Re: [PATCH v2 01/15] drm/exynos: remove dependency on DRM simple helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the DP AUX channel and resources registered by analogix_dp_bind() are leaked if drm_bridge_connector_init() fails, leading to a Use-After-Free (UAF).
--

--- Patch [1]: [PATCH v2 01/15] drm/exynos: remove dependency on DRM simple helpers ---
commit c403fdd838b4dabbda14312eb449cb97a7566462
Author: Diogo Silva <diogompaissilva@gmail.com>
Subject: drm/exynos: remove dependency on DRM simple helpers

The simple KMS helpers are deprecated because they only add an
intermediate layer between drivers and atomic modesetting. Open-code
drm_simple_encoder_init() by calling drm_encoder_init() directly and
providing driver-local drm_encoder_funcs.

> diff --git a/drivers/gpu/drm/exynos/exynos_dp.c b/drivers/gpu/drm/exynos/exynos_dp.c
> index b805403281504..957382223956a 100644
> --- a/drivers/gpu/drm/exynos/exynos_dp.c
> +++ b/drivers/gpu/drm/exynos/exynos_dp.c

[ ... ]

> @@ -95,7 +99,12 @@ static int exynos_dp_bind(struct device *dev, struct device *master, void *data)
>  
>  	dp->drm_dev = drm_dev;
>  
> -	drm_simple_encoder_init(drm_dev, encoder, DRM_MODE_ENCODER_TMDS);
> +	ret = drm_encoder_init(drm_dev, encoder, &exynos_dp_encoder_funcs,
> +			       DRM_MODE_ENCODER_TMDS, NULL);
> +	if (ret) {
> +		drm_err(drm_dev, "Failed to initialize encoder\n");
> +		return ret;
> +	}
>  
>  	drm_encoder_helper_add(encoder, &exynos_dp_encoder_helper_funcs);

[Severity: High]
This isn't a bug introduced by this patch, but looking further down in
exynos_dp_bind(), if drm_bridge_connector_init() fails, does this code leak
the DP AUX character device and resources registered by analogix_dp_bind()?

Currently, if the bridge connector init fails:

	connector = drm_bridge_connector_init(dp->drm_dev, dp->plat_data.encoder);
	if (IS_ERR(connector)) {
		ret = PTR_ERR(connector);
		dev_err(dp->dev, "Failed to initialize bridge_connector\n");
		return ret;
	}

The error path returns directly without calling analogix_dp_unbind() to roll
back the earlier success of analogix_dp_bind().

Since the component bind fails, the master DRM bind will also fail, and the
component's unbind hook (exynos_dp_unbind()) is never invoked.

When the devres framework later frees the struct analogix_dp_device, could
the still-registered /dev/drm_dp_auxN character device cause a
Use-After-Free if accessed from userspace?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720-drm_simple_encoder_init-v2-0-5020b630668a@gmail.com?part=1