From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AE4E217BCA; Mon, 18 May 2026 18:33:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779129208; cv=none; b=GikIzx1qsPxphE3n6Gz++YAzwj+EsmQAq/oB08UG0tYcT6Qh9TeAnW7fJny1tZDpP+tLadgxIlmnWKPIrY9S2b0Gx9bKHIIhNFPnaidQkWWtGZ+WLp918LO9fnx6swV8odNKK4g4JuBRg2GGq+yz3NAw1sLthjESRxxmuiRD8ZA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779129208; c=relaxed/simple; bh=LGKGSMUN4o8qJprgckf5sju9UjIfUozUpvum/hvdi4Q=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=Gsf0hXM6dmy4L+U3svWDur0ye7kR+jlC+3xYRPC9b3kglA9NcsqwFPhpE4YQtAI5p/f7lYahlXAU05Cw+hnpyTILxxYjlxMGxUZgeTiIA0OCiawrYg3oq6T86p67kwGpczdC4R0Rfmn7hk6XX8gp5D02mVK8eyUyDwToOl1uzyg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=cgFJPYUR; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="cgFJPYUR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13424C2BCF6; Mon, 18 May 2026 18:33:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1779129208; bh=LGKGSMUN4o8qJprgckf5sju9UjIfUozUpvum/hvdi4Q=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date:From; b=cgFJPYURhIOG9dJmQHfBDUx+U48eMNN16jXyMNo+FCMHw+qrLbkKBw0ur62totE8y owDOudIJi520iNEHAd6F3zSdx11g75JJZvxiv0TKQvonsshJo0WJu6M+vMesLv+2rX ri101/DuQAEEjp8Jy5zqcqqwH1DvGmAtRGHKdq23MRnfBJ3qEwAGkQMD4HKQlbZDR6 T/6h5jp3tfZTPzVAaKwW3QNDtSoxzuA3jtyeSxXi3i5v7gBlqUYn+DAixJBT3ffPZS rW7NGZLqwwjQKqAduDh2D6uzxlCVEhW2ztl7/wE6DVaUqG62EfkCKa7CFmpCV7uHNt Al7uAY48tKFcg== From: sashiko-bot@kernel.org Subject: Re: [PATCH v7 03/23] drm: bridge: dw_hdmi: Free IRQ before CEC adapter is unregistered Reply-To: sashiko-reviews@lists.linux.dev To: "Jonas Karlman" Cc: linux-amlogic@lists.infradead.org, Frank.Li@kernel.org, imx@lists.linux.dev, linux-sunxi@lists.linux.dev, neil.armstrong@linaro.org In-Reply-To: <20260518180206.2480119-4-jonas@kwiboo.se> References: <20260518180206.2480119-4-jonas@kwiboo.se> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Mon, 18 May 2026 18:33:27 +0000 Message-Id: <20260518183328.13424C2BCF6@smtp.kernel.org> Precedence: bulk X-Mailing-List: imx@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 1 potential issue(= s) to consider: - [High] Freeing the shared IRQ before masking the hardware interrupt sourc= e creates a race condition that can lead to an unhandled interrupt storm, p= ermanently disabling the shared IRQ line. -- commit 860a0518c5583dda606c670b609794b60e6bc07b Author: Jonas Karlman drm: bridge: dw_hdmi: Free IRQ before CEC adapter is unregistered This commit explicitly frees the IRQ before the CEC adapter is unregistered to prevent a use-after-free issue. This addresses a KASAN slab-use-after-fr= ee report triggered during device unbind when the devres release action frees the IRQ. > diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-cec.c b/drivers/gpu/= drm/bridge/synopsys/dw-hdmi-cec.c > index 9549dabde941c..67a2a242d3ca9 100644 > --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-cec.c > +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-cec.c > @@ -309,6 +309,7 @@ static void dw_hdmi_cec_remove(struct platform_device= *pdev) > struct dw_hdmi_cec *cec =3D platform_get_drvdata(pdev); > =20 > cec_notifier_cec_adap_unregister(cec->notify, cec->adap); > + devm_free_irq(&pdev->dev, cec->irq, cec->adap); Does this sequence create a race condition that could result in an unhandled interrupt storm? The dw-hdmi-cec driver shares this IRQ line with the main dw-hdmi driver. By freeing the IRQ handler before calling cec_unregister_adapter(), the hardware CEC interrupts might still be unmasked and active. If the CEC hardware asserts an interrupt during this window, the shared IRQ line will go high. The remaining handlers on that line won't clear the CEC interrupt, returning IRQ_NONE. This could lead to an interrupt storm, causing the kernel to permanently disable the shared IRQ line and break the main dw-hdmi driver's functionali= ty. Should the CEC hardware interrupts be explicitly masked before devm_free_irq() is called? > cec_unregister_adapter(cec->adap); > } --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260518180206.2480= 119-1-jonas@kwiboo.se?part=3D3 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 33040CD4F4A for ; Mon, 18 May 2026 18:34:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=9XYXdgo2ii1hZ6iBZNyVV7BBYUR6NcVTQHqAgiL9OxQ=; b=ffqIxmPFa8zxJA exF/ZXXxLQy+32BcLSedXMcKBzcZZRzt7gS99ebr0Wpiaz97eCMzV+FkwasolFXKDeIViIqfvC3vr dAKpL4kgujiQs2SNLnnZ9dZILAK0WpSXAFP6+gbHLJskoufCVC8dGm2sLtI6oSyZDbk6iGi3wCihl zwTIJQTibS4UkId1UzmN9UE1v+cOCrzayMVY3LdQNxKBb5dh9sU4X1jXddUXZA9eboaHhET8o9DF9 9+2FIjxbieAHZ4CUSSbU+gjZZdgYg6vnzTSt1NoyYctfeLTZgPOUtWWuvB3eYlNl9pXWNPkJedeFm w09S7T1hGiTVDYJxf7Sg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wP2mR-0000000GZpP-2GyA; Mon, 18 May 2026 18:33:31 +0000 Received: from tor.source.kernel.org ([2600:3c04:e001:324:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wP2mP-0000000GZpA-43ja for linux-amlogic@lists.infradead.org; Mon, 18 May 2026 18:33:30 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by tor.source.kernel.org (Postfix) with ESMTP id D938E60120; Mon, 18 May 2026 18:33:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13424C2BCF6; Mon, 18 May 2026 18:33:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1779129208; bh=LGKGSMUN4o8qJprgckf5sju9UjIfUozUpvum/hvdi4Q=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date:From; b=cgFJPYURhIOG9dJmQHfBDUx+U48eMNN16jXyMNo+FCMHw+qrLbkKBw0ur62totE8y owDOudIJi520iNEHAd6F3zSdx11g75JJZvxiv0TKQvonsshJo0WJu6M+vMesLv+2rX ri101/DuQAEEjp8Jy5zqcqqwH1DvGmAtRGHKdq23MRnfBJ3qEwAGkQMD4HKQlbZDR6 T/6h5jp3tfZTPzVAaKwW3QNDtSoxzuA3jtyeSxXi3i5v7gBlqUYn+DAixJBT3ffPZS rW7NGZLqwwjQKqAduDh2D6uzxlCVEhW2ztl7/wE6DVaUqG62EfkCKa7CFmpCV7uHNt Al7uAY48tKFcg== From: sashiko-bot@kernel.org Subject: Re: [PATCH v7 03/23] drm: bridge: dw_hdmi: Free IRQ before CEC adapter is unregistered To: "Jonas Karlman" Cc: linux-amlogic@lists.infradead.org, Frank.Li@kernel.org, imx@lists.linux.dev, linux-sunxi@lists.linux.dev, neil.armstrong@linaro.org In-Reply-To: <20260518180206.2480119-4-jonas@kwiboo.se> References: <20260518180206.2480119-4-jonas@kwiboo.se> Date: Mon, 18 May 2026 18:33:27 +0000 Message-Id: <20260518183328.13424C2BCF6@smtp.kernel.org> X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MSBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6Ci0gW0hpZ2hdIEZyZWVpbmcgdGhlIHNo YXJlZCBJUlEgYmVmb3JlIG1hc2tpbmcgdGhlIGhhcmR3YXJlIGludGVycnVwdCBzb3VyY2UgY3Jl YXRlcyBhIHJhY2UgY29uZGl0aW9uIHRoYXQgY2FuIGxlYWQgdG8gYW4gdW5oYW5kbGVkIGludGVy cnVwdCBzdG9ybSwgcGVybWFuZW50bHkgZGlzYWJsaW5nIHRoZSBzaGFyZWQgSVJRIGxpbmUuCi0t Cgpjb21taXQgODYwYTA1MThjNTU4M2RkYTYwNmM2NzBiNjA5Nzk0YjYwZTZiYzA3YgpBdXRob3I6 IEpvbmFzIEthcmxtYW4gPGpvbmFzQGt3aWJvby5zZT4KCmRybTogYnJpZGdlOiBkd19oZG1pOiBG cmVlIElSUSBiZWZvcmUgQ0VDIGFkYXB0ZXIgaXMgdW5yZWdpc3RlcmVkCgpUaGlzIGNvbW1pdCBl eHBsaWNpdGx5IGZyZWVzIHRoZSBJUlEgYmVmb3JlIHRoZSBDRUMgYWRhcHRlciBpcyB1bnJlZ2lz dGVyZWQKdG8gcHJldmVudCBhIHVzZS1hZnRlci1mcmVlIGlzc3VlLiBUaGlzIGFkZHJlc3NlcyBh IEtBU0FOIHNsYWItdXNlLWFmdGVyLWZyZWUKcmVwb3J0IHRyaWdnZXJlZCBkdXJpbmcgZGV2aWNl IHVuYmluZCB3aGVuIHRoZSBkZXZyZXMgcmVsZWFzZSBhY3Rpb24gZnJlZXMKdGhlIElSUS4KCj4g ZGlmZiAtLWdpdCBhL2RyaXZlcnMvZ3B1L2RybS9icmlkZ2Uvc3lub3BzeXMvZHctaGRtaS1jZWMu YyBiL2RyaXZlcnMvZ3B1L2RybS9icmlkZ2Uvc3lub3BzeXMvZHctaGRtaS1jZWMuYwo+IGluZGV4 IDk1NDlkYWJkZTk0MWMuLjY3YTJhMjQyZDNjYTkgMTAwNjQ0Cj4gLS0tIGEvZHJpdmVycy9ncHUv ZHJtL2JyaWRnZS9zeW5vcHN5cy9kdy1oZG1pLWNlYy5jCj4gKysrIGIvZHJpdmVycy9ncHUvZHJt L2JyaWRnZS9zeW5vcHN5cy9kdy1oZG1pLWNlYy5jCj4gQEAgLTMwOSw2ICszMDksNyBAQCBzdGF0 aWMgdm9pZCBkd19oZG1pX2NlY19yZW1vdmUoc3RydWN0IHBsYXRmb3JtX2RldmljZSAqcGRldikK PiAgCXN0cnVjdCBkd19oZG1pX2NlYyAqY2VjID0gcGxhdGZvcm1fZ2V0X2RydmRhdGEocGRldik7 Cj4gIAo+ICAJY2VjX25vdGlmaWVyX2NlY19hZGFwX3VucmVnaXN0ZXIoY2VjLT5ub3RpZnksIGNl Yy0+YWRhcCk7Cj4gKwlkZXZtX2ZyZWVfaXJxKCZwZGV2LT5kZXYsIGNlYy0+aXJxLCBjZWMtPmFk YXApOwoKRG9lcyB0aGlzIHNlcXVlbmNlIGNyZWF0ZSBhIHJhY2UgY29uZGl0aW9uIHRoYXQgY291 bGQgcmVzdWx0IGluIGFuIHVuaGFuZGxlZAppbnRlcnJ1cHQgc3Rvcm0/CgpUaGUgZHctaGRtaS1j ZWMgZHJpdmVyIHNoYXJlcyB0aGlzIElSUSBsaW5lIHdpdGggdGhlIG1haW4gZHctaGRtaSBkcml2 ZXIuCkJ5IGZyZWVpbmcgdGhlIElSUSBoYW5kbGVyIGJlZm9yZSBjYWxsaW5nIGNlY191bnJlZ2lz dGVyX2FkYXB0ZXIoKSwgdGhlCmhhcmR3YXJlIENFQyBpbnRlcnJ1cHRzIG1pZ2h0IHN0aWxsIGJl IHVubWFza2VkIGFuZCBhY3RpdmUuCgpJZiB0aGUgQ0VDIGhhcmR3YXJlIGFzc2VydHMgYW4gaW50 ZXJydXB0IGR1cmluZyB0aGlzIHdpbmRvdywgdGhlIHNoYXJlZCBJUlEKbGluZSB3aWxsIGdvIGhp Z2guIFRoZSByZW1haW5pbmcgaGFuZGxlcnMgb24gdGhhdCBsaW5lIHdvbid0IGNsZWFyIHRoZSBD RUMKaW50ZXJydXB0LCByZXR1cm5pbmcgSVJRX05PTkUuCgpUaGlzIGNvdWxkIGxlYWQgdG8gYW4g aW50ZXJydXB0IHN0b3JtLCBjYXVzaW5nIHRoZSBrZXJuZWwgdG8gcGVybWFuZW50bHkKZGlzYWJs ZSB0aGUgc2hhcmVkIElSUSBsaW5lIGFuZCBicmVhayB0aGUgbWFpbiBkdy1oZG1pIGRyaXZlcidz IGZ1bmN0aW9uYWxpdHkuCgpTaG91bGQgdGhlIENFQyBoYXJkd2FyZSBpbnRlcnJ1cHRzIGJlIGV4 cGxpY2l0bHkgbWFza2VkIGJlZm9yZQpkZXZtX2ZyZWVfaXJxKCkgaXMgY2FsbGVkPwoKPiAgCWNl Y191bnJlZ2lzdGVyX2FkYXB0ZXIoY2VjLT5hZGFwKTsKPiAgfQoKLS0gClNhc2hpa28gQUkgcmV2 aWV3IMK3IGh0dHBzOi8vc2FzaGlrby5kZXYvIy9wYXRjaHNldC8yMDI2MDUxODE4MDIwNi4yNDgw MTE5LTEtam9uYXNAa3dpYm9vLnNlP3BhcnQ9MwoKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18KbGludXgtYW1sb2dpYyBtYWlsaW5nIGxpc3QKbGludXgtYW1s b2dpY0BsaXN0cy5pbmZyYWRlYWQub3JnCmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxt YW4vbGlzdGluZm8vbGludXgtYW1sb2dpYwo=