Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Early HPD interrupt can cause a NULL pointer dereference of `hdmi->bridge.dev` if it fires before `drm_bridge_attach` completes. -- commit 1a1229643b989df67626f64f580add186cebd6ed Author: Michal Wilczynski <[email protected]> drm/bridge: inno-hdmi: Allow the register map to come from a parent On some SoCs the HDMI controller does not own its register window. The StarFive JH7110 documents one 64 KB block, u0_hdmitx, that holds both the controller and the PHY, so the parent device maps it and owns the regmap while the two children share it. > diff --git a/drivers/gpu/drm/bridge/inno-hdmi.c > b/drivers/gpu/drm/bridge/inno-hdmi.c > index aab474740f7f5..8bd7717611804 100644 > --- a/drivers/gpu/drm/bridge/inno-hdmi.c > +++ b/drivers/gpu/drm/bridge/inno-hdmi.c [ ... ] > @@ -1095,9 +1110,19 @@ struct inno_hdmi *inno_hdmi_probe(struct > platform_device *pdev, > hdmi->dev = dev; > hdmi->plat_data = plat_data; > > - hdmi->regs = devm_platform_ioremap_resource(pdev, 0); > - if (IS_ERR(hdmi->regs)) > - return ERR_CAST(hdmi->regs); > + /* > + * On platforms where the controller shares a register space with > + * other blocks, the parent owns the regmap. Fall back to mapping > + * our own resource where it does not. > + */ > + if (dev->parent) > + hdmi->regmap = dev_get_regmap(dev->parent, NULL); > + > + if (!hdmi->regmap) { > + hdmi->regs = devm_platform_ioremap_resource(pdev, 0); > + if (IS_ERR(hdmi->regs)) > + return ERR_CAST(hdmi->regs); > + } > > hdmi->pclk = devm_clk_get_enabled(hdmi->dev, "pclk"); > if (IS_ERR(hdmi->pclk)) { [Severity: High] This is a pre-existing issue, but could this code trigger a NULL pointer dereference if the hotplug interrupt fires early? Looking at the rest of inno_hdmi_probe(), the hardware interrupt is unmuted in inno_hdmi_init_hw(), and then the handler is registered: inno_hdmi_init_hw(hdmi); ... ret = devm_request_threaded_irq(dev, irq, inno_hdmi_hardirq, inno_hdmi_irq, IRQF_SHARED, dev_name(dev), hdmi); If a cable is already connected or plugged in at this exact moment, the interrupt can fire immediately. The threaded handler inno_hdmi_irq() will then execute: drm_helper_hpd_irq_event(hdmi->bridge.dev); However, hdmi->bridge.dev appears to be NULL at this point, as it is only populated later when the upstream display controller calls drm_bridge_attach(). Is there something preventing this race condition, or should the IRQ handler registration be deferred? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=8
