diff mbox series

[v2,10/11] drm: aspeed: Use devm_of_reserved_mem_device_init()

Message ID 20260902201640.2024648-11-mukesh.ojha@oss.qualcomm.com (mailing list archive)
State New
Headers
Series drm: Use devm_of_reserved_mem_device_init() |

Commit Message

Mukesh Ojha Sept. 2, 2026, 8:16 p.m. UTC 
Use the devres-managed devm_of_reserved_mem_device_init() to ensure
the reserved memory region is released on device removal, fixing a
missing cleanup in the original code.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
 drivers/gpu/drm/aspeed/aspeed_gfx_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

sashiko-bot@kernel.org Sept. 2, 2026, 8:35 p.m. UTC | #1 
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Using devm_of_reserved_mem_device_init ties the reserved memory release to the physical device unbind, which executes before DRM GEM objects are freed. This leads to a kernel panic in dma_free_wc() during driver unload or when userspace closes the device.
--

commit af4228b344b701076f4bd88aa57c810ff4e26c48
Author: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>

drm: aspeed: Use devm_of_reserved_mem_device_init()

This commit replaces of_reserved_mem_device_init() with the devres-managed
devm_of_reserved_mem_device_init() to ensure the reserved memory region is
released on device removal.

> diff --git a/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c b/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c
> index d4577663a1f0e..2c7e54fc35d93 100644
> --- a/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c
> +++ b/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c
> @@ -168,7 +168,7 @@ static int aspeed_gfx_load(struct drm_device *drm)
>  		}
>  	}
>  
> -	ret = of_reserved_mem_device_init(drm->dev);
> +	ret = devm_of_reserved_mem_device_init(drm->dev);

[Severity: High]
Will tying the reserved memory release to the physical device unbind phase
cause a kernel panic if a user holds an open DRM file descriptor?

The devm_of_reserved_mem_device_init() cleanup runs when the platform device
unbinds, calling of_reserved_mem_device_release() which clears dev->dma_mem.

However, if userspace holds an open DRM file descriptor, the DRM device and
its GEM objects outlive the platform device's devres cleanup phase. When the
user eventually closes the file descriptor, the GEM objects are freed.

At that point, drm_gem_dma_free() calls dma_free_wc(), which relies on
dev->dma_mem to identify the reserved memory pool. Since dev->dma_mem was
already cleared during the unbind devres cleanup, it falls back to the system
page allocator, which results in a kernel panic.

>  	if (ret) {
>  		dev_err(&pdev->dev,
>  			"failed to initialize reserved mem: %d\n", ret);
diff mbox series

Patch

diff --git a/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c b/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c
index d4577663a1f0..2c7e54fc35d9 100644
--- a/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c
+++ b/drivers/gpu/drm/aspeed/aspeed_gfx_drv.c
@@ -168,7 +168,7 @@  static int aspeed_gfx_load(struct drm_device *drm)
 		}
 	}
 
-	ret = of_reserved_mem_device_init(drm->dev);
+	ret = devm_of_reserved_mem_device_init(drm->dev);
 	if (ret) {
 		dev_err(&pdev->dev,
 			"failed to initialize reserved mem: %d\n", ret);