[PATCH v2] drm/bridge: display-connector: Fix I2C adapter resource leak

[PATCH v2] drm/bridge: display-connector: Fix I2C adapter resource leak

[Laurent Pinchart]

If the probe function returns an error after getting the I2C adapter for
DDC, the reference to the adapter is never released. Fix it by releasing
it in the bridge .destroy() handler.

There is no need to test the ddc pointer with !IS_ERR(), as
of_get_i2c_adapter_by_node() returns NULL on error.

Fixes: 2e2bf3a5584d ("drm/bridge: display-connector: add DP support")
Cc: stable@vger.kernel.org
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
---
 drivers/gpu/drm/bridge/display-connector.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
index d1e74dd2e051..eb3412ec30a0 100644
--- a/drivers/gpu/drm/bridge/display-connector.c
+++ b/drivers/gpu/drm/bridge/display-connector.c
@@ -43,6 +43,13 @@ static int display_connector_attach(struct drm_bridge *bridge,
 	return flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR ? 0 : -EINVAL;
 }
 
+static void display_connector_destroy(struct drm_bridge *bridge)
+{
+	struct display_connector *conn = to_display_connector(bridge);
+
+	i2c_put_adapter(conn->bridge.ddc);
+}
+
 static enum drm_connector_status display_connector_detect(struct drm_bridge *bridge)
 {
 	struct display_connector *conn = to_display_connector(bridge);
@@ -208,6 +215,7 @@ static u32 *display_connector_get_input_bus_fmts(struct drm_bridge *bridge,
 
 static const struct drm_bridge_funcs display_connector_bridge_funcs = {
 	.attach = display_connector_attach,
+	.destroy = display_connector_destroy,
 	.detect = display_connector_bridge_detect,
 	.hpd_enable = display_connector_hpd_enable,
 	.hpd_disable = display_connector_hpd_disable,
@@ -439,9 +447,6 @@ static void display_connector_remove(struct platform_device *pdev)
 		regulator_disable(conn->supply);
 
 	drm_bridge_remove(&conn->bridge);
-
-	if (!IS_ERR(conn->bridge.ddc))
-		i2c_put_adapter(conn->bridge.ddc);
 }
 
 static const struct of_device_id display_connector_match[] = {

base-commit: 5b9af25f2d0b574b4058c9f8c84486a597168116
-- 
Regards,

Laurent Pinchart

Re: [PATCH v2] drm/bridge: display-connector: Fix I2C adapter resource leak

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free of devm-managed resources (hpd_gpio, hpd_irq) and locking of destroyed mutexes during driver unbind.
--

--- Patch [1]: [PATCH v2] drm/bridge: display-connector: Fix I2C adapter resource leak ---
commit 2b26eaff927cdb68a6ad11049169cdda7d66a1f8
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>

drm/bridge: display-connector: Fix I2C adapter resource leak

This commit moves the release of the I2C adapter to the bridge .destroy()
handler to fix a reference leak when probe fails after getting the DDC
adapter.

> diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
> --- a/drivers/gpu/drm/bridge/display-connector.c
> +++ b/drivers/gpu/drm/bridge/display-connector.c

[ ... ]

> @@ -439,9 +447,6 @@ static void display_connector_remove(struct platform_device *pdev)
>  		regulator_disable(conn->supply);
>  
>  	drm_bridge_remove(&conn->bridge);

[Severity: High]
This is a pre-existing issue, but does the bridge removal sequence leave
devm-managed resources vulnerable to a use-after-free?

If the driver is unbound while the bridge is still attached to a DRM encoder,
drm_bridge_remove() destroys bridge->hpd_mutex and moves the bridge to a
lingering list. Because hpd_gpio and hpd_irq are devm-managed, devres will
free them as soon as display_connector_remove() returns.

Could an incoming HPD interrupt fire right after drm_bridge_remove() and try
to lock the destroyed bridge->hpd_mutex via drm_bridge_hpd_notify()?

Additionally, if the DRM core later calls display_connector_detect() or
display_connector_hpd_disable() on the lingering bridge, would it result in a
use-after-free when accessing the freed conn->hpd_gpio or conn->hpd_irq?

> -
> -	if (!IS_ERR(conn->bridge.ddc))
> -		i2c_put_adapter(conn->bridge.ddc);
>  }
>  
>  static const struct of_device_id display_connector_match[] = {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717184836.2017386-1-laurent.pinchart+renesas@ideasonboard.com?part=1

Re: [PATCH v2] drm/bridge: display-connector: Fix I2C adapter resource leak

[Laurent Pinchart]

Hello,

This is the friendly mail bot of Laurent Pinchart. You have sent him
what appears to be an e-mail generated by an LLM. In order to preserve
his mental health, the e-mail has been automatically ignored.

Thank you,

Laurent's mail bot

On Fri, 17 Jul 2026 19:01:28 +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] Use-After-Free of devm-managed resources (hpd_gpio, hpd_irq) and locking of destroyed mutexes during driver unbind.
> --
> 
> --- Patch [1]: [PATCH v2] drm/bridge: display-connector: Fix I2C adapter resource leak ---
> commit 2b26eaff927cdb68a6ad11049169cdda7d66a1f8
> Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
> 
> drm/bridge: display-connector: Fix I2C adapter resource leak
> 
> This commit moves the release of the I2C adapter to the bridge .destroy()
> handler to fix a reference leak when probe fails after getting the DDC
> adapter.
> 
> > diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
> > --- a/drivers/gpu/drm/bridge/display-connector.c
> > +++ b/drivers/gpu/drm/bridge/display-connector.c
> 
> [ ... ]
> 
> > @@ -439,9 +447,6 @@ static void display_connector_remove(struct platform_device *pdev)
> >  		regulator_disable(conn->supply);
> >  
> >  	drm_bridge_remove(&conn->bridge);
> 
> [Severity: High]
> This is a pre-existing issue, but does the bridge removal sequence leave
> devm-managed resources vulnerable to a use-after-free?
> 
> If the driver is unbound while the bridge is still attached to a DRM encoder,
> drm_bridge_remove() destroys bridge->hpd_mutex and moves the bridge to a
> lingering list. Because hpd_gpio and hpd_irq are devm-managed, devres will
> free them as soon as display_connector_remove() returns.
> 
> Could an incoming HPD interrupt fire right after drm_bridge_remove() and try
> to lock the destroyed bridge->hpd_mutex via drm_bridge_hpd_notify()?
> 
> Additionally, if the DRM core later calls display_connector_detect() or
> display_connector_hpd_disable() on the lingering bridge, would it result in a
> use-after-free when accessing the freed conn->hpd_gpio or conn->hpd_irq?
> 
> > -
> > -	if (!IS_ERR(conn->bridge.ddc))
> > -		i2c_put_adapter(conn->bridge.ddc);
> >  }
> >  
> >  static const struct of_device_id display_connector_match[] = {
>