Re: [PATCH v8 22/39] drm/rockchip: dw_hdmi_qp: Use local dev variable consistently in bind()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Component bind/unbind lifetime mismatch leading to Use-After-Free and resource leaks.
--

commit 53ed72bcdde7f86deb352e52bb664f24f880b84c
Author: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>

drm/rockchip: dw_hdmi_qp: Use local dev variable consistently in bind()

This patch updates dw_hdmi_qp_rockchip_bind() to use the local dev parameter 
instead of indirect struct device accesses. This improves consistency and 
readability throughout the function.

> diff --git a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c
> index 7bd0f6dcbe5dc..d2fcfa70ed168 100644
> --- a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c
> +++ b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c

[ ... ]

> @@ -671,7 +670,7 @@ static int dw_hdmi_qp_rockchip_bind(struct device *dev, struct device *master,
>  	if (irq < 0)
>  		return irq;
>  
> -	ret = devm_request_threaded_irq(hdmi->dev, irq,
> +	ret = devm_request_threaded_irq(dev, irq,
>  					cfg->ctrl_ops->hardirq_callback,
>  					cfg->ctrl_ops->irq_callback,
>  					IRQF_SHARED, "dw-hdmi-qp-hpd",
>  					hdmi);

[Severity: High]
This is a pre-existing issue, but could this lifetime mismatch between the 
component device and the DRM master lead to a use-after-free?

The hdmi context is allocated earlier in dw_hdmi_qp_rockchip_bind() using 
drmm_kzalloc(), which ties its lifetime to the DRM master device:

    hdmi = drmm_kzalloc(drm, sizeof(*hdmi), GFP_KERNEL);

However, the HPD interrupt is requested using devm_request_threaded_irq() 
with the component device (dev).

If the master DRM device is unbound, the hdmi context will be freed 
automatically. Looking at dw_hdmi_qp_rockchip_unbind(), it only cancels the 
delayed work but lacks manual cleanup of the IRQ:

static void dw_hdmi_qp_rockchip_unbind(struct device *dev,
				       struct device *master,
				       void *data)
{
	struct rockchip_hdmi_qp *hdmi = dev_get_drvdata(dev);

	cancel_delayed_work_sync(&hdmi->hpd_work);
}

If the HPD interrupt fires after the master DRM device is unbound but before 
the component device is unbound, the dangling interrupt handler will execute 
with a freed hdmi pointer. Is it possible to tie the IRQ lifetime to the DRM 
master or explicitly free it in the unbind path?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702-dw-hdmi-qp-scramb-v8-0-d79890d00b6a@collabora.com?part=22