Re: [PATCH v8 24/39] drm/rockchip: dw_hdmi_qp: Defer HPD IRQ enable until after connector setup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `disable_irq()` or `devm_free_irq()` in component `unbind()` leaves the HPD IRQ enabled, causing a Use-After-Free of the `hdmi` struct if an interrupt fires after the DRM device is torn down.
--

commit ed0ca175c20c7a0b231242e1a45aec15890b9c5d
Author: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>

drm/rockchip: dw_hdmi_qp: Defer HPD IRQ enable until after connector setup

This commit defers enabling the HPD IRQ until the end of the initialization
sequence by using IRQF_NO_AUTOEN and calling enable_irq() later. It also
removes the incompatible IRQF_SHARED flag.

> diff --git a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c
> index 33036f194e348..3de4b3e6ea85e 100644
> --- a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c
> +++ b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c

[ ... ]

> @@ -694,6 +694,8 @@ static int dw_hdmi_qp_rockchip_bind(struct device *dev, struct device *master,
>  		return dev_err_probe(dev, PTR_ERR(connector),
>  				     "Failed to init bridge connector\n");
>  
> +	enable_irq(irq);
> +
>  	return 0;
>  }

[Severity: High]
This is a pre-existing issue, but does the hardware IRQ remain enabled after
component unbind?

Since the IRQ is requested with devm_request_threaded_irq(), it won't be
freed until driver detach. However, when the component is unbound
(e.g., via sysfs), dw_hdmi_qp_rockchip_unbind() is called:

static void dw_hdmi_qp_rockchip_unbind(struct device *dev, ...)
{
        struct rockchip_hdmi_qp *hdmi = dev_get_drvdata(dev);

        cancel_delayed_work_sync(&hdmi->hpd_work);
}

This cancels the delayed work but does not disable the IRQ. After unbind,
the DRM master completes teardown and frees the hdmi struct (which was
allocated via drmm_kzalloc).

If a physical HDMI hotplug event occurs after unbind, could the hardirq
handler dw_hdmi_qp_rk3588_hardirq() execute and dereference the freed
hdmi->regmap, causing a use-after-free?

Should dw_hdmi_qp_rockchip_unbind() include a matching disable_irq() or
devm_free_irq() to prevent the interrupt from firing after teardown?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702-dw-hdmi-qp-scramb-v8-0-d79890d00b6a@collabora.com?part=24