On Tue Oct 13, 2026 at 5:35 PM CEST, sashiko-bot wrote: > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) > to consider: > - [Medium] drm/vc4: reference leak of next_bridge on component unbind/rebind > -- > > commit 01a94378aeae8cb42a9f68ed6384a34ccaa162a0 > Author: Luca Ceresoli <[email protected]> > > drm/vc4: dsi: stop using deprecated drmm_of_get_bridge() > > drmm_of_get_bridge() is deprecated, switch to > of_drm_get_bridge_by_endpoint(). As of_drm_get_bridge_by_endpoint() returns > a refcounted bridge, ensure it is put by using bridge.next_bridge. > >> diff --git a/drivers/gpu/drm/vc4/vc4_dsi.c b/drivers/gpu/drm/vc4/vc4_dsi.c >> index 0148f2befed14..675bd0fc13913 100644 >> --- a/drivers/gpu/drm/vc4/vc4_dsi.c >> +++ b/drivers/gpu/drm/vc4/vc4_dsi.c > [ ... ] >> @@ -1775,9 +1774,13 @@ static int vc4_dsi_bind(struct device *dev, struct >> device *master, void *data) >> if (ret) >> return ret; >> >> + dsi->bridge.next_bridge = drm_bridge_get(next_bridge); >> + > > [Severity: Medium] > Does this code introduce a regression that leaks the bridge reference across > component unbind/rebind cycles? > > During component unbind, vc4_dsi_release_action() only drops the reference > to dsi->bridge acquired during bind: > > static void vc4_dsi_release_action(struct drm_device *drm, void *ptr) > { > struct vc4_dsi *dsi = ptr; > > drm_bridge_put(&dsi->bridge); > } > > Because dsi->bridge outlives the component unbind, __drm_bridge_free() is > not executed, and the reference to next_bridge is not automatically released. > > When the component is subsequently rebound, vc4_dsi_bind() overwrites > dsi->bridge.next_bridge here without freeing the previous pointer, > permanently leaking the bridge reference. Does next_bridge need to be > explicitly cleared in the teardown path?
Ah, right. I'm fixing this in v4 by calling drm_bridge_clear_and_put(&dsi->bridge.next_bridge). Not sure adding it to vc4_dsi_release_action() would be correct in case of unbind/rebind, so I'm probably adding a new vc4_dsi_unbind() for that. Luca -- Luca Ceresoli, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
