From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B36732DECC2 for ; Fri, 23 Jan 2026 16:07:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.84.56 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769184423; cv=none; b=XD8vNIs/zRe+/Cegjxilxb9y8Q9OjrrvNvGD9AH867FeL4JJ6x+Lvhq92W4iQ/vPuzW8LugaDUAtYd4PJ1a4l6KRA4ux5den6El/eb8LDjpd6WCDskyKOaDp9d5xsyVI/IYqjP9GaenEO8mivq0eu6pg7PQPw7f4O/2S/scKdkQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769184423; c=relaxed/simple; bh=6YoCn7zSx60Z9ouH5G1Cgbqc9Q70APZisYU7CQSyeHo=; h=Mime-Version:Content-Type:Date:Message-Id:Subject:Cc:To:From: References:In-Reply-To; b=M3NQbfvTT2WqNlZnlf3iAg5HOQFN+grIeMGyT/etZSwEJ251K/cLxPaR51aAsu7Vx60QxkGQWeoJslZpWW5OAisTj81I8l/jQDPuIddUFcF88CaVUL1kpJ+ZNABUmTSVMyg5B+H8RvxNE+2nRVvKTquLHNXYYwYuusxk61lqZqo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=V31Kh61S; arc=none smtp.client-ip=185.246.84.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="V31Kh61S" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 2DF7C1A2A43; Fri, 23 Jan 2026 16:06:54 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id EF04B6070A; Fri, 23 Jan 2026 16:06:53 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id E8585119A87D8; Fri, 23 Jan 2026 17:06:42 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1769184412; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=vI3kzpZHjcjHFtL3p8Qx+S2TsVWIlODIqyNcUXdrzhU=; b=V31Kh61SiJ4UoGViGvd1QA6OuNo9J5Xldz9y000yE1WlWlYr3MvhI6MMiynQPIvr3K8uCo zFWne7arjeQjfTIwX7nzcL/m3a0te273RWNXGh4HGND5PgTCtX3XXzPx4vctvkt0elUwxG qID7HpSkALXkMmH8PZX6hU5OHSsmlsAdoIxKnUtFkxVEnW9JVjSk7VYNbgzbHU5Jy8XkSy txpjBNoDiZ0A2YHfd2PvqOpbf4m9kGiUPApCKhjHuBmCiIscq94G9mPT0ko2QIGX9RqJAb djDT///e9tFXC6373e6T9i+Qt+ViNTC/9qTFLOo3MCW23wHjDfI4IXPhHS3f6g== Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Fri, 23 Jan 2026 17:06:41 +0100 Message-Id: Subject: Re: [PATCH v4 18/25] drm/tilcdc: Convert to DRM managed resources Cc: "Jyri Sarha" , "Tomi Valkeinen" , "Maarten Lankhorst" , "Maxime Ripard" , "Thomas Zimmermann" , "David Airlie" , "Simona Vetter" , "Rob Herring" , "Krzysztof Kozlowski" , "Conor Dooley" , "Russell King" , "Bartosz Golaszewski" , "Tony Lindgren" , "Andrzej Hajda" , "Neil Armstrong" , "Robert Foss" , "Laurent Pinchart" , "Jonas Karlman" , "Jernej Skrabec" , "Markus Schneider-Pargmann" , "Bajjuri Praneeth" , "Louis Chauvet" , "Thomas Petazzoni" , "Miguel Gazquez" , "Herve Codina" , , , , , To: "Kory Maincent" From: "Luca Ceresoli" X-Mailer: aerc 0.20.1 References: <20260116-feature_tilcdc-v4-0-2c1c22143087@bootlin.com> <20260116-feature_tilcdc-v4-18-2c1c22143087@bootlin.com> <20260122154840.5185671a@kmaincent-XPS-13-7390> In-Reply-To: <20260122154840.5185671a@kmaincent-XPS-13-7390> X-Last-TLS-Session-Version: TLSv1.3 On Thu Jan 22, 2026 at 3:48 PM CET, Kory Maincent wrote: > On Mon, 19 Jan 2026 22:19:26 +0100 > "Luca Ceresoli" wrote: > >> On Fri Jan 16, 2026 at 6:02 PM CET, Kory Maincent (TI.com) wrote: >> > Convert the tilcdc driver to use DRM managed resources (drmm_* APIs) >> > to eliminate resource lifetime issues, particularly in probe deferral >> > scenarios. >> > >> > This conversion addresses potential use-after-free bugs by ensuring >> > proper cleanup ordering through the DRM managed resource framework. >> > The changes include: >> > - Replace drm_crtc_init_with_planes() with drmm_crtc_alloc_with_planes= () >> > - Replace drm_universal_plane_init() with drmm_universal_plane_alloc() >> > - Replace drm_simple_encoder_init() with drmm_simple_encoder_alloc() >> > - Remove manual cleanup in tilcdc_crtc_destroy() and error paths >> > - Remove drm_encoder_cleanup() from encoder error handling paths >> > - Use drmm_add_action_or_reset() for remaining cleanup operations >> > >> > This approach is recommended by the DRM subsystem for improved resourc= e >> > lifetime management and is particularly important for drivers that may >> > experience probe deferral. >> > >> > Signed-off-by: Kory Maincent (TI.com) >> > --- >> > >> > Change in v4: >> > - Newt patch. >> >> Why? Adding patches along the way does not help getting your series merg= ed >> timely. If there's a good reason for adding a new patch, please mention = it >> here. > > Thanks for your review. > > Sorry for that. The reason is that I faced a null pointer dereference koo= ps if > for example the panel module is not installed. Then the > drm_of_find_panel_or_bridge() function return eprobe defer and something = goes > wrong with the DRM resources. Using DRM managed resources solves it. > I will mention it for the v5. > >> > + tilcdc_crtc =3D drmm_crtc_alloc_with_planes(dev, struct tilcdc_crtc, >> > base, >> > + &primary->base, >> > + NULL, >> > + &tilcdc_crtc_funcs, >> > + "tilcdc crtc"); >> > + if (IS_ERR(tilcdc_crtc)) { >> > + dev_err(dev->dev, "Failed to init CRTC: %pe\n", >> > tilcdc_crtc); >> > + return PTR_ERR(tilcdc_crtc); >> > + } >> > + >> > + tilcdc_crtc->primary =3D primary; >> >> (*) see below >> >> > >> > init_completion(&tilcdc_crtc->palette_loaded); >> > tilcdc_crtc->palette_base =3D dmam_alloc_coherent(dev->dev, >> > @@ -978,10 +992,6 @@ int tilcdc_crtc_create(struct drm_device *dev) >> > >> > crtc =3D &tilcdc_crtc->base; >> > >> > - ret =3D tilcdc_plane_init(dev, &tilcdc_crtc->primary); >> > - if (ret < 0) >> > - goto fail; >> > - >> > mutex_init(&tilcdc_crtc->enable_lock); >> > >> > init_waitqueue_head(&tilcdc_crtc->frame_done_wq); >> > @@ -989,20 +999,12 @@ int tilcdc_crtc_create(struct drm_device *dev) >> > spin_lock_init(&tilcdc_crtc->irq_lock); >> > INIT_WORK(&tilcdc_crtc->recover_work, tilcdc_crtc_recover_work); >> > >> > - ret =3D drm_crtc_init_with_planes(dev, crtc, >> > - &tilcdc_crtc->primary, >> > - NULL, >> > - &tilcdc_crtc_funcs, >> > - "tilcdc crtc"); >> > - if (ret < 0) >> > - goto fail; >> > - >> > drm_crtc_helper_add(crtc, &tilcdc_crtc_helper_funcs); >> > >> > + ret =3D drmm_add_action_or_reset(dev, tilcdc_crtc_destroy, priv); >> > + if (ret) >> > + return ret; >> >> Not related to your patch, but if the dmam_alloc_coherent() (not visible= in >> the diff) fails, tilcdc_crtc_destroy() won't be called. Is this intended= ? >> At first sight this drmm_add_action_or_reset() should be moved at (*), j= ust >> after the allocation. > > You are totally right. > >> However being not related to your patch I'd leave this for another serie= s >> anyway, to avoid making this series a moving target. > > I think it is related to this patch. > Before this patch there was no need for cleanup as the only action before= the > dmam_alloc_coherent() was a devm_kzalloc(). > Now the plane and the crtc are initialize before the dmam_alloc_coherent(= ) so > the cleanup need to happen if it fails an error. > >> I find this patch hard to read and I think because it is converting >> multiple things at once. Splitting it in small steps would have been nic= e, >> even thought I'm not 100% sure it would have been doable. > > Yes, it brought more error when not converting the whole to DRM Managed > resources in one go. > >> >> Nevertheless it looks correct, so: >> >> Reviewed-by: Luca Ceresoli > > Thanks, but I will remove it due to the small change. > Or maybe it is ok for you if I keep it with only the move of > drmm_add_action_or_reset(). If you only move the drmm_add_action_or_reset() where I suggested you can keep it. Luca -- Luca Ceresoli, Bootlin Embedded Linux and Kernel engineering https://bootlin.com