Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Component bind/unbind lifetime mismatch leading to Use-After-Free and resource leaks. -- commit 53ed72bcdde7f86deb352e52bb664f24f880b84c Author: Cristian Ciocaltea <[email protected]> drm/rockchip: dw_hdmi_qp: Use local dev variable consistently in bind() This patch updates dw_hdmi_qp_rockchip_bind() to use the local dev parameter instead of indirect struct device accesses. This improves consistency and readability throughout the function. > diff --git a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c > b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c > index 7bd0f6dcbe5dc..d2fcfa70ed168 100644 > --- a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c > +++ b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c [ ... ] > @@ -671,7 +670,7 @@ static int dw_hdmi_qp_rockchip_bind(struct device *dev, > struct device *master, > if (irq < 0) > return irq; > > - ret = devm_request_threaded_irq(hdmi->dev, irq, > + ret = devm_request_threaded_irq(dev, irq, > cfg->ctrl_ops->hardirq_callback, > cfg->ctrl_ops->irq_callback, > IRQF_SHARED, "dw-hdmi-qp-hpd", > hdmi); [Severity: High] This is a pre-existing issue, but could this lifetime mismatch between the component device and the DRM master lead to a use-after-free? The hdmi context is allocated earlier in dw_hdmi_qp_rockchip_bind() using drmm_kzalloc(), which ties its lifetime to the DRM master device: hdmi = drmm_kzalloc(drm, sizeof(*hdmi), GFP_KERNEL); However, the HPD interrupt is requested using devm_request_threaded_irq() with the component device (dev). If the master DRM device is unbound, the hdmi context will be freed automatically. Looking at dw_hdmi_qp_rockchip_unbind(), it only cancels the delayed work but lacks manual cleanup of the IRQ: static void dw_hdmi_qp_rockchip_unbind(struct device *dev, struct device *master, void *data) { struct rockchip_hdmi_qp *hdmi = dev_get_drvdata(dev); cancel_delayed_work_sync(&hdmi->hpd_work); } If the HPD interrupt fires after the master DRM device is unbound but before the component device is unbound, the dangling interrupt handler will execute with a freed hdmi pointer. Is it possible to tie the IRQ lifetime to the DRM master or explicitly free it in the unbind path? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=22
