search for: drm_dev_unregist

drm_put_dev also calls drm_dev_unregister, so dev will be unregistered twice. Replace it with drm_dev_put to fix it. Signed-off-by: Chuhong Yuan <hslester96 at gmail.com> --- drivers/gpu/drm/virtio/virtgpu_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/...

drm_put_dev also calls drm_dev_unregister, so dev will be unregistered twice. Replace it with drm_dev_put to fix it. Signed-off-by: Chuhong Yuan <hslester96 at gmail.com> --- drivers/gpu/drm/virtio/virtgpu_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/...

From: Gurchetan Singh <gurchetansingh at chromium.org> Move bochs_unload call from bochs_remove() to the new bochs_release() callback. Also call drm_dev_unregister() first in bochs_remove(). Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/bochs/bochs_drv.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bochs/bochs_drv.c b/drivers/gpu/drm/bochs/bochs_drv.c index 10460878414e..87ee1...

...pci_dev *pdev, > err_pci: > pci_disable_device(pdev); > err_free: > - drm_dev_unref(dev); > + drm_dev_put(dev); > return ret; > } > > @@ -657,7 +657,7 @@ amdgpu_pci_remove(struct pci_dev *pdev) > struct drm_device *dev = pci_get_drvdata(pdev); > > drm_dev_unregister(dev); > - drm_dev_unref(dev); > + drm_dev_put(dev); > pci_disable_device(pdev); > pci_set_drvdata(pdev, NULL); > } > diff --git a/drivers/gpu/drm/arc/arcpgu_drv.c b/drivers/gpu/drm/arc/arcpgu_drv.c > index f067de4e1e82..dcb06d4e9135 100644 > --- a/drivers/gpu/drm/arc/...

...drv.c @@ -647,7 +647,7 @@ static int amdgpu_pci_probe(struct pci_dev *pdev, err_pci: pci_disable_device(pdev); err_free: - drm_dev_unref(dev); + drm_dev_put(dev); return ret; } @@ -657,7 +657,7 @@ amdgpu_pci_remove(struct pci_dev *pdev) struct drm_device *dev = pci_get_drvdata(pdev); drm_dev_unregister(dev); - drm_dev_unref(dev); + drm_dev_put(dev); pci_disable_device(pdev); pci_set_drvdata(pdev, NULL); } diff --git a/drivers/gpu/drm/arc/arcpgu_drv.c b/drivers/gpu/drm/arc/arcpgu_drv.c index f067de4e1e82..dcb06d4e9135 100644 --- a/drivers/gpu/drm/arc/arcpgu_drv.c +++ b/drivers/gpu/drm/arc/a...

...drv.c @@ -647,7 +647,7 @@ static int amdgpu_pci_probe(struct pci_dev *pdev, err_pci: pci_disable_device(pdev); err_free: - drm_dev_unref(dev); + drm_dev_put(dev); return ret; } @@ -657,7 +657,7 @@ amdgpu_pci_remove(struct pci_dev *pdev) struct drm_device *dev = pci_get_drvdata(pdev); drm_dev_unregister(dev); - drm_dev_unref(dev); + drm_dev_put(dev); pci_disable_device(pdev); pci_set_drvdata(pdev, NULL); } diff --git a/drivers/gpu/drm/arc/arcpgu_drv.c b/drivers/gpu/drm/arc/arcpgu_drv.c index f067de4e1e82..dcb06d4e9135 100644 --- a/drivers/gpu/drm/arc/arcpgu_drv.c +++ b/drivers/gpu/drm/arc/a...

...drv.c @@ -647,7 +647,7 @@ static int amdgpu_pci_probe(struct pci_dev *pdev, err_pci: pci_disable_device(pdev); err_free: - drm_dev_unref(dev); + drm_dev_put(dev); return ret; } @@ -657,7 +657,7 @@ amdgpu_pci_remove(struct pci_dev *pdev) struct drm_device *dev = pci_get_drvdata(pdev); drm_dev_unregister(dev); - drm_dev_unref(dev); + drm_dev_put(dev); pci_disable_device(pdev); pci_set_drvdata(pdev, NULL); } diff --git a/drivers/gpu/drm/arc/arcpgu_drv.c b/drivers/gpu/drm/arc/arcpgu_drv.c index f067de4e1e82..dcb06d4e9135 100644 --- a/drivers/gpu/drm/arc/arcpgu_drv.c +++ b/drivers/gpu/drm/arc/a...

...ease > hook, and we might need a few fixups. > We take a ref on the parent device in drm_dev_init() and release it in drm_dev_fini(). I added this because of the DRM_DEV_* macros we have, to protect access to the device struct after it was unregistered. Setting drm_device->dev to NULL in drm_dev_unregister() instead will provide the same protection I think. commit 56be6503aab2 drm/drv: Hold ref on parent device during drm_device lifetime Noralf. > Cheers, Daniel > >> + qxl_device_fini(qdev); >> + dev->dev_private = NULL; >> + kfree(qdev); >> +} >> + >&g...

...) calls is + * non-trivial though. + */ + qxl_modeset_fini(qdev); + qxl_device_fini(qdev); + dev->dev_private = NULL; + kfree(qdev); +} + static void qxl_pci_remove(struct pci_dev *pdev) { struct drm_device *dev = pci_get_drvdata(pdev); - struct qxl_device *qdev = dev->dev_private; drm_dev_unregister(dev); - - qxl_modeset_fini(qdev); - qxl_device_fini(qdev); + drm_atomic_helper_shutdown(dev); if (is_vga(pdev)) vga_put(pdev, VGA_RSRC_LEGACY_IO); - - dev->dev_private = NULL; - kfree(qdev); drm_dev_put(dev); } @@ -279,6 +289,8 @@ static struct drm_driver qxl_driver = { .major = 0,...

...) calls is + * non-trivial though. + */ + qxl_modeset_fini(qdev); + qxl_device_fini(qdev); + dev->dev_private = NULL; + kfree(qdev); +} + static void qxl_pci_remove(struct pci_dev *pdev) { struct drm_device *dev = pci_get_drvdata(pdev); - struct qxl_device *qdev = dev->dev_private; drm_dev_unregister(dev); - - qxl_modeset_fini(qdev); - qxl_device_fini(qdev); + drm_atomic_helper_shutdown(dev); if (is_vga(pdev)) vga_put(pdev, VGA_RSRC_LEGACY_IO); - - dev->dev_private = NULL; - kfree(qdev); drm_dev_put(dev); } @@ -279,6 +289,8 @@ static struct drm_driver qxl_driver = { .major = 0,...

Call drm_dev_unregister() first in bochs_pci_remove(). Hook bochs_unload() into the new .release callback, to make sure cleanup is done when all users are gone. Add ready bool to state struct and move bochs_hw_fini() call from bochs_unload() to bochs_pci_remove() to make sure hardware is not touched after bochs_pci_re...

On Sat, Nov 09, 2019 at 03:54:17PM +0800, Chuhong Yuan wrote: > drm_put_dev also calls drm_dev_unregister, so dev will be unregistered > twice. > Replace it with drm_dev_put to fix it. > > Signed-off-by: Chuhong Yuan <hslester96 at gmail.com> Nice catch, I'll apply. Since this is so confusing, we actually have a todo to remove drm_put_dev completely from the codebase (and ope...

From: Gurchetan Singh <gurchetansingh at chromium.org> Move bochs_unload call from bochs_remove() to the new bochs_release() callback. Also call drm_dev_unregister() first in bochs_remove(). Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/bochs/bochs_drv.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bochs/bochs_drv.c b/drivers/gpu/drm/bochs/bochs_drv.c index 10460878414e..87ee1...

...qxl_device *qdev = dev->dev_private; + + qxl_modeset_fini(qdev); + qxl_device_fini(qdev); + dev->dev_private = NULL; + kfree(qdev); +} + static void qxl_pci_remove(struct pci_dev *pdev) { struct drm_device *dev = pci_get_drvdata(pdev); - struct qxl_device *qdev = dev->dev_private; drm_dev_unregister(dev); - - qxl_modeset_fini(qdev); - qxl_device_fini(qdev); + drm_atomic_helper_shutdown(dev); if (is_vga(pdev)) vga_put(pdev, VGA_RSRC_LEGACY_IO); - - dev->dev_private = NULL; - kfree(qdev); drm_dev_put(dev); } @@ -279,6 +284,8 @@ static struct drm_driver qxl_driver = { .major = 0,...

...pdev, const struct pci_device_id *ent) unload: qxl_device_fini(qdev); put_vga: - if (is_vga(pdev)) + if (is_vga(pdev) && pdev->revision < 5) vga_put(pdev, VGA_RSRC_LEGACY_IO); disable_pci: pci_disable_device(pdev); @@ -155,7 +155,7 @@ qxl_pci_remove(struct pci_dev *pdev) drm_dev_unregister(dev); drm_atomic_helper_shutdown(dev); - if (is_vga(pdev)) + if (is_vga(pdev) && pdev->revision < 5) vga_put(pdev, VGA_RSRC_LEGACY_IO); } -- 2.18.4

...lease, }; static int cirrus_pci_probe(struct pci_dev *pdev, @@ -596,14 +607,10 @@ static int cirrus_pci_probe(struct pci_dev *pdev, static void cirrus_pci_remove(struct pci_dev *pdev) { struct drm_device *dev = pci_get_drvdata(pdev); - struct cirrus_device *cirrus = dev->dev_private; drm_dev_unregister(dev); - drm_mode_config_cleanup(dev); - iounmap(cirrus->mmio); - iounmap(cirrus->vram); + drm_atomic_helper_shutdown(dev); drm_dev_put(dev); - kfree(cirrus); pci_release_regions(pdev); } -- 2.18.1

This series fixes a number of use-after-frees in nouveau's postclose() handler. It was discovered by pointing IGT's core_hotunplug tests at a nouveau device, but the steps to reproduce it are simple: 1. Open the device file 2. Unbind the driver or remove the device 3. Close the file opened in step 1. During the device removal, the nouveau_drm structure is de-allocated, but is

...Try to preserve the crtc enabled state in drm_atomic_remove_fb, v2.") ... so I've included both in the commit. Is that the right thing to do? I couldn't help wondering if we should also update the comment for drm_fbdev_generic_setup(), because it says: "The fbdev is destroyed by drm_dev_unregister()" ... which implies to me that cleanup only requires that call, but actually since 846c7dfc1193 you will always(?) need to use drm_atomic_helper_shutdown() as well. (Is it actually always the case?) Cheers, Sam. drivers/gpu/drm/bochs/bochs_drv.c | 2 ++ 1 file changed, 2 insertions(+) d...

...Try to preserve the crtc enabled state in drm_atomic_remove_fb, v2.") ... so I've included both in the commit. Is that the right thing to do? I couldn't help wondering if we should also update the comment for drm_fbdev_generic_setup(), because it says: "The fbdev is destroyed by drm_dev_unregister()" ... which implies to me that cleanup only requires that call, but actually since 846c7dfc1193 you will always(?) need to use drm_atomic_helper_shutdown() as well. (Is it actually always the case?) Cheers, Sam. drivers/gpu/drm/bochs/bochs_drv.c | 2 ++ 1 file changed, 2 insertions(+) d...

...us_driver = { .fops = &cirrus_fops, DRM_GEM_SHMEM_DRIVER_OPS, + .release = cirrus_release, }; static int cirrus_pci_probe(struct pci_dev *pdev, @@ -599,11 +617,12 @@ static void cirrus_pci_remove(struct pci_dev *pdev) struct cirrus_device *cirrus = dev->dev_private; drm_dev_unregister(dev); - drm_mode_config_cleanup(dev); + drm_atomic_helper_shutdown(dev); iounmap(cirrus->mmio); + cirrus->mmio = NULL; iounmap(cirrus->vram); + cirrus->vram = NULL; drm_dev_put(dev); - kfree(cirrus); pci_release_regions(pdev); } -- 2.18.1