Re: [PATCH 24/24] drm/bridge-connector: attach the DP subconnector property

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unchecked return value from drm_property_create_enum() causes a NULL pointer dereference inside drm_object_attach_property().
--

--- Patch [24]: [PATCH 24/24] drm/bridge-connector: attach the DP subconnector property ---
commit 3033458679cc26b1f68f203c9dbef371dae0aec7
Author: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Subject: drm/bridge-connector: attach the DP subconnector property

This patch attaches the DP subconnector property from
drm_bridge_connector_init() for all DisplayPort connectors. It also removes
the open-coded attachment from the MSM driver to push other DP drivers towards
adding support for the property.

> diff --git a/drivers/gpu/drm/display/drm_bridge_connector.c b/drivers/gpu/drm/display/drm_bridge_connector.c
> index 8b54069fa53a4..f83d5f52ab146 100644
> --- a/drivers/gpu/drm/display/drm_bridge_connector.c
> +++ b/drivers/gpu/drm/display/drm_bridge_connector.c
> @@ -1089,6 +1089,10 @@ struct drm_connector *drm_bridge_connector_init(struct drm_device *drm,
>  	    IS_ENABLED(CONFIG_DRM_DISPLAY_HDCP_HELPER))
>  		drm_connector_attach_content_protection_property(connector, true);
>  
> +	/* The DP subconnector property applies to DisplayPort only. */
> +	if (connector_type == DRM_MODE_CONNECTOR_DisplayPort)
> +		drm_connector_attach_dp_subconnector_property(connector);

[Severity: High]
This is a pre-existing issue, but can this lead to a NULL pointer dereference
if drm_property_create_enum() fails under memory pressure?

By adding this call here, the bug is now exposed to all DisplayPort bridge
connectors. In drm_connector_attach_dp_subconnector_property():

	if (!mode_config->dp_subconnector_property)
		mode_config->dp_subconnector_property =
			drm_property_create_enum(connector->dev, ...);

	drm_object_attach_property(&connector->base,
				   mode_config->dp_subconnector_property,
				   DRM_MODE_SUBCONNECTOR_Unknown);

If drm_property_create_enum() returns NULL, it passes NULL to
drm_object_attach_property().

Inside drm_object_attach_property(), the NULL property pointer is immediately
dereferenced:

void drm_object_attach_property(struct drm_mode_object *obj,
				struct drm_property *property,
				uint64_t init_val)
{
	int count = obj->properties->count;
	struct drm_device *dev = property->dev;

Could an error check be added to
drm_connector_attach_dp_subconnector_property() to handle the allocation
failure instead of dereferencing a NULL pointer?

> +
>  	ret = drm_connector_attach_encoder(connector, encoder);
>  	if (ret)
>  		return ERR_PTR(ret);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722-drm-msm-display-interface-v1-0-368c10fe62fd@oss.qualcomm.com?part=24