Thank you for your contribution! Sashiko AI review found 1 potential issue(s) 
to consider:
- [High] Double-unregister of the `mediatek-dp-phy` platform device on 
`devm_phy_get` failure.
--

--- Patch [7]: [PATCH v2 07/11] drm/mediatek: mtk_dp: Add support for PHY from 
devicetree ---
commit 21392ccaeb903069c1e4a92500d58612e1669daf
Author: AngeloGioacchino Del Regno <[email protected]>
Subject: drm/mediatek: mtk_dp: Add support for PHY from devicetree

This commit adds support for parsing the DisplayPort PHY from the devicetree
via the phys property. For older devicetrees, it falls back to a legacy
configuration by registering a mediatek-dp-phy platform device and reading
legacy PHY calibration data.

> diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c 
> b/drivers/gpu/drm/mediatek/mtk_dp.c
> index b4cb1996a3314..cabfc833c0a80 100644
> --- a/drivers/gpu/drm/mediatek/mtk_dp.c
> +++ b/drivers/gpu/drm/mediatek/mtk_dp.c

[ ... ]

> @@ -2754,6 +2775,7 @@ static int mtk_dp_register_phy(struct mtk_dp *mtk_dp)
>               return dev_err_probe(dev, ret,
>                                    "Failed to add phy unregister devm 
> action");
>  
> +     /* PHY calibration data is in mtk_dp only for legacy devicetree */
>       mtk_dp_get_calibration_data(mtk_dp);
>  
>       mtk_dp->phy = devm_phy_get(&mtk_dp->phy_dev->dev, "dp");

[Severity: High]
Does this code double-unregister the mediatek-dp-phy platform device?

Earlier in mtk_dp_register_phy(), mtk_dp->phy_dev is registered with devres:

        ret = devm_add_action_or_reset(dev, mtk_dp_unregister_pdevs,
                                       mtk_dp->phy_dev);

If devm_phy_get() fails immediately after the lines modified above:

        mtk_dp->phy = devm_phy_get(&mtk_dp->phy_dev->dev, "dp");
        if (IS_ERR(mtk_dp->phy)) {
                platform_device_unregister(mtk_dp->phy_dev);
                return dev_err_probe(dev, PTR_ERR(mtk_dp->phy),
                                     "Failed to get phy\n");
        }

It explicitly calls platform_device_unregister() on the failure path. Since
devres will also execute mtk_dp_unregister_pdevs() (which unregisters the
same device) when probe fails, can this lead to a double-free and list
corruption in the driver core?

-- 
Sashiko AI review ยท 
https://sashiko.dev/#/patchset/[email protected]?part=7

Reply via email to