[PATCH v7 00/11] drm/bridge: add devm_drm_bridge_alloc() with bridge refcount

From: Luca Ceresoli
Date: Fri Mar 14 2025 - 06:31:51 EST


This series improves the way DRM bridges are allocated and initialized and
makes them reference-counted. The goal of reference counting is to avoid
use-after-free by drivers which got a pointer to a bridge and keep it
stored and used even after the bridge has been deallocated.

The overall goal is supporting Linux devices with a DRM pipeline whose
final components can be hot-plugged and hot-unplugged, including one or
more bridges. For more details see the big picture [0].

DRM bridge drivers will have to be adapted to the new API, which is pretty
simple for most cases. Refcounting will have to be adopted on the two
sides: all functions returning a bridge pointer and all code obtaining such
a pointer. This series has just an overview of some of those conversions,
because for now the main goal is to agree on the API.

Series layout:

1. Add the new API and refcounting:

drm/bridge: add devm_drm_bridge_alloc()
drm/bridge: add support for refcounting

2. get/put the reference in basic operations in the bridge core:

drm/bridge: get/put the bridge reference in drm_bridge_add/remove()
drm/bridge: get/put the bridge reference in drm_bridge_attach/detach()

3. as an example of changes for bridge consumers, get a reference for the
bridge returned by drm_bridge_chain_get_first_bridge(), have it put by
all callers (all users will be covered later on separately):

drm/bridge: add a cleanup action for scope-based drm_bridge_put() invocation
drm/bridge: get the bridge returned by drm_bridge_chain_get_first_bridge()
drm/mxsfb: put the bridge returned by drm_bridge_chain_get_first_bridge()
drm/atomic-helper: put the bridge returned by drm_bridge_chain_get_first_bridge()
drm/probe-helper: put the bridge returned by drm_bridge_chain_get_first_bridge()

4. convert a few bridge drivers (bridge providers) to the new API:

drm/bridge: ti-sn65dsi83: use dynamic lifetime management
drm/bridge: samsung-dsim: use dynamic lifetime management

This work was formerly a part of my v6 DRM bridge hotplug series[0], now
split as a standalone series with many improvements, hence the "v7" version
number.

[0] https://lore.kernel.org/dri-devel/20250206-hotplug-drm-bridge-v6-0-9d6f2c9c3058@xxxxxxxxxxx/

Signed-off-by: Luca Ceresoli <luca.ceresoli@xxxxxxxxxxx>
---
Luca Ceresoli (11):
drm/bridge: add devm_drm_bridge_alloc()
drm/bridge: add support for refcounting
drm/bridge: get/put the bridge reference in drm_bridge_add/remove()
drm/bridge: get/put the bridge reference in drm_bridge_attach/detach()
drm/bridge: add a cleanup action for scope-based drm_bridge_put() invocation
drm/bridge: get the bridge returned by drm_bridge_chain_get_first_bridge()
drm/mxsfb: put the bridge returned by drm_bridge_chain_get_first_bridge()
drm/atomic-helper: put the bridge returned by drm_bridge_chain_get_first_bridge()
drm/probe-helper: put the bridge returned by drm_bridge_chain_get_first_bridge()
drm/bridge: ti-sn65dsi83: use dynamic lifetime management
drm/bridge: samsung-dsim: use dynamic lifetime management

drivers/gpu/drm/bridge/samsung-dsim.c | 7 +-
drivers/gpu/drm/bridge/ti-sn65dsi83.c | 7 +-
drivers/gpu/drm/drm_atomic_helper.c | 5 ++
drivers/gpu/drm/drm_bridge.c | 74 +++++++++++++++++++--
drivers/gpu/drm/drm_probe_helper.c | 1 +
drivers/gpu/drm/mxsfb/lcdif_kms.c | 3 +-
include/drm/drm_bridge.h | 119 +++++++++++++++++++++++++++++++++-
7 files changed, 201 insertions(+), 15 deletions(-)
---
base-commit: 9e6d91c60b0d64a4f945663993b3bbf4f3fb7392
change-id: 20250314-drm-bridge-refcount-58d9503503f6

Best regards,
--
Luca Ceresoli <luca.ceresoli@xxxxxxxxxxx>