The rockchip_dp_bind() returns without unwinding analogix_dp_bind() when drm_bridge_connector_init() fails. The aux device registered by analogix_dp_bind() is then left behind with a dangling drm_dev pointer, which could be accessed on later AUX transfers.
Call analogix_dp_unbind() in the error path to release the aux device. Signed-off-by: Damon Ding <[email protected]> --- drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c index 38c78360842f..e6310d66e8e3 100644 --- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c +++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c @@ -419,6 +419,7 @@ static int rockchip_dp_bind(struct device *dev, struct device *master, if (IS_ERR(connector)) { ret = PTR_ERR(connector); dev_err(dp->dev, "Failed to initialize bridge_connector\n"); + analogix_dp_unbind(dp->adp); goto err_cleanup_encoder; } -- 2.34.1
