Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] drm/bridge: imx8mp-hdmi-pvi: double-put of next_bridge on unbind --
commit 86a7e8c2747f218e207c0b6519ab1f7729f32712 Author: Wentao Liang <[email protected]> drm/bridge: imx8mp-hdmi-pvi: Fix next_bridge reference leak This commit adds a call to drm_bridge_put() in the driver unbind path to release the reference to the next bridge in the pipeline. > diff --git a/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c > b/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c > index a31d4fc76f35b..c71319bb68f4b 100644 > --- a/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c > +++ b/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c > @@ -179,6 +179,7 @@ static void imx8mp_hdmi_pvi_remove(struct platform_device > *pdev) > struct imx8mp_hdmi_pvi *pvi = platform_get_drvdata(pdev); > > drm_bridge_remove(&pvi->bridge); > + drm_bridge_put(pvi->bridge.next_bridge); [Severity: High] Does this introduce a double-put of the next_bridge object? When the device is unbound, devres triggers the cleanup for pvi->bridge which was allocated with devm_drm_bridge_alloc(). When its refcount drops to zero, the DRM core calls __drm_bridge_free(), which automatically releases next_bridge: drivers/gpu/drm/drm_bridge.c:__drm_bridge_free() { ... drm_bridge_put(bridge->next_bridge); ... } By adding a manual drm_bridge_put() here without clearing the pointer, won't __drm_bridge_free() drop the reference a second time and potentially cause a use-after-free? > > pm_runtime_disable(&pdev->dev); > } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
