Re: [PATCH v5 02/11] drm/bridge: it6505: balance and disable runtime PM on remove

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free of devres-managed resources when I2C device is unbound while DRM pipeline is active.
--

--- Patch [2]: [PATCH v5 02/11] drm/bridge: it6505: balance and disable runtime PM on remove ---
commit e15fa2b94105d4f1aa7e633d5a8987820994caa9
Author: Daniel Golle <daniel@makrotopia.org>

drm/bridge: it6505: balance and disable runtime PM on remove

This commit balances the usage reference held for a connected display and
explicitly disables runtime PM in the I2C remove path. This prevents a
device from leaking the reference count across rebinds and resolves an
unbalanced pm_runtime_enable warning.

> diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
> --- a/drivers/gpu/drm/bridge/ite-it6505.c
> +++ b/drivers/gpu/drm/bridge/ite-it6505.c
> @@ -3660,6 +3660,9 @@ static void it6505_i2c_remove(struct i2c_client *client)
>  	cancel_work_sync(&it6505->hdcp_wait_ksv_list);
>  	cancel_delayed_work_sync(&it6505->hdcp_work);
>  	cancel_work_sync(&it6505->extcon_wq);
> +	if (it6505->extcon_state)
> +		pm_runtime_put_sync(&client->dev);
> +	pm_runtime_disable(&client->dev);
>  	it6505_poweroff(it6505);
>  	it6505_remove_edid(it6505);
>  }

[Severity: High]
This is a pre-existing issue, but does this remove sequence lead to a
use-after-free if the device is unbound via sysfs while the DRM pipeline is
active?

When it6505_i2c_remove() returns, the driver core cleans up devres-managed
resources allocated during probe, including the regmap and regulators.

The bridge container itself is allocated via devm_drm_bridge_alloc(), which
uses a kref to manage its lifetime, meaning it outlives the devres cleanup
as long as the DRM pipeline holds a reference.

If the DRM pipeline is subsequently torn down, it will call bridge callbacks
like it6505_bridge_atomic_disable() which attempt to access the freed regmap
and regulators. Is there a way to ensure the bridge is fully disconnected and
hardware resources are safe from late access during unbind?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1784717129.git.daniel@makrotopia.org?part=2