Re: [PATCH v8 31/39] drm/vc4: hdmi: Convert to common SCDC scrambling infrastructure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] If `drm_dev_enter` fails in `vc4_hdmi_encoder_post_crtc_disable` (e.g., when the device is unbound or unplugged), the function jumps to the `out` label and skips calling `drm_connector_hdmi_disable_scrambling()`. This leaves the `connector->hdmi.scdc_work` delayed work pending. Since `drm_connector_cleanup()` does not natively cancel this work, it will execute after the connector memory has been zeroed and freed, causing a use-after-free and kernel crash.
--

commit b7c6215b3f661e126a4a4477a77ead5d481367d2
Author: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>

drm/vc4: hdmi: Convert to common SCDC scrambling infrastructure

This commit converts the vc4 HDMI driver to use the common HDMI 2.0
scrambling infrastructure. It removes the local scrambling workqueue and
state tracking, relying instead on the shared drm_connector_hdmi layer
functions.

> diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
> --- a/drivers/gpu/drm/vc4/vc4_hdmi.c
> +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
> @@ -909,7 +738,7 @@ static void vc4_hdmi_encoder_post_crtc_disable(struct drm_encoder *encoder,
>  		spin_unlock_irqrestore(&vc4_hdmi->hw_lock, flags);
>  	}
>  
> -	vc4_hdmi_disable_scrambling(encoder);
> +	drm_connector_hdmi_disable_scrambling(&vc4_hdmi->connector);
>  
>  	drm_dev_exit(idx);

[Severity: High]
This is a pre-existing issue, but does skipping this function leave a
pending delayed work if device access is lost?

Looking at vc4_hdmi_encoder_post_crtc_disable(), if drm_dev_enter() fails,
the function jumps to the out label:

	if (!drm_dev_enter(drm, &idx))
		goto out;
	...
	drm_connector_hdmi_disable_scrambling(&vc4_hdmi->connector);
	drm_dev_exit(idx);
out:
	mutex_unlock(&vc4_hdmi->mutex);

If drm_connector_hdmi_disable_scrambling() is skipped because drm_dev_enter()
failed, the connector->hdmi.scdc_work delayed work is never cancelled. Since
drm_connector_cleanup() does not cancel this work, will it execute after the
connector is freed and cause a use-after-free when the timer fires?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702-dw-hdmi-qp-scramb-v8-0-d79890d00b6a@collabora.com?part=31