Re: [PATCH v2 3/5] drm/panel: of_drm_find_panel() return a counted reference

[Mikko Perttunen]

On Monday, July 13, 2026 8:53 PM Albert Esteve wrote:
> Callers of of_drm_find_panel() receive a pointer with no reference
> held, creating a window where the panel device can be unregistered
> and freed between the lookup and first use (e.g., drm_panel_prepare()).
> 
> Fix the lookup function by acquiring a reference with drm_panel_get()
> before returning, under panel_lock. Callers are now responsible for
> calling drm_panel_put() when they no longer need the pointer.
> 
> For bridge drivers that immediately wrap the panel in a panel_bridge
> (which acquires its own reference), release the lookup reference right
> after the bridge creation call.
> 
> For analogix-anx6345, which stores the panel for direct use, release
> the reference in the i2c remove path.
> 
> For platform drivers using analogix_dp_core with a component lifecycle
> (exynos_dp, rockchip analogix_dp), release the lookup reference in the
> platform remove() function. The panel_bridge created during bind() holds
> a separate reference that devm cleanup releases after remove() returns.
> 
> Also fix devm_drm_of_get_bridge() and drmm_of_get_bridge() in
> bridge/panel.c itself: both call drm_of_find_panel_or_bridge() and
> then pass the panel to devm/drmm_panel_bridge_add(), which acquires
> its own reference via drm_panel_bridge_add_typed(). The lookup
> reference was never released; add drm_panel_put() after each bridge
> creation call.
> 
> Assisted-by: Claude:claude-opus-4-6
> Signed-off-by: Albert Esteve <aesteve@xxxxxxxxxx>
> ---
>  drivers/gpu/drm/bridge/analogix/analogix-anx6345.c |  3 +++
>  drivers/gpu/drm/bridge/panel.c                     |  8 ++++++--
>  drivers/gpu/drm/drm_of.c                           |  3 ++-
>  drivers/gpu/drm/drm_panel.c                        | 12 ++++++++----
>  drivers/gpu/drm/exynos/exynos_dp.c                 | 10 ++++++++++
>  drivers/gpu/drm/exynos/exynos_drm_dpi.c            |  3 +++
>  drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c          | 18 ++++++++++++++++++
>  drivers/gpu/drm/logicvc/logicvc_interface.c        | 12 ++++++++++++
>  drivers/gpu/drm/rockchip/analogix_dp-rockchip.c    | 11 +++++++++++
>  drivers/gpu/drm/sti/sti_dvo.c                      |  3 +++
>  drivers/gpu/drm/stm/lvds.c                         |  3 +++
>  drivers/gpu/drm/sun4i/sun4i_lvds.c                 | 13 +++++++++++++
>  drivers/gpu/drm/sun4i/sun4i_rgb.c                  | 13 +++++++++++++
>  drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c             |  2 ++
>  drivers/gpu/drm/tegra/dsi.c                        |  1 +
>  drivers/gpu/drm/tegra/output.c                     |  3 +++
>  16 files changed, 111 insertions(+), 7 deletions(-)
> 
> ...
> diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
> index 7f25c50621c94..57a016f47434d 100644
> --- a/drivers/gpu/drm/tegra/dsi.c
> +++ b/drivers/gpu/drm/tegra/dsi.c
> @@ -1516,6 +1516,7 @@ static int tegra_dsi_host_detach(struct mipi_dsi_host *host,
>  	struct tegra_output *output = &dsi->output;
>  
>  	if (output->panel && &device->dev == output->panel->dev) {
> +		drm_panel_put(output->panel);
>  		output->panel = NULL;
>  
>  		if (output->connector.dev)
> diff --git a/drivers/gpu/drm/tegra/output.c b/drivers/gpu/drm/tegra/output.c
> index 49e4f63a5550d..90db39dbdd332 100644
> --- a/drivers/gpu/drm/tegra/output.c
> +++ b/drivers/gpu/drm/tegra/output.c
> @@ -195,6 +195,9 @@ int tegra_output_probe(struct tegra_output *output)
>  
>  void tegra_output_remove(struct tegra_output *output)
>  {
> +	if (output->panel)
> +		drm_panel_put(output->panel);
> +
>  	if (output->hpd_gpio)
>  		free_irq(output->hpd_irq, output);
>  
> 

tegra_output_probe's error cleanup paths need to be updated to clean up
the refcount. Also, it can technically call drm_of_find_panel_or_bridge
and then overwrite that value with of_drm_find_panel. While there's
already a WARN_ON for that case, I think it would be good to fix the
refcounting there as well for consistency.

As a note, the tegra-dsi code also uses tegra_output and can overwrite
the panel field with its own -- but in those cases tegra_output should
never populate the panel and we've been talking about removing that
code path anyway, so the dsi code can continue to assume that
tegra_output_probe doesn't populate a panel.

Cheers
Mikko

> -- 
> 2.54.0
> 
>