Re: [PATCH] Revert "drm/imx: don't destroy mode objects manually on driver unbind"

[Stefan Agner]

On 16.10.2018 18:51, Lucas Stach wrote:
> Am Dienstag, den 16.10.2018, 18:09 +0200 schrieb Stefan Agner:
>> This reverts commit 8e3b16e2117409625b89807de3912ff773aea354.
>>
>> Using the component framework requires all components to undo in
>> ->unbind what ->bind does. Unfortunately that particular commit
>> broke this rule. In particular, this is an issue if a single
>> component during probe fails. In that case, component_bind_all()
>> calls unbind on already succussfully bound components, and then
>> frees memory allocated using devm. If one of those components
>> registered e.g. an encoder with the framework then this leads to
>> use after free situations.
>>
>> Revert the commit to ensure that all components properly undo
>> what ->bind does.
> 
> I agree with this patch in general, but I think I remember why I
> changed this in the first place: dw_hdmi_imx_unbind does not destroy
> the encoder that has been registered in dw_hdmi_imx_bind.

Good point, yeah that is missing.

> 
> 8e3b16e21174 was an (apparently wrong) attempt to fix such issues once
> and for all. By reverting this commit we go back to leaking the HDMI
> encoder, so I think this patch should include a fix to destroy the
> encoder on unbind.

Makes sense, will add that to the same commit and send a v2.

--
Stefan

> 
> Regards,
> Lucas
> 
>> Link: https://www.mail-archive.com/dri-devel@xxxxxxxxxxxxxxxxxxxxx/msg233327.html
>> > Suggested-by: Russell King <rmk+kernel@xxxxxxxxxxxxxxx>
>> > Signed-off-by: Stefan Agner <stefan@xxxxxxxx>
>> ---
>> Âdrivers/gpu/drm/imx/imx-drm-core.cÂÂÂÂÂ| 4 ++--
>> Âdrivers/gpu/drm/imx/imx-ldb.cÂÂÂÂÂÂÂÂÂÂ| 6 ++++++
>> Âdrivers/gpu/drm/imx/imx-tve.cÂÂÂÂÂÂÂÂÂÂ| 3 +++
>> Âdrivers/gpu/drm/imx/parallel-display.c | 3 +++
>> Â4 files changed, 14 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c
>> index 5ea0c82f9957..caa6061a98ba 100644
>> --- a/drivers/gpu/drm/imx/imx-drm-core.c
>> +++ b/drivers/gpu/drm/imx/imx-drm-core.c
>> @@ -305,11 +305,11 @@ static void imx_drm_unbind(struct device *dev)
>> Â
>> > Â	drm_fb_cma_fbdev_fini(drm);
>> Â
>> > -	drm_mode_config_cleanup(drm);
>> -
>> > Â	component_unbind_all(drm->dev, drm);
>> > Â	dev_set_drvdata(dev, NULL);
>> Â
>> > +	drm_mode_config_cleanup(drm);
>> +
>> > Â	drm_dev_put(drm);
>> Â}
>> Â
>> diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
>> index 3bd0f8a18e74..592aabc4a262 100644
>> --- a/drivers/gpu/drm/imx/imx-ldb.c
>> +++ b/drivers/gpu/drm/imx/imx-ldb.c
>> @@ -723,6 +723,12 @@ static void imx_ldb_unbind(struct device *dev, struct device *master,
>> > Â		if (channel->panel)
>> > Â			drm_panel_detach(channel->panel);
>> Â
>> > +		if (!channel->connector.funcs)
>> > +			continue;
>> +
>> > +		channel->connector.funcs->destroy(&channel->connector);
>> > +		channel->encoder.funcs->destroy(&channel->encoder);
>> +
>> > Â		kfree(channel->edid);
>> > Â		i2c_put_adapter(channel->ddc);
>> > Â	}
>> diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c
>> index cffd3310240e..8d6e89ce1edb 100644
>> --- a/drivers/gpu/drm/imx/imx-tve.c
>> +++ b/drivers/gpu/drm/imx/imx-tve.c
>> @@ -673,6 +673,9 @@ static void imx_tve_unbind(struct device *dev, struct device *master,
>> Â{
>> > Â	struct imx_tve *tve = dev_get_drvdata(dev);
>> Â
>> > +	tve->connector.funcs->destroy(&tve->connector);
>> > +	tve->encoder.funcs->destroy(&tve->encoder);
>> +
>> > Â	if (!IS_ERR(tve->dac_reg))
>> > Â		regulator_disable(tve->dac_reg);
>> Â}
>> diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c
>> index aefd04e18f93..6f11bffcde37 100644
>> --- a/drivers/gpu/drm/imx/parallel-display.c
>> +++ b/drivers/gpu/drm/imx/parallel-display.c
>> @@ -258,6 +258,9 @@ static void imx_pd_unbind(struct device *dev, struct device *master,
>> > Â	if (imxpd->panel)
>> > Â		drm_panel_detach(imxpd->panel);
>> Â
>> > +	imxpd->encoder.funcs->destroy(&imxpd->encoder);
>> > +	imxpd->connector.funcs->destroy(&imxpd->connector);
>> +
>> > Â	kfree(imxpd->edid);
>> Â}
>> Â