Calling drm_connector_cleanup() should only be done via the free_cb => .destroy path, which cleans up the struct drm_connector only when the refcount drops to zero. A cleanup done with a refcount higher than 0 can result from buggy code, e.g. by doing cleanup directly in the drivers teardown code. Serious trouble can happen if this happens, so warn about it. Signed-off-by: Luca Ceresoli <luca.ceresoli@xxxxxxxxxxx> --- drivers/gpu/drm/drm_connector.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c index fc35f47e2849ed6786d6223ac9c69e1c359fc648..e0bf9c490af43055de4caaee1580a4befbd608c5 100644 --- a/drivers/gpu/drm/drm_connector.c +++ b/drivers/gpu/drm/drm_connector.c @@ -624,6 +624,12 @@ void drm_connector_cleanup(struct drm_connector *connector) struct drm_device *dev = connector->dev; struct drm_display_mode *mode, *t; + /* + * Cleanup must happen when the last ref is put, via the + * drm_connector_free() callback. + */ + WARN_ON(drm_mode_object_read_refcount(&connector->base) != 0); + /* The connector should have been removed from userspace long before * it is finally destroyed. */ -- 2.34.1
