Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] If `drm_dev_enter` fails in `vc4_hdmi_encoder_post_crtc_disable` (e.g., when the device is unbound or unplugged), the function jumps to the `out` label and skips calling `drm_connector_hdmi_disable_scrambling()`. This leaves the `connector->hdmi.scdc_work` delayed work pending. Since `drm_connector_cleanup()` does not natively cancel this work, it will execute after the connector memory has been zeroed and freed, causing a use-after-free and kernel crash. -- commit b7c6215b3f661e126a4a4477a77ead5d481367d2 Author: Cristian Ciocaltea <[email protected]> drm/vc4: hdmi: Convert to common SCDC scrambling infrastructure This commit converts the vc4 HDMI driver to use the common HDMI 2.0 scrambling infrastructure. It removes the local scrambling workqueue and state tracking, relying instead on the shared drm_connector_hdmi layer functions. > diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c > --- a/drivers/gpu/drm/vc4/vc4_hdmi.c > +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c > @@ -909,7 +738,7 @@ static void vc4_hdmi_encoder_post_crtc_disable(struct > drm_encoder *encoder, > spin_unlock_irqrestore(&vc4_hdmi->hw_lock, flags); > } > > - vc4_hdmi_disable_scrambling(encoder); > + drm_connector_hdmi_disable_scrambling(&vc4_hdmi->connector); > > drm_dev_exit(idx); [Severity: High] This is a pre-existing issue, but does skipping this function leave a pending delayed work if device access is lost? Looking at vc4_hdmi_encoder_post_crtc_disable(), if drm_dev_enter() fails, the function jumps to the out label: if (!drm_dev_enter(drm, &idx)) goto out; ... drm_connector_hdmi_disable_scrambling(&vc4_hdmi->connector); drm_dev_exit(idx); out: mutex_unlock(&vc4_hdmi->mutex); If drm_connector_hdmi_disable_scrambling() is skipped because drm_dev_enter() failed, the connector->hdmi.scdc_work delayed work is never cancelled. Since drm_connector_cleanup() does not cancel this work, will it execute after the connector is freed and cause a use-after-free when the timer fires? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=31
