Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] The dynamically allocated `output_fmts` array is leaked when no matching bus formats are found. -- --- Patch [4]: [PATCH v5 04/15] drm/bridge: synopsys: dw-dp: Move dw_dp_bridge_atomic_get_output_bus_fmts() --- commit c989bc992dcfd432abf52123b03475b9fb318ca0 Author: Sebastian Reichel <[email protected]> drm/bridge: synopsys: dw-dp: Move dw_dp_bridge_atomic_get_output_bus_fmts() This commit moves dw_dp_bridge_atomic_get_output_bus_fmts() before dw_dp_bridge_atomic_check() in preparation for reusing it. No functional changes are intended. > diff --git a/drivers/gpu/drm/bridge/synopsys/dw-dp.c > b/drivers/gpu/drm/bridge/synopsys/dw-dp.c > index b28040d69fabf..3dec7777fb285 100644 > --- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c > +++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c [ ... ] > @@ -1522,6 +1522,54 @@ static ssize_t dw_dp_aux_transfer(struct drm_dp_aux > *aux, > * 2. the minimum hsync should be 9 pixel; > * 3. the minimum hbp should be 16 pixel; > */ > +static u32 *dw_dp_bridge_atomic_get_output_bus_fmts(struct drm_bridge > *bridge, > + struct drm_bridge_state > *bridge_state, > + struct drm_crtc_state > *crtc_state, > + struct drm_connector_state > *conn_state, > + unsigned int > *num_output_fmts) > +{ [ ... ] > + output_fmts = kcalloc(ARRAY_SIZE(dw_dp_output_formats), > sizeof(*output_fmts), GFP_KERNEL); > + if (!output_fmts) > + return NULL; > + > + for (i = 0; i < ARRAY_SIZE(dw_dp_output_formats); i++) { [ ... ] > + if (!dw_dp_bandwidth_ok(dp, &mode, fmt->bpp, link->lanes, > link->rate)) > + continue; > + > + output_fmts[j++] = fmt->bus_format; > + } > + > + *num_output_fmts = j; > + > + return output_fmts; [Severity: High] This isn't a bug introduced by this patch, but does this code leak the dynamically allocated output_fmts array when no formats match? If a display mode has a very high pixel clock, dw_dp_bandwidth_ok() might return false for all formats, leaving j as 0. The function then sets *num_output_fmts = 0 and returns the allocated output_fmts array. In the DRM core, if drm_atomic_bridge_chain_select_bus_fmts() receives 0 in num_out_bus_fmts, it immediately returns -ENOTSUPP without calling kfree() on the returned pointer. Since this can be repeatedly triggered via the atomic test ioctl by a process with DRM Master privileges, could this be exploited to exhaust memory? > +} [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/20260724-synopsys-dw-dp-improvements-v5-0-9445c2e87...@collabora.com?part=4
