Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Use-After-Free of devm-managed resources (hpd_gpio, hpd_irq) and locking of destroyed mutexes during driver unbind. -- --- Patch [1]: [PATCH v2] drm/bridge: display-connector: Fix I2C adapter resource leak --- commit 2b26eaff927cdb68a6ad11049169cdda7d66a1f8 Author: Laurent Pinchart <[email protected]> drm/bridge: display-connector: Fix I2C adapter resource leak This commit moves the release of the I2C adapter to the bridge .destroy() handler to fix a reference leak when probe fails after getting the DDC adapter. > diff --git a/drivers/gpu/drm/bridge/display-connector.c > b/drivers/gpu/drm/bridge/display-connector.c > --- a/drivers/gpu/drm/bridge/display-connector.c > +++ b/drivers/gpu/drm/bridge/display-connector.c [ ... ] > @@ -439,9 +447,6 @@ static void display_connector_remove(struct > platform_device *pdev) > regulator_disable(conn->supply); > > drm_bridge_remove(&conn->bridge); [Severity: High] This is a pre-existing issue, but does the bridge removal sequence leave devm-managed resources vulnerable to a use-after-free? If the driver is unbound while the bridge is still attached to a DRM encoder, drm_bridge_remove() destroys bridge->hpd_mutex and moves the bridge to a lingering list. Because hpd_gpio and hpd_irq are devm-managed, devres will free them as soon as display_connector_remove() returns. Could an incoming HPD interrupt fire right after drm_bridge_remove() and try to lock the destroyed bridge->hpd_mutex via drm_bridge_hpd_notify()? Additionally, if the DRM core later calls display_connector_detect() or display_connector_hpd_disable() on the lingering bridge, would it result in a use-after-free when accessing the freed conn->hpd_gpio or conn->hpd_irq? > - > - if (!IS_ERR(conn->bridge.ddc)) > - i2c_put_adapter(conn->bridge.ddc); > } > > static const struct of_device_id display_connector_match[] = { -- Sashiko AI review ยท https://sashiko.dev/#/patchset/20260717184836.2017386-1-laurent.pinchart+rene...@ideasonboard.com?part=1
