Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] drm/bridge: dw-hdmi: missing connector cleanup in dw_hdmi_connector_create() --
commit 79a659d48a2ba43f6a6effe5800fc818debe3d47 Author: Maxime Ripard <[email protected]> drm/bridge: synopsys: dw-hdmi: Convert to atomic_create_state This commit replaces the call to drm_atomic_helper_connector_reset() in dw_hdmi_connector_create() with drm_atomic_helper_connector_create_state() to allocate the initial connector state required by drm_connector_attach_max_bpc_property(). > diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c > b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c > index 917cf764c9c5d..5f11707c67b5c 100644 > --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c > +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c > @@ -2605,7 +2605,15 @@ static int dw_hdmi_connector_create(struct dw_hdmi > *hdmi) > * drm_connector_attach_max_bpc_property() requires the > * connector to have a state. > */ > - drm_atomic_helper_connector_reset(connector); > + if (!connector->state) { > + struct drm_connector_state *conn_state; > + > + conn_state = > drm_atomic_helper_connector_create_state(connector); > + if (IS_ERR(conn_state)) > + return PTR_ERR(conn_state); [Severity: High] If drm_atomic_helper_connector_create_state() fails in dw_hdmi_connector_create() in drivers/gpu/drm/bridge/synopsys/dw-hdmi.c, does returning PTR_ERR(conn_state) directly leak the initialized connector and leave &hdmi->connector linked on dev->mode_config.connector_list? Just before allocating the state, dw_hdmi_connector_create() initializes the unmanaged embedded connector: drm_connector_init_with_ddc(hdmi->bridge.dev, connector, &dw_hdmi_connector_funcs, DRM_MODE_CONNECTOR_HDMIA, hdmi->ddc); which registers &connector->base in dev->mode_config.object_idr, allocates connector->name, and adds &connector->head to dev->mode_config.connector_list. When dw_hdmi_connector_create() returns an error via dw_hdmi_bridge_attach() -> drm_bridge_attach() during component binding, dw_hdmi_bind() cleans up the bridge and component_bind() in drivers/base/component.c releases the component devres group, freeing struct dw_hdmi while &hdmi->connector remains on dev->mode_config.connector_list. When the master driver later runs drm_mode_config_cleanup() in drivers/gpu/drm/drm_mode_config.c, iterating connector_list will dereference the already-freed &hdmi->connector. Should this error path call drm_connector_cleanup(connector) before returning? > + > + connector->state = conn_state; > + } > > drm_connector_attach_max_bpc_property(connector, 8, 16); > -- Sashiko AI review ยท https://sashiko.dev/#/patchset/20261022-drm-no-more-connector-reset-v2-0-0b7e4e85b...@kernel.org?part=44
