Re: [PATCH v5 16/19] drm: fix race between partial drm_dev_register() failure and ioctl

[Alexandre Courbot]

On Sun Jun 28, 2026 at 11:53 PM JST, Danilo Krummrich wrote:
> If drm_dev_register() fails after registering a minor (e.g. render minor
> registered, primary minor fails), userspace could have opened the first
> minor and entered a drm_dev_enter() critical section. Since the
> unplugged flag was never set, the ioctl proceeds while the error path
> tears down device resources.
>
> Fix this by introducing drm_dev_synchronize_unplug(), which sets the
> unplugged flag and waits for the SRCU barrier, ensuring all in-flight
> drm_dev_enter() critical sections complete before cleanup proceeds; call
> it on the error path of drm_dev_register().
>
> Fixes: bee330f3d672 ("drm: Use srcu to protect drm_device.unplugged")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: sashiko-bot@xxxxxxxxxx
> Closes: https://lore.kernel.org/all/20260620190648.2E9F61F000E9@xxxxxxxxxxxxxxx/
> Signed-off-by: Danilo Krummrich <dakr@xxxxxxxxxx>

Reviewed-by: Alexandre Courbot <acourbot@xxxxxxxxxx>