Thank you for your contribution! Sashiko AI review found 1 potential issue(s) 
to consider:

Pre-existing issues:
- [High] Double-free of I2C adapter device and module references during driver 
unbind due to conflicting manual and devm cleanups.
--

--- Patch [1]: [PATCH] drm/mediatek: mtk_hdmi_common: take i2c adapter module 
reference ---
commit cbad79e276722919c8f55731b14f0b51837c5548
Author: Johan Hovold <[email protected]>

drm/mediatek: mtk_hdmi_common: take i2c adapter module reference

The patch switches to of_get_i2c_adapter_by_node() which grabs a
module reference, allowing graceful module unload failures instead
of uninterruptible blocking. It updates the devm action to call
mtk_hdmi_put_adapter which wraps i2c_put_adapter.

> diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi_common.c 
> b/drivers/gpu/drm/mediatek/mtk_hdmi_common.c
> index a049489daa2d7..042b98e5a5199 100644
> --- a/drivers/gpu/drm/mediatek/mtk_hdmi_common.c
> +++ b/drivers/gpu/drm/mediatek/mtk_hdmi_common.c
[ ... ]
> @@ -328,12 +335,12 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi 
> *hdmi, struct platform_device
>       if (!i2c_np)
>               return dev_err_probe(dev, -EINVAL, "No ddc-i2c-bus in 
> connector\n");
>  
> -     hdmi->ddc_adpt = of_find_i2c_adapter_by_node(i2c_np);
> +     hdmi->ddc_adpt = of_get_i2c_adapter_by_node(i2c_np);
>       of_node_put(i2c_np);
>       if (!hdmi->ddc_adpt)
>               return dev_err_probe(dev, -EPROBE_DEFER, "Failed to get ddc i2c 
> adapter by node\n");
>  
> -     ret = devm_add_action_or_reset(dev, mtk_hdmi_put_device, 
> &hdmi->ddc_adpt->dev);
> +     ret = devm_add_action_or_reset(dev, mtk_hdmi_put_adapter, 
> hdmi->ddc_adpt);

[Severity: High]
This is a pre-existing issue, but does this devm cleanup conflict with a
manual cleanup during driver unbind?

Looking at mtk_hdmi_v2_remove() in drivers/gpu/drm/mediatek/mtk_hdmi_v2.c,
there is a manual call to i2c_put_adapter(hdmi->ddc_adpt).

When the driver unbinds, mtk_hdmi_v2_remove() will run and release the
adapter. After the remove callback returns, the device core will execute
the devres action registered here. This will invoke mtk_hdmi_put_adapter()
and call i2c_put_adapter() a second time on the same pointer.

Will this result in a double-free of the I2C adapter device and a double
module_put()?

-- 
Sashiko AI review ยท 
https://sashiko.dev/#/patchset/[email protected]?part=1

Reply via email to