu/drm/drm_debugfs.c
> @@ -159,11 +159,28 @@ static const struct drm_debugfs_info drm_debugfs_list[]
> = {
> static int drm_debugfs_open(struct inode *inode, struct file *file)
> {
> struct drm_info_node *node = inode->i_private;
> + struct drm_device *dev = node->minor->dev;
> + int ret;
>
> if (!device_is_registered(node->minor->kdev))
> return -ENODEV;
>
> - return single_open(file, node->info_ent->show, node);
> + drm_dev_get(dev);
> +
> + ret = single_open(file, node->info_ent->show, node);
> + if (ret)
> + drm_dev_put(dev);
> +
> + return ret;
> +}
> +
> +static int drm_debugfs_release(struct inode *inode, struct file *file)
> +{
> + struct drm_info_node *node =
> + ((struct seq_file *)file->private_data)->private;
> +
> + drm_dev_put(node->minor->dev);
> + return single_release(inode, file);
> }
This isn't needed; in drm_dev_unregister() we call debugfs_remove_recursive(),
which already waits for all in-flight file operations. The DRM device itself is
guaranteed to be valid as long as it is registered.
