To be able to unregister stuff from isrs, the corresponding table was
copied. Nobody seems to unregister stuff that way, so it does not help.
But there are stack-allocated objects passed to these isrs giving chances
of UAF of these objects if irqs are unregistered while they are handled,
so better do not copy that table.
Fixes: 4ae2ddddf44cd ("OMAP: DSS2: DSI: Add ISR support")
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20260702-dsi-uaf-v2-1-dbb4aa0f0b8e@kemnade.info
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Callers of of_drm_find_panel() and drm_of_find_panel_or_bridge() receive a pointer with no reference held, creating a window where the panel device can be unregistered and freed between the lookup and first use (e.g., drm_panel_prepare()). Fix the lookup function by acquiring a reference with drm_panel_get() before returning, under panel_lock. Callers are now responsible for calling drm_panel_put() when they no longer need the pointer. For bridge drivers that immediately wrap the panel in a panel_bridge (which acquires its own reference), release the lookup reference right after the bridge creation call. For analogix-anx6345, which stores the panel for direct use, release the reference in the i2c remove path. For platform drivers using analogix_dp_core with a component lifecycle (exynos_dp, rockchip analogix_dp), release the lookup reference in the platform remove() function. The panel_bridge created during bind() holds a separate reference that devm cleanup releases after remove() returns. Also fix devm_drm_of_get_bridge() and drmm_of_get_bridge() in bridge/panel.c itself, update a second batch of drivers calling of_drm_find_panel() or drm_of_find_panel_or_bridge() to release the lookup reference after wrapping the panel in a bridge, and handle the cases where a panel is found but cannot be used, dropping the reference immediately in those paths. Assisted-by: Claude:claude-opus-4-6 Acked-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Albert Esteve <aesteve@redhat.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260717-drm_refcount_wiring-v3-3-023900c32e01@redhat.com
The venc bridge uses the legacy non-atomic enable and disable bridge
callbacks.
In order to remove the legacy bridge callback support from the DRM
bridge core, switch to their atomic counterparts and add the bridge
atomic state handlers.
Generated by the following Coccinelle script:
@ is_bridge @
identifier funcs;
@@
struct drm_bridge_funcs funcs = {
...,
};
@ has_create_state depends on is_bridge @
identifier funcs, f;
@@
struct drm_bridge_funcs funcs = {
...,
.atomic_create_state = f,
...,
};
@ update_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
+ .atomic_create_state = drm_atomic_helper_bridge_create_state,
+ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
+ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
...,
};
@ update_pre_enable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .pre_enable = f,
+ .atomic_pre_enable = f,
...,
};
@ update_pre_enable_impl depends on update_pre_enable_struct @
identifier update_pre_enable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
@ update_enable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .enable = f,
+ .atomic_enable = f,
...,
};
@ update_enable_impl depends on update_enable_struct @
identifier update_enable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
@ update_disable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .disable = f,
+ .atomic_disable = f,
...,
};
@ update_disable_impl depends on update_disable_struct @
identifier update_disable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
@ update_post_disable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .post_disable = f,
+ .atomic_post_disable = f,
...,
};
@ update_post_disable_impl depends on update_post_disable_struct @
identifier update_post_disable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Link: https://patch.msgid.link/20260707-drm-all-atomic-bridges-v2-33-21d03cbca446@kernel.org
Signed-off-by: Maxime Ripard <mripard@kernel.org>
The sdi bridge uses the legacy non-atomic enable and disable bridge
callbacks.
In order to remove the legacy bridge callback support from the DRM
bridge core, switch to their atomic counterparts and add the bridge
atomic state handlers.
Generated by the following Coccinelle script:
@ is_bridge @
identifier funcs;
@@
struct drm_bridge_funcs funcs = {
...,
};
@ has_create_state depends on is_bridge @
identifier funcs, f;
@@
struct drm_bridge_funcs funcs = {
...,
.atomic_create_state = f,
...,
};
@ update_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
+ .atomic_create_state = drm_atomic_helper_bridge_create_state,
+ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
+ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
...,
};
@ update_pre_enable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .pre_enable = f,
+ .atomic_pre_enable = f,
...,
};
@ update_pre_enable_impl depends on update_pre_enable_struct @
identifier update_pre_enable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
@ update_enable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .enable = f,
+ .atomic_enable = f,
...,
};
@ update_enable_impl depends on update_enable_struct @
identifier update_enable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
@ update_disable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .disable = f,
+ .atomic_disable = f,
...,
};
@ update_disable_impl depends on update_disable_struct @
identifier update_disable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
@ update_post_disable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .post_disable = f,
+ .atomic_post_disable = f,
...,
};
@ update_post_disable_impl depends on update_post_disable_struct @
identifier update_post_disable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Link: https://patch.msgid.link/20260707-drm-all-atomic-bridges-v2-32-21d03cbca446@kernel.org
Signed-off-by: Maxime Ripard <mripard@kernel.org>
The dsi bridge uses the legacy non-atomic enable and disable bridge
callbacks.
In order to remove the legacy bridge callback support from the DRM
bridge core, switch to their atomic counterparts and add the bridge
atomic state handlers.
Generated by the following Coccinelle script:
@ is_bridge @
identifier funcs;
@@
struct drm_bridge_funcs funcs = {
...,
};
@ has_create_state depends on is_bridge @
identifier funcs, f;
@@
struct drm_bridge_funcs funcs = {
...,
.atomic_create_state = f,
...,
};
@ update_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
+ .atomic_create_state = drm_atomic_helper_bridge_create_state,
+ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
+ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
...,
};
@ update_pre_enable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .pre_enable = f,
+ .atomic_pre_enable = f,
...,
};
@ update_pre_enable_impl depends on update_pre_enable_struct @
identifier update_pre_enable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
@ update_enable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .enable = f,
+ .atomic_enable = f,
...,
};
@ update_enable_impl depends on update_enable_struct @
identifier update_enable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
@ update_disable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .disable = f,
+ .atomic_disable = f,
...,
};
@ update_disable_impl depends on update_disable_struct @
identifier update_disable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
@ update_post_disable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .post_disable = f,
+ .atomic_post_disable = f,
...,
};
@ update_post_disable_impl depends on update_post_disable_struct @
identifier update_post_disable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Link: https://patch.msgid.link/20260707-drm-all-atomic-bridges-v2-31-21d03cbca446@kernel.org
Signed-off-by: Maxime Ripard <mripard@kernel.org>
The dpi bridge uses the legacy non-atomic enable and disable bridge
callbacks.
In order to remove the legacy bridge callback support from the DRM
bridge core, switch to their atomic counterparts and add the bridge
atomic state handlers.
Generated by the following Coccinelle script:
@ is_bridge @
identifier funcs;
@@
struct drm_bridge_funcs funcs = {
...,
};
@ has_create_state depends on is_bridge @
identifier funcs, f;
@@
struct drm_bridge_funcs funcs = {
...,
.atomic_create_state = f,
...,
};
@ update_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
+ .atomic_create_state = drm_atomic_helper_bridge_create_state,
+ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
+ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
...,
};
@ update_pre_enable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .pre_enable = f,
+ .atomic_pre_enable = f,
...,
};
@ update_pre_enable_impl depends on update_pre_enable_struct @
identifier update_pre_enable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
@ update_enable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .enable = f,
+ .atomic_enable = f,
...,
};
@ update_enable_impl depends on update_enable_struct @
identifier update_enable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
@ update_disable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .disable = f,
+ .atomic_disable = f,
...,
};
@ update_disable_impl depends on update_disable_struct @
identifier update_disable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
@ update_post_disable_struct depends on (is_bridge && !has_create_state) @
identifier is_bridge.funcs;
identifier f;
@@
struct drm_bridge_funcs funcs = {
...,
- .post_disable = f,
+ .atomic_post_disable = f,
...,
};
@ update_post_disable_impl depends on update_post_disable_struct @
identifier update_post_disable_struct.f;
identifier b;
@@
-void f(struct drm_bridge *b)
+void f(struct drm_bridge *b, struct drm_atomic_commit *commit)
{
...
}
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Link: https://patch.msgid.link/20260707-drm-all-atomic-bridges-v2-30-21d03cbca446@kernel.org
Signed-off-by: Maxime Ripard <mripard@kernel.org>
The drm_bridge_funcs.atomic_reset callback and its drm_atomic_helper_bridge_reset() helper are deprecated. Switch to the atomic_create_state callback and its drm_atomic_helper_bridge_create_state() counterpart. Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # imx8mp + sn65dsi84 + bridge hotplug Link: https://patch.msgid.link/20260619-drm-no-more-bridge-reset-v3-60-ff399263111b@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
The drm_bridge_funcs.atomic_reset callback and its drm_atomic_helper_bridge_reset() helper are deprecated. Switch to the atomic_create_state callback and its drm_atomic_helper_bridge_create_state() counterpart. Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # imx8mp + sn65dsi84 + bridge hotplug Link: https://patch.msgid.link/20260619-drm-no-more-bridge-reset-v3-59-ff399263111b@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
drm-misc-next for v7.1-rc1: UAPI Changes: - Expose per-client BO memory usage via fdinfo in amdxdna. (Hou) - Change the default priority of drm scheduler to fair. (Tvrtko) Cross-subsystem Changes: - Revert hugetlb support in udmabuf. (Gunthorpe) - Fix error in udmabuf with CONFIG_DMA_API_DEBUG(/ _SG). (Gavrilov) - Add Docbook for DRM_IOCTL_SYNCOBJ_EVENTFD, (Ser) clarify drm_bridge_get/put. (Tvrtko) - Change signature of drm_connector_attach_hdr_output_metadata_property. (Canal) - Use IOVA allocations in gpusvm and pagemap APIs. (Brost) - Fix tracepoints vs dma-fence lifetime. (Tvrtko) - Convert st-dma*.c tests to use kunit. (Gunthorpe) Core Changes: - Deduplicate counter and timestamp retrieval in vblank code. (Ville) - Parse AMD VSDB v3 in CTA extension blocks, and use it in amdgpu. (Chen) - Prevent bridge and encoder chain changes at inopportune times. (Ceresoli) - Map the run queue 1:1 to the drm scheduler. (Tvrtko) Driver Changes: - Assorted bugfixes and (documentation) updates to rockchip, bridge/synopsis, panfrost, tidss, accel/qaic, tilcdc, vc4, ast, imagination, panthor, renesas, accel/amdxdna, msxfb, bridge/imx8mp, nouveau. bridge/analogix_dp, bridge/exynos_dp, omap. - Add support for CSW PNB601LS1-2, LGD LP116WHA-SPB1, panels. - Add support for a lot of waveshare panels (Baryshkov) - Support for AIE4 devices in accel/wamdxdna. (Zhang) - Enable support for GEM shrinking in panthor. (Goel/Brezillon) - Runtime Power Management is added to v3d. (Canal) - Allow panel probing and use the panel bridge helper in analogix_dp. (Ding) - Support XRGB1555 and C8 in mgag and XRGB1555 in ast. (Zimmermann) From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/bf31b1a1-951b-4f60-b226-22e8c083697d@linux.intel.com Signed-off-by: Dave Airlie <airlied@redhat.com>
The KMS framework uses two slightly different definitions for the state concept. For a given object (plane, CRTC, encoder, etc., so drm_$OBJECT_state), the state is the entire state of that object. However, at the device level, drm_atomic_state refers to a state update for a limited number of objects. Thus, drm_atomic_state isn't the entire device state, but only the full state of some objects in that device. This has been an endless source of confusion and thus bugs. We can rename the drm_atomic_state structure to drm_atomic_commit to make it less confusing. This patch was created using: rg -l drm_atomic_state | \ xargs sed -i 's/drm_atomic_state/drm_atomic_commit/g; s/drm_atomic_commit_helper/drm_atomic_state_helper/g' mv drivers/gpu/drm/tests/drm_atomic_state_test.c drivers/gpu/drm/tests/drm_atomic_commit_test.c Acked-by: Simona Vetter <simona.vetter@ffwll.ch> Acked-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/20260427-drm-drm-atomic-update-v4-1-c0e713bfdf25@kernel.org