Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Lifetime mismatch between drmm_ allocated state and devm_ managed resources causes Use-After-Free and resource leaks. -- commit 4f79590505cad08e229d9cf38e2f40905ce2991c Author: Cristian Ciocaltea <[email protected]> drm/rockchip: dw_hdmi_qp: Use dw_hdmi_qp_hpd_notify() for HPD reports Notify only the affected connector instead of polling all of them, and ensure .detect_ctx() runs on reconnect to recover SCDC state. > diff --git a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c > b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c > index 1c547016ee009..f2a1ea8dfefa5 100644 > --- a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c > +++ b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c [ ... ] > @@ -398,14 +397,8 @@ static void dw_hdmi_qp_rk3588_hpd_work(struct > work_struct *work) > struct rockchip_hdmi_qp *hdmi = container_of(work, > struct rockchip_hdmi_qp, > hpd_work.work); > - struct drm_device *drm = hdmi->encoder.encoder.dev; > - bool changed; > > - if (drm) { > - changed = drm_helper_hpd_irq_event(drm); > - if (changed) > - dev_dbg(hdmi->dev, "connector status changed\n"); > - } > + dw_hdmi_qp_hpd_notify(hdmi->hdmi); > } [Severity: High] This is a pre-existing issue, but can the hpd_work or IRQ handler outlive the hdmi structure, leading to a use-after-free here? The hdmi structure is allocated with DRM device lifetime in dw_hdmi_qp_rockchip_bind(): hdmi = drmm_kzalloc(drm, sizeof(*hdmi), GFP_KERNEL); However, the IRQ is registered with platform device lifetime: ret = devm_request_threaded_irq(dev, hdmi->hpd_irq, cfg->ctrl_ops->hardirq_callback, cfg->ctrl_ops->irq_callback, IRQF_NO_AUTOEN, "dw-hdmi-qp-hpd", hdmi); During a component unbind (e.g. via sysfs or EPROBE_DEFER), dw_hdmi_qp_rockchip_unbind() does not explicitly disable the IRQ or unregister the bridge: static void dw_hdmi_qp_rockchip_unbind(struct device *dev, struct device *master, void *data) { struct rockchip_hdmi_qp *hdmi = dev_get_drvdata(dev); dev_set_drvdata(dev, NULL); cancel_delayed_work_sync(&hdmi->hpd_work); } If the DRM device is freed, the hdmi structure is also freed. But because devm_ resources are tied to the platform device (which isn't removed during a component unbind), the IRQ remains active. If a hotplug event fires afterwards, won't it dereference the freed hdmi pointer and cause a panic? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=40
