On 8/4/26 01:56, Danilo Krummrich wrote:
On Thu Jul 30, 2026 at 7:05 PM CEST, Alvin Sun wrote:Hold a device reference (via drm_dev_get/put) across the lifetime of open debugfs files. Prevents use-after-free when a device is unregistered while a debugfs file remains open. Both drm_debugfs_open (legacy info_list) and drm_debugfs_entry_open (drm_debugfs_add_file) paths are covered. Fixes: 1c9cacbea8805 ("drm/debugfs: create device-centered debugfs functions") Fixes: 28a62277e06f9 ("drm: Convert proc files to seq_file and introduce debugfs") Signed-off-by: Alvin Sun <[email protected]> --- drivers/gpu/drm/drm_debugfs.c | 42 ++++++++++++++++++++++++++++++++++++++---- 1 file changed, 38 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c index 38cf6ce387cc8..5262a708f1602 100644 --- a/drivers/gpu/drm/drm_debugfs.c +++ b/drivers/gpu/drm/drm_debugfs.c @@ -159,11 +159,28 @@ static const struct drm_debugfs_info drm_debugfs_list[] = { static int drm_debugfs_open(struct inode *inode, struct file *file) { struct drm_info_node *node = inode->i_private; + struct drm_device *dev = node->minor->dev; + int ret;if (!device_is_registered(node->minor->kdev))return -ENODEV;- return single_open(file, node->info_ent->show, node);+ drm_dev_get(dev); + + ret = single_open(file, node->info_ent->show, node); + if (ret) + drm_dev_put(dev); + + return ret; +} + +static int drm_debugfs_release(struct inode *inode, struct file *file) +{ + struct drm_info_node *node = + ((struct seq_file *)file->private_data)->private; + + drm_dev_put(node->minor->dev); + return single_release(inode, file); }This isn't needed; in drm_dev_unregister() we call debugfs_remove_recursive(), which already waits for all in-flight file operations. The DRM device itself is guaranteed to be valid as long as it is registered.
Thanks for the review. Sorry for the delay — I was on vacation the last few days.
v3 is ready, incorporating the feedback, and I'll send it out shortly. Best regards, Alvin
