On Wed, Apr 2, 2025 at 4:36 PM AngeloGioacchino Del Regno
<angelogioacchino.delre...@collabora.com> wrote:
>
> This driver is taking a kobject for mtk_mutex only once per mmsys
> device for each drm-mediatek driver instance, differently from the
> behavior with other components, but it is decrementing the kobj's
> refcount in a loop and once per mmsys: this is not right and will
> result in a refcount_t underflow warning when mediatek-drm returns
> multiple probe deferrals in one boot (or when manually bound and
> unbound).
>
> Besides that, the refcount for mutex_dev was not decremented for
> error cases in mtk_drm_bind(), causing another refcount_t warning
> but this time for overflow, when the failure happens not during
> driver bind but during component bind.
>
> In order to fix one of the reasons why this is happening, remove
> the put_device(xx->mutex_dev) loop from the mtk_drm_kms_init()'s
> put_mutex_dev label (and drop the label) and add a single call to
> correctly free the single incremented refcount of mutex_dev to
> the mtk_drm_unbind() function to fix the refcount_t underflow.
>
> Moreover, add the same call to the error cases in mtk_drm_bind()
> to fix the refcount_t overflow.
>
> Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi
> mmsys support")
> Signed-off-by: AngeloGioacchino Del Regno
> <angelogioacchino.delre...@collabora.com>
Reviewed-by: Chen-Yu Tsai <we...@chromium.org>
> ---
> drivers/gpu/drm/mediatek/mtk_drm_drv.c | 17 ++++++++++-------
> 1 file changed, 10 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index e09578756de0..a8fbccb50c74 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -464,7 +464,7 @@ static int mtk_drm_kms_init(struct drm_device *drm)
>
> ret = drmm_mode_config_init(drm);
> if (ret)
> - goto put_mutex_dev;
> + return ret;
>
> drm->mode_config.min_width = 64;
> drm->mode_config.min_height = 64;
> @@ -483,7 +483,7 @@ static int mtk_drm_kms_init(struct drm_device *drm)
> drm->dev_private = private->all_drm_private[i];
> ret = component_bind_all(private->all_drm_private[i]->dev,
> drm);
> if (ret)
> - goto put_mutex_dev;
> + return ret;
> }
>
> /*
> @@ -576,9 +576,6 @@ static int mtk_drm_kms_init(struct drm_device *drm)
> err_component_unbind:
> for (i = 0; i < private->data->mmsys_dev_num; i++)
> component_unbind_all(private->all_drm_private[i]->dev, drm);
> -put_mutex_dev:
> - for (i = 0; i < private->data->mmsys_dev_num; i++)
> - put_device(private->all_drm_private[i]->mutex_dev);
>
> return ret;
> }
> @@ -649,8 +646,10 @@ static int mtk_drm_bind(struct device *dev)
> return 0;
>
> drm = drm_dev_alloc(&mtk_drm_driver, dev);
> - if (IS_ERR(drm))
> - return PTR_ERR(drm);
> + if (IS_ERR(drm)) {
> + ret = PTR_ERR(drm);
> + goto err_put_dev;
> + }
>
> private->drm_master = true;
> drm->dev_private = private;
> @@ -676,6 +675,8 @@ static int mtk_drm_bind(struct device *dev)
> drm_dev_put(drm);
> for (i = 0; i < private->data->mmsys_dev_num; i++)
> private->all_drm_private[i]->drm = NULL;
> +err_put_dev:
> + put_device(private->mutex_dev);
> return ret;
> }
>
> @@ -688,6 +689,8 @@ static void mtk_drm_unbind(struct device *dev)
> drm_dev_unregister(private->drm);
> mtk_drm_kms_deinit(private->drm);
> drm_dev_put(private->drm);
> +
> + put_device(private->mutex_dev);
> }
> private->mtk_drm_bound = false;
> private->drm_master = false;
> --
> 2.48.1
>
