Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Missing `disable_irq()` or `devm_free_irq()` in component `unbind()` leaves the HPD IRQ enabled, causing a Use-After-Free of the `hdmi` struct if an interrupt fires after the DRM device is torn down. -- commit ed0ca175c20c7a0b231242e1a45aec15890b9c5d Author: Cristian Ciocaltea <[email protected]> drm/rockchip: dw_hdmi_qp: Defer HPD IRQ enable until after connector setup This commit defers enabling the HPD IRQ until the end of the initialization sequence by using IRQF_NO_AUTOEN and calling enable_irq() later. It also removes the incompatible IRQF_SHARED flag. > diff --git a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c > b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c > index 33036f194e348..3de4b3e6ea85e 100644 > --- a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c > +++ b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c [ ... ] > @@ -694,6 +694,8 @@ static int dw_hdmi_qp_rockchip_bind(struct device *dev, > struct device *master, > return dev_err_probe(dev, PTR_ERR(connector), > "Failed to init bridge connector\n"); > > + enable_irq(irq); > + > return 0; > } [Severity: High] This is a pre-existing issue, but does the hardware IRQ remain enabled after component unbind? Since the IRQ is requested with devm_request_threaded_irq(), it won't be freed until driver detach. However, when the component is unbound (e.g., via sysfs), dw_hdmi_qp_rockchip_unbind() is called: static void dw_hdmi_qp_rockchip_unbind(struct device *dev, ...) { struct rockchip_hdmi_qp *hdmi = dev_get_drvdata(dev); cancel_delayed_work_sync(&hdmi->hpd_work); } This cancels the delayed work but does not disable the IRQ. After unbind, the DRM master completes teardown and frees the hdmi struct (which was allocated via drmm_kzalloc). If a physical HDMI hotplug event occurs after unbind, could the hardirq handler dw_hdmi_qp_rk3588_hardirq() execute and dereference the freed hdmi->regmap, causing a use-after-free? Should dw_hdmi_qp_rockchip_unbind() include a matching disable_irq() or devm_free_irq() to prevent the interrupt from firing after teardown? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=24
