[v2,3/5] drm/panel: of_drm_find_panel() return a counted reference
Commit Message
Callers of of_drm_find_panel() receive a pointer with no reference
held, creating a window where the panel device can be unregistered
and freed between the lookup and first use (e.g., drm_panel_prepare()).
Fix the lookup function by acquiring a reference with drm_panel_get()
before returning, under panel_lock. Callers are now responsible for
calling drm_panel_put() when they no longer need the pointer.
For bridge drivers that immediately wrap the panel in a panel_bridge
(which acquires its own reference), release the lookup reference right
after the bridge creation call.
For analogix-anx6345, which stores the panel for direct use, release
the reference in the i2c remove path.
For platform drivers using analogix_dp_core with a component lifecycle
(exynos_dp, rockchip analogix_dp), release the lookup reference in the
platform remove() function. The panel_bridge created during bind() holds
a separate reference that devm cleanup releases after remove() returns.
Also fix devm_drm_of_get_bridge() and drmm_of_get_bridge() in
bridge/panel.c itself: both call drm_of_find_panel_or_bridge() and
then pass the panel to devm/drmm_panel_bridge_add(), which acquires
its own reference via drm_panel_bridge_add_typed(). The lookup
reference was never released; add drm_panel_put() after each bridge
creation call.
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Albert Esteve <aesteve@redhat.com>
---
drivers/gpu/drm/bridge/analogix/analogix-anx6345.c | 3 +++
drivers/gpu/drm/bridge/panel.c | 8 ++++++--
drivers/gpu/drm/drm_of.c | 3 ++-
drivers/gpu/drm/drm_panel.c | 12 ++++++++----
drivers/gpu/drm/exynos/exynos_dp.c | 10 ++++++++++
drivers/gpu/drm/exynos/exynos_drm_dpi.c | 3 +++
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c | 18 ++++++++++++++++++
drivers/gpu/drm/logicvc/logicvc_interface.c | 12 ++++++++++++
drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 11 +++++++++++
drivers/gpu/drm/sti/sti_dvo.c | 3 +++
drivers/gpu/drm/stm/lvds.c | 3 +++
drivers/gpu/drm/sun4i/sun4i_lvds.c | 13 +++++++++++++
drivers/gpu/drm/sun4i/sun4i_rgb.c | 13 +++++++++++++
drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 2 ++
drivers/gpu/drm/tegra/dsi.c | 1 +
drivers/gpu/drm/tegra/output.c | 3 +++
16 files changed, 111 insertions(+), 7 deletions(-)
Comments
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
New issues:
- [Critical] In the Tegra DSI driver, the panel reference is freed twice during driver removal, causing a use-after-free and a double free of the kref.
- [Medium] Widespread panel reference leaks in unmodified callers of `of_drm_find_panel()` and `drm_of_find_panel_or_bridge()`.
- [Medium] Modified drivers leak the panel reference if their probe or initialization functions fail after the panel lookup.
- [Medium] `tegra_dsi_host_attach()` overwrites the `output->panel` pointer, leaking the reference previously acquired during `tegra_output_probe()`.
Pre-existing issues:
- [Critical] `find_panel_by_fwnode()` was not updated to acquire a reference, preserving the use-after-free window that the commit intended to fix.
--
--- Patch [3]: [PATCH v2 3/5] drm/panel: of_drm_find_panel() return a counted reference ---
commit a89c4180aa3b0d041a29e5173be0f8523bd150fe
Author: Albert Esteve <aesteve@redhat.com>
drm/panel: of_drm_find_panel() return a counted reference
This patch modifies of_drm_find_panel() to acquire a reference with
drm_panel_get() before returning the panel, preventing a race condition where
the device can be freed before first use. It also updates several drivers to
release this reference when the panel is no longer needed.
> diff --git a/drivers/gpu/drm/drm_of.c b/drivers/gpu/drm/drm_of.c
[ ... ]
> @@ -225,7 +225,8 @@ EXPORT_SYMBOL_GPL(drm_of_encoder_active_endpoint);
> * @np: device tree node containing encoder output ports
> * @port: port in the device tree node
> * @endpoint: endpoint in the device tree node
> - * @panel: pointer to hold returned drm_panel, must not be NULL
> + * @panel: pointer to hold returned drm_panel, must not be NULL. On success
> + * the caller must call drm_panel_put() when done with the panel
> * @bridge: pointer to hold returned drm_bridge
> *
> * Given a DT node's port and endpoint number, find the connected node and
[Severity: Medium]
Since of_drm_find_panel() and drm_of_find_panel_or_bridge() now return a
panel with an incremented reference count, do all unmodified callers need
to be updated?
For example, in samsung_dsim_host_attach():
drivers/gpu/drm/bridge/samsung-dsim.c:samsung_dsim_host_attach() {
...
panel = of_drm_find_panel(remote);
...
}
And in rockchip_lvds_bind():
drivers/gpu/drm/rockchip/rockchip_lvds.c:rockchip_lvds_bind() {
...
ret = drm_of_find_panel_or_bridge(dev->of_node, 1, endpoint_id,
&lvds->panel, &lvds->bridge);
...
}
Are these panel references leaked if the callers are not updated to call
drm_panel_put() upon success or error?
> diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c
[ ... ]
> @@ -484,6 +487,7 @@ struct drm_panel *of_drm_find_panel(const struct device_node *np)
>
> list_for_each_entry(panel, &panel_list, list) {
> if (panel->dev->of_node == np) {
> + drm_panel_get(panel);
> mutex_unlock(&panel_lock);
> return panel;
> }
[Severity: Critical]
This isn't a bug introduced by this patch, but find_panel_by_fwnode() in
drm_panel.c appears to have the same race condition this patch fixes for
of_drm_find_panel().
drivers/gpu/drm/drm_panel.c:find_panel_by_fwnode() {
...
if (dev_fwnode(panel->dev) == fwnode) {
mutex_unlock(&panel_lock);
return panel;
}
...
}
Since it returns a raw panel pointer without acquiring its reference count,
could the panel device be unregistered and freed before the caller (like
drm_panel_add_follower()) uses it?
Does this function need the same drm_panel_get() treatment?
> diff --git a/drivers/gpu/drm/exynos/exynos_dp.c b/drivers/gpu/drm/exynos/exynos_dp.c
[ ... ]
> @@ -193,6 +193,16 @@ static int exynos_dp_probe(struct platform_device *pdev)
>
> static void exynos_dp_remove(struct platform_device *pdev)
> {
> + struct exynos_dp_device *dp = platform_get_drvdata(pdev);
> +
> + /*
> + * Release the probe-time reference from of_drm_find_panel(). If bind
> + * ran, the panel_bridge holds a second reference that devm cleanup
> + * will release when the bridge is destroyed after remove() returns.
> + */
> + if (dp->plat_data.panel)
> + drm_panel_put(dp->plat_data.panel);
> +
[Severity: Medium]
If exynos_dp_probe() fails after acquiring the panel reference, does it leak
the reference?
Looking at the probe function:
drivers/gpu/drm/exynos/exynos_dp.c:exynos_dp_probe() {
...
// panel reference acquired here or earlier
...
if (IS_ERR(dp->adp))
return PTR_ERR(dp->adp);
...
}
Since the driver core does not invoke remove() for failed probes, will
returning an error without calling drm_panel_put() cause a memory leak?
(A similar error-path leak pattern seems to exist in tegra_output_probe()).
[ ... ]
> diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
> index 7f25c50621c94..57a016f47434d 100644
> --- a/drivers/gpu/drm/tegra/dsi.c
> +++ b/drivers/gpu/drm/tegra/dsi.c
> @@ -1516,6 +1516,7 @@ static int tegra_dsi_host_detach(struct mipi_dsi_host *host,
> struct tegra_output *output = &dsi->output;
>
> if (output->panel && &device->dev == output->panel->dev) {
> + drm_panel_put(output->panel);
> output->panel = NULL;
[Severity: Critical]
Could this lead to a use-after-free and double-free during driver removal?
During removal, tegra_dsi_remove() calls tegra_output_remove() which drops
the reference:
drivers/gpu/drm/tegra/output.c:tegra_output_remove() {
if (output->panel)
drm_panel_put(output->panel);
...
}
But output->panel is not set to NULL. Subsequently, mipi_dsi_host_unregister()
calls tegra_dsi_host_detach(), which executes this code:
if (output->panel && &device->dev == output->panel->dev) {
drm_panel_put(output->panel);
Will this dereference the freed output->panel->dev in the condition, and then
drop the kref a second time?
[Severity: Medium]
Also in the Tegra DSI driver, does tegra_dsi_host_attach() leak a reference?
drivers/gpu/drm/tegra/dsi.c:tegra_dsi_host_attach() {
...
output->panel = of_drm_find_panel(device->dev.of_node);
...
}
If tegra_output_probe() already acquired a panel reference and stored it in
output->panel, won't this assignment overwrite the pointer without releasing
the previously acquired reference?
On Monday, July 13, 2026 8:53 PM Albert Esteve wrote:
> Callers of of_drm_find_panel() receive a pointer with no reference
> held, creating a window where the panel device can be unregistered
> and freed between the lookup and first use (e.g., drm_panel_prepare()).
>
> Fix the lookup function by acquiring a reference with drm_panel_get()
> before returning, under panel_lock. Callers are now responsible for
> calling drm_panel_put() when they no longer need the pointer.
>
> For bridge drivers that immediately wrap the panel in a panel_bridge
> (which acquires its own reference), release the lookup reference right
> after the bridge creation call.
>
> For analogix-anx6345, which stores the panel for direct use, release
> the reference in the i2c remove path.
>
> For platform drivers using analogix_dp_core with a component lifecycle
> (exynos_dp, rockchip analogix_dp), release the lookup reference in the
> platform remove() function. The panel_bridge created during bind() holds
> a separate reference that devm cleanup releases after remove() returns.
>
> Also fix devm_drm_of_get_bridge() and drmm_of_get_bridge() in
> bridge/panel.c itself: both call drm_of_find_panel_or_bridge() and
> then pass the panel to devm/drmm_panel_bridge_add(), which acquires
> its own reference via drm_panel_bridge_add_typed(). The lookup
> reference was never released; add drm_panel_put() after each bridge
> creation call.
>
> Assisted-by: Claude:claude-opus-4-6
> Signed-off-by: Albert Esteve <aesteve@redhat.com>
> ---
> drivers/gpu/drm/bridge/analogix/analogix-anx6345.c | 3 +++
> drivers/gpu/drm/bridge/panel.c | 8 ++++++--
> drivers/gpu/drm/drm_of.c | 3 ++-
> drivers/gpu/drm/drm_panel.c | 12 ++++++++----
> drivers/gpu/drm/exynos/exynos_dp.c | 10 ++++++++++
> drivers/gpu/drm/exynos/exynos_drm_dpi.c | 3 +++
> drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c | 18 ++++++++++++++++++
> drivers/gpu/drm/logicvc/logicvc_interface.c | 12 ++++++++++++
> drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 11 +++++++++++
> drivers/gpu/drm/sti/sti_dvo.c | 3 +++
> drivers/gpu/drm/stm/lvds.c | 3 +++
> drivers/gpu/drm/sun4i/sun4i_lvds.c | 13 +++++++++++++
> drivers/gpu/drm/sun4i/sun4i_rgb.c | 13 +++++++++++++
> drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 2 ++
> drivers/gpu/drm/tegra/dsi.c | 1 +
> drivers/gpu/drm/tegra/output.c | 3 +++
> 16 files changed, 111 insertions(+), 7 deletions(-)
>
> ...
> diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
> index 7f25c50621c94..57a016f47434d 100644
> --- a/drivers/gpu/drm/tegra/dsi.c
> +++ b/drivers/gpu/drm/tegra/dsi.c
> @@ -1516,6 +1516,7 @@ static int tegra_dsi_host_detach(struct mipi_dsi_host *host,
> struct tegra_output *output = &dsi->output;
>
> if (output->panel && &device->dev == output->panel->dev) {
> + drm_panel_put(output->panel);
> output->panel = NULL;
>
> if (output->connector.dev)
> diff --git a/drivers/gpu/drm/tegra/output.c b/drivers/gpu/drm/tegra/output.c
> index 49e4f63a5550d..90db39dbdd332 100644
> --- a/drivers/gpu/drm/tegra/output.c
> +++ b/drivers/gpu/drm/tegra/output.c
> @@ -195,6 +195,9 @@ int tegra_output_probe(struct tegra_output *output)
>
> void tegra_output_remove(struct tegra_output *output)
> {
> + if (output->panel)
> + drm_panel_put(output->panel);
> +
> if (output->hpd_gpio)
> free_irq(output->hpd_irq, output);
>
>
tegra_output_probe's error cleanup paths need to be updated to clean up
the refcount. Also, it can technically call drm_of_find_panel_or_bridge
and then overwrite that value with of_drm_find_panel. While there's
already a WARN_ON for that case, I think it would be good to fix the
refcounting there as well for consistency.
As a note, the tegra-dsi code also uses tegra_output and can overwrite
the panel field with its own -- but in those cases tegra_output should
never populate the panel and we've been talking about removing that
code path anyway, so the dsi code can continue to assume that
tegra_output_probe doesn't populate a panel.
Cheers
Mikko
> --
> 2.54.0
>
>
On Wed, Jul 15, 2026 at 9:14 AM Mikko Perttunen <mperttunen@nvidia.com> wrote:
>
> On Monday, July 13, 2026 8:53 PM Albert Esteve wrote:
> > Callers of of_drm_find_panel() receive a pointer with no reference
> > held, creating a window where the panel device can be unregistered
> > and freed between the lookup and first use (e.g., drm_panel_prepare()).
> >
> > Fix the lookup function by acquiring a reference with drm_panel_get()
> > before returning, under panel_lock. Callers are now responsible for
> > calling drm_panel_put() when they no longer need the pointer.
> >
> > For bridge drivers that immediately wrap the panel in a panel_bridge
> > (which acquires its own reference), release the lookup reference right
> > after the bridge creation call.
> >
> > For analogix-anx6345, which stores the panel for direct use, release
> > the reference in the i2c remove path.
> >
> > For platform drivers using analogix_dp_core with a component lifecycle
> > (exynos_dp, rockchip analogix_dp), release the lookup reference in the
> > platform remove() function. The panel_bridge created during bind() holds
> > a separate reference that devm cleanup releases after remove() returns.
> >
> > Also fix devm_drm_of_get_bridge() and drmm_of_get_bridge() in
> > bridge/panel.c itself: both call drm_of_find_panel_or_bridge() and
> > then pass the panel to devm/drmm_panel_bridge_add(), which acquires
> > its own reference via drm_panel_bridge_add_typed(). The lookup
> > reference was never released; add drm_panel_put() after each bridge
> > creation call.
> >
> > Assisted-by: Claude:claude-opus-4-6
> > Signed-off-by: Albert Esteve <aesteve@redhat.com>
> > ---
> > drivers/gpu/drm/bridge/analogix/analogix-anx6345.c | 3 +++
> > drivers/gpu/drm/bridge/panel.c | 8 ++++++--
> > drivers/gpu/drm/drm_of.c | 3 ++-
> > drivers/gpu/drm/drm_panel.c | 12 ++++++++----
> > drivers/gpu/drm/exynos/exynos_dp.c | 10 ++++++++++
> > drivers/gpu/drm/exynos/exynos_drm_dpi.c | 3 +++
> > drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c | 18 ++++++++++++++++++
> > drivers/gpu/drm/logicvc/logicvc_interface.c | 12 ++++++++++++
> > drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 11 +++++++++++
> > drivers/gpu/drm/sti/sti_dvo.c | 3 +++
> > drivers/gpu/drm/stm/lvds.c | 3 +++
> > drivers/gpu/drm/sun4i/sun4i_lvds.c | 13 +++++++++++++
> > drivers/gpu/drm/sun4i/sun4i_rgb.c | 13 +++++++++++++
> > drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 2 ++
> > drivers/gpu/drm/tegra/dsi.c | 1 +
> > drivers/gpu/drm/tegra/output.c | 3 +++
> > 16 files changed, 111 insertions(+), 7 deletions(-)
> >
> > ...
> > diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
> > index 7f25c50621c94..57a016f47434d 100644
> > --- a/drivers/gpu/drm/tegra/dsi.c
> > +++ b/drivers/gpu/drm/tegra/dsi.c
> > @@ -1516,6 +1516,7 @@ static int tegra_dsi_host_detach(struct mipi_dsi_host *host,
> > struct tegra_output *output = &dsi->output;
> >
> > if (output->panel && &device->dev == output->panel->dev) {
> > + drm_panel_put(output->panel);
> > output->panel = NULL;
> >
> > if (output->connector.dev)
> > diff --git a/drivers/gpu/drm/tegra/output.c b/drivers/gpu/drm/tegra/output.c
> > index 49e4f63a5550d..90db39dbdd332 100644
> > --- a/drivers/gpu/drm/tegra/output.c
> > +++ b/drivers/gpu/drm/tegra/output.c
> > @@ -195,6 +195,9 @@ int tegra_output_probe(struct tegra_output *output)
> >
> > void tegra_output_remove(struct tegra_output *output)
> > {
> > + if (output->panel)
> > + drm_panel_put(output->panel);
> > +
> > if (output->hpd_gpio)
> > free_irq(output->hpd_irq, output);
> >
> >
>
> tegra_output_probe's error cleanup paths need to be updated to clean up
> the refcount. Also, it can technically call drm_of_find_panel_or_bridge
> and then overwrite that value with of_drm_find_panel. While there's
> already a WARN_ON for that case, I think it would be good to fix the
> refcounting there as well for consistency.
Agreed. I really missed those. I am doing another general check in
case I missed similar cases.
>
> As a note, the tegra-dsi code also uses tegra_output and can overwrite
> the panel field with its own -- but in those cases tegra_output should
> never populate the panel and we've been talking about removing that
> code path anyway, so the dsi code can continue to assume that
> tegra_output_probe doesn't populate a panel.
Thanks. I will add a note before of_drm_find_panel() in tegra/dsi.c to clarify.
BR,
Albert
>
> Cheers
> Mikko
>
> > --
> > 2.54.0
> >
> >
>
>
>
>
On Mon, 13 Jul 2026 13:53:06 +0200, Albert Esteve wrote:
> Callers of of_drm_find_panel() receive a pointer with no reference
> held, creating a window where the panel device can be unregistered
> and freed between the lookup and first use (e.g., drm_panel_prepare()).
>
> Fix the lookup function by acquiring a reference with drm_panel_get()
>
> [ ... ]
Acked-by: Maxime Ripard <mripard@kernel.org>
Thanks!
Maxime
@@ -756,6 +756,9 @@ static void anx6345_i2c_remove(struct i2c_client *client)
{
struct anx6345 *anx6345 = i2c_get_clientdata(client);
+ if (anx6345->panel)
+ drm_panel_put(anx6345->panel);
+
drm_bridge_remove(&anx6345->bridge);
unregister_i2c_dummy_clients(anx6345);
@@ -513,8 +513,10 @@ struct drm_bridge *devm_drm_of_get_bridge(struct device *dev,
if (ret)
return ERR_PTR(ret);
- if (panel)
+ if (panel) {
bridge = devm_drm_panel_bridge_add(dev, panel);
+ drm_panel_put(panel);
+ }
return bridge;
}
@@ -547,8 +549,10 @@ struct drm_bridge *drmm_of_get_bridge(struct drm_device *drm,
if (ret)
return ERR_PTR(ret);
- if (panel)
+ if (panel) {
bridge = drmm_panel_bridge_add(drm, panel);
+ drm_panel_put(panel);
+ }
return bridge;
}
@@ -225,7 +225,8 @@ EXPORT_SYMBOL_GPL(drm_of_encoder_active_endpoint);
* @np: device tree node containing encoder output ports
* @port: port in the device tree node
* @endpoint: endpoint in the device tree node
- * @panel: pointer to hold returned drm_panel, must not be NULL
+ * @panel: pointer to hold returned drm_panel, must not be NULL. On success
+ * the caller must call drm_panel_put() when done with the panel
* @bridge: pointer to hold returned drm_bridge
*
* Given a DT node's port and endpoint number, find the connected node and
@@ -458,14 +458,17 @@ EXPORT_SYMBOL(__devm_drm_panel_alloc);
#ifdef CONFIG_OF
/**
- * of_drm_find_panel - look up a panel using a device tree node
+ * of_drm_find_panel - look up and reference a panel by device tree node
* @np: device tree node of the panel
*
* Searches the set of registered panels for one that matches the given device
- * tree node. If a matching panel is found, return a pointer to it.
+ * tree node. If a matching panel is found, the panel's reference count is
+ * incremented before returning a pointer to it. The caller must call
+ * drm_panel_put() when it no longer needs the panel pointer.
*
- * Return: A pointer to the panel registered for the specified device tree
- * node or an ERR_PTR() if no panel matching the device tree node can be found.
+ * Return: A reference-counted pointer to the panel registered for the specified
+ * device tree node or an ERR_PTR() if no panel matching the device tree node
+ * can be found.
*
* Possible error codes returned by this function:
*
@@ -484,6 +487,7 @@ struct drm_panel *of_drm_find_panel(const struct device_node *np)
list_for_each_entry(panel, &panel_list, list) {
if (panel->dev->of_node == np) {
+ drm_panel_get(panel);
mutex_unlock(&panel_lock);
return panel;
}
@@ -193,6 +193,16 @@ static int exynos_dp_probe(struct platform_device *pdev)
static void exynos_dp_remove(struct platform_device *pdev)
{
+ struct exynos_dp_device *dp = platform_get_drvdata(pdev);
+
+ /*
+ * Release the probe-time reference from of_drm_find_panel(). If bind
+ * ran, the panel_bridge holds a second reference that devm cleanup
+ * will release when the bridge is destroyed after remove() returns.
+ */
+ if (dp->plat_data.panel)
+ drm_panel_put(dp->plat_data.panel);
+
component_del(&pdev->dev, &exynos_dp_ops);
}
@@ -245,5 +245,8 @@ int exynos_dpi_remove(struct drm_encoder *encoder)
exynos_dpi_disable(&ctx->encoder);
+ if (ctx->panel)
+ drm_panel_put(ctx->panel);
+
return 0;
}
@@ -109,6 +109,13 @@ static int fsl_dcu_attach_panel(struct fsl_dcu_drm_device *fsl_dev,
return ret;
}
+static void fsl_dcu_panel_put_action(void *data)
+{
+ struct drm_panel *panel = data;
+
+ drm_panel_put(panel);
+}
+
int fsl_dcu_create_outputs(struct fsl_dcu_drm_device *fsl_dev)
{
struct device_node *panel_node;
@@ -124,6 +131,12 @@ int fsl_dcu_create_outputs(struct fsl_dcu_drm_device *fsl_dev)
if (IS_ERR(fsl_dev->connector.panel))
return PTR_ERR(fsl_dev->connector.panel);
+ ret = devm_add_action_or_reset(fsl_dev->dev,
+ fsl_dcu_panel_put_action,
+ fsl_dev->connector.panel);
+ if (ret)
+ return ret;
+
return fsl_dcu_attach_panel(fsl_dev, fsl_dev->connector.panel);
}
@@ -132,6 +145,11 @@ int fsl_dcu_create_outputs(struct fsl_dcu_drm_device *fsl_dev)
return ret;
if (panel) {
+ ret = devm_add_action_or_reset(fsl_dev->dev,
+ fsl_dcu_panel_put_action, panel);
+ if (ret)
+ return ret;
+
fsl_dev->connector.panel = panel;
return fsl_dcu_attach_panel(fsl_dev, panel);
}
@@ -28,6 +28,11 @@
#define logicvc_interface_from_drm_connector(c) \
container_of(c, struct logicvc_interface, drm_connector)
+static void logicvc_panel_put_action(void *data)
+{
+ drm_panel_put(data);
+}
+
static void logicvc_encoder_enable(struct drm_encoder *drm_encoder)
{
struct logicvc_drm *logicvc = logicvc_drm(drm_encoder->dev);
@@ -160,6 +165,13 @@ int logicvc_interface_init(struct logicvc_drm *logicvc)
if (ret == -EPROBE_DEFER)
goto error_early;
+ if (interface->drm_panel) {
+ ret = devm_add_action_or_reset(dev, logicvc_panel_put_action,
+ interface->drm_panel);
+ if (ret)
+ goto error_early;
+ }
+
ret = drm_encoder_init(drm_dev, &interface->drm_encoder,
&logicvc_encoder_funcs, encoder_type, NULL);
if (ret) {
@@ -27,6 +27,7 @@
#include <drm/drm_bridge_connector.h>
#include <drm/bridge/analogix_dp.h>
#include <drm/drm_of.h>
+#include <drm/drm_panel.h>
#include <drm/drm_print.h>
#include <drm/drm_probe_helper.h>
#include <drm/drm_simple_kms_helper.h>
@@ -472,6 +473,16 @@ static int rockchip_dp_probe(struct platform_device *pdev)
static void rockchip_dp_remove(struct platform_device *pdev)
{
+ struct rockchip_dp_device *dp = platform_get_drvdata(pdev);
+
+ /*
+ * Release the probe-time reference from of_drm_find_panel(). If bind
+ * ran, the panel_bridge holds a second reference that devm cleanup
+ * will release when the bridge is destroyed after remove() returns.
+ */
+ if (dp->plat_data.panel)
+ drm_panel_put(dp->plat_data.panel);
+
component_del(&pdev->dev, &rockchip_dp_component_ops);
}
@@ -492,6 +492,9 @@ static void sti_dvo_unbind(struct device *dev,
{
struct sti_dvo *dvo = dev_get_drvdata(dev);
+ if (dvo->panel)
+ drm_panel_put(dvo->panel);
+
drm_bridge_remove(&dvo->bridge);
}
@@ -1189,6 +1189,9 @@ static void lvds_remove(struct platform_device *pdev)
{
struct stm_lvds *lvds = platform_get_drvdata(pdev);
+ if (lvds->panel)
+ drm_panel_put(lvds->panel);
+
lvds_pixel_clk_unregister(lvds);
drm_bridge_remove(&lvds->lvds_bridge);
@@ -18,6 +18,11 @@
#include "sun4i_tcon.h"
#include "sun4i_lvds.h"
+static void sun4i_panel_put_action(void *data)
+{
+ drm_panel_put(data);
+}
+
struct sun4i_lvds {
struct drm_connector connector;
struct drm_encoder encoder;
@@ -113,6 +118,14 @@ int sun4i_lvds_init(struct drm_device *drm, struct sun4i_tcon *tcon)
return 0;
}
+ if (lvds->panel) {
+ ret = devm_add_action_or_reset(tcon->dev,
+ sun4i_panel_put_action,
+ lvds->panel);
+ if (ret)
+ return ret;
+ }
+
drm_encoder_helper_add(&lvds->encoder,
&sun4i_lvds_enc_helper_funcs);
ret = drm_simple_encoder_init(drm, &lvds->encoder,
@@ -43,6 +43,11 @@ drm_encoder_to_sun4i_rgb(struct drm_encoder *encoder)
encoder);
}
+static void sun4i_panel_put_action(void *data)
+{
+ drm_panel_put(data);
+}
+
static int sun4i_rgb_get_modes(struct drm_connector *connector)
{
struct sun4i_rgb *rgb =
@@ -205,6 +210,14 @@ int sun4i_rgb_init(struct drm_device *drm, struct sun4i_tcon *tcon)
return 0;
}
+ if (rgb->panel) {
+ ret = devm_add_action_or_reset(tcon->dev,
+ sun4i_panel_put_action,
+ rgb->panel);
+ if (ret)
+ return ret;
+ }
+
drm_encoder_helper_add(&rgb->encoder,
&sun4i_rgb_enc_helper_funcs);
ret = drm_simple_encoder_init(drm, &rgb->encoder,
@@ -985,6 +985,8 @@ static int sun6i_dsi_detach(struct mipi_dsi_host *host,
{
struct sun6i_dsi *dsi = host_to_sun6i_dsi(host);
+ if (dsi->panel)
+ drm_panel_put(dsi->panel);
dsi->panel = NULL;
dsi->device = NULL;
@@ -1516,6 +1516,7 @@ static int tegra_dsi_host_detach(struct mipi_dsi_host *host,
struct tegra_output *output = &dsi->output;
if (output->panel && &device->dev == output->panel->dev) {
+ drm_panel_put(output->panel);
output->panel = NULL;
if (output->connector.dev)
@@ -195,6 +195,9 @@ int tegra_output_probe(struct tegra_output *output)
void tegra_output_remove(struct tegra_output *output)
{
+ if (output->panel)
+ drm_panel_put(output->panel);
+
if (output->hpd_gpio)
free_irq(output->hpd_irq, output);