[PATCH 00/10] drm/bridge: Remove redundant error messages on IRQ request failure

[PATCH 00/10] drm/bridge: Remove redundant error messages on IRQ request failure

[Pan Chuang]

Commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()") added automatic error logging to
devm_request_threaded_irq() and devm_request_any_context_irq()
via the new devm_request_result() helper, which prints device
name, IRQ number, handler functions, and error code on failure.

Since devm_request_irq() is a static inline wrapper around
devm_request_threaded_irq(), it also benefits from this
automatic logging.

Remove the now-redundant dev_err() and dev_err_probe() calls
in drm/bridge drivers that follow these devm_request_*_irq()
functions, as the core now provides more detailed diagnostic
information on failure.

Pan Chuang (10):
  drm/bridge: analogix_dp: Remove redundant dev_err()
  drm/bridge: cdns-mhdp8546: Remove redundant dev_err()
  drm/bridge: lt9611: Remove redundant dev_err()
  drm/bridge: samsung-dsim: Remove redundant dev_err()
  drm/bridge: synopsys: dw-dp: Remove redundant dev_err_probe()
  drm/bridge: tc358767: Remove redundant dev_err()
  drm/bridge: it6505: Remove redundant dev_err()
  drm/bridge/sii8620: Remove redundant dev_err_probe()
  drm/bridge: ti-sn65dsi83: Remove redundant dev_err_probe()
  drm/bridge: ti-sn65dsi86: Remove redundant dev_err_probe()

 drivers/gpu/drm/bridge/analogix/analogix_dp_core.c  | 4 +---
 drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 1 -
 drivers/gpu/drm/bridge/ite-it6505.c                 | 4 +---
 drivers/gpu/drm/bridge/lontium-lt9611.c             | 4 +---
 drivers/gpu/drm/bridge/samsung-dsim.c               | 4 +---
 drivers/gpu/drm/bridge/sil-sii8620.c                | 3 +--
 drivers/gpu/drm/bridge/synopsys/dw-dp.c             | 4 +---
 drivers/gpu/drm/bridge/tc358767.c                   | 4 +---
 drivers/gpu/drm/bridge/ti-sn65dsi83.c               | 2 +-
 drivers/gpu/drm/bridge/ti-sn65dsi86.c               | 2 +-
 10 files changed, 9 insertions(+), 23 deletions(-)

-- 
2.34.1

[PATCH 01/10] drm/bridge: analogix_dp: Remove redundant dev_err()

[Pan Chuang]

Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
index 30c0c0b41d5a..566f1e5eb8cd 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
@@ -1414,10 +1414,8 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data)
 					analogix_dp_hardirq,
 					analogix_dp_irq_thread,
 					irq_flags, "analogix-dp", dp);
-	if (ret) {
-		dev_err(&pdev->dev, "failed to request irq\n");
+	if (ret)
 		return ERR_PTR(ret);
-	}
 
 	dp->aux.name = "DP-AUX";
 	dp->aux.transfer = analogix_dpaux_transfer;
-- 
2.34.1

[PATCH 02/10] drm/bridge: cdns-mhdp8546: Remove redundant dev_err()

[Pan Chuang]

Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
index 504a3186ebb3..f47717bd1079 100644
--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
@@ -2343,7 +2343,6 @@ static int cdns_mhdp_probe(struct platform_device *pdev)
 					cdns_mhdp_irq_handler, IRQF_ONESHOT,
 					"mhdp8546", mhdp);
 	if (ret) {
-		dev_err(dev, "cannot install IRQ %d\n", irq);
 		ret = -EIO;
 		goto plat_fini;
 	}
-- 
2.34.1

[PATCH 03/10] drm/bridge: lt9611: Remove redundant dev_err()

[Pan Chuang]

Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/gpu/drm/bridge/lontium-lt9611.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
index b6a368f71285..05950cbc0a90 100644
--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
+++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
@@ -1156,10 +1156,8 @@ static int lt9611_probe(struct i2c_client *client)
 	ret = devm_request_threaded_irq(dev, client->irq, NULL,
 					lt9611_irq_thread_handler,
 					IRQF_ONESHOT, "lt9611", lt9611);
-	if (ret) {
-		dev_err(dev, "failed to request irq\n");
+	if (ret)
 		goto err_disable_regulators;
-	}
 
 	i2c_set_clientdata(client, lt9611);
 
-- 
2.34.1

[PATCH 04/10] drm/bridge: samsung-dsim: Remove redundant dev_err()

[Pan Chuang]

Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/gpu/drm/bridge/samsung-dsim.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c
index 25ab475309e8..991d370daea1 100644
--- a/drivers/gpu/drm/bridge/samsung-dsim.c
+++ b/drivers/gpu/drm/bridge/samsung-dsim.c
@@ -2183,10 +2183,8 @@ int samsung_dsim_probe(struct platform_device *pdev)
 					samsung_dsim_irq,
 					IRQF_ONESHOT | IRQF_NO_AUTOEN,
 					dev_name(dev), dsi);
-	if (ret) {
-		dev_err(dev, "failed to request dsi irq\n");
+	if (ret)
 		return ret;
-	}
 
 	ret = samsung_dsim_parse_dt(dsi);
 	if (ret)
-- 
2.34.1

[PATCH 05/10] drm/bridge: synopsys: dw-dp: Remove redundant dev_err_probe()

[Pan Chuang]

Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err_probe() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/gpu/drm/bridge/synopsys/dw-dp.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/bridge/synopsys/dw-dp.c b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
index 3445c82e6f50..aea8973fb825 100644
--- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
@@ -2080,10 +2080,8 @@ struct dw_dp *dw_dp_bind(struct device *dev, struct drm_encoder *encoder,
 
 	ret = devm_request_threaded_irq(dev, dp->irq, NULL, dw_dp_irq,
 					IRQF_ONESHOT, dev_name(dev), dp);
-	if (ret) {
-		dev_err_probe(dev, ret, "failed to request irq\n");
+	if (ret)
 		goto unregister_aux;
-	}
 
 	return dp;
 
-- 
2.34.1

[PATCH 06/10] drm/bridge: tc358767: Remove redundant dev_err()

[Pan Chuang]

Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/gpu/drm/bridge/tc358767.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index ce1b73214f26..ab644e4f3a95 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -2528,10 +2528,8 @@ static int tc_probe(struct i2c_client *client)
 						NULL, tc_irq_handler,
 						IRQF_ONESHOT,
 						"tc358767-irq", tc);
-		if (ret) {
-			dev_err(dev, "failed to register dp interrupt\n");
+		if (ret)
 			return ret;
-		}
 
 		tc->have_irq = true;
 	}
-- 
2.34.1

[PATCH 07/10] drm/bridge: it6505: Remove redundant dev_err()

[Pan Chuang]

Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/gpu/drm/bridge/ite-it6505.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index 8ecb43611dba..fe0f4ab16216 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -3607,10 +3607,8 @@ static int it6505_i2c_probe(struct i2c_client *client)
 					IRQF_TRIGGER_LOW | IRQF_ONESHOT |
 					IRQF_NO_AUTOEN,
 					"it6505-intp", it6505);
-	if (err) {
-		dev_err(dev, "Failed to request INTP threaded IRQ: %d", err);
+	if (err)
 		return err;
-	}
 
 	INIT_WORK(&it6505->link_works, it6505_link_training_work);
 	INIT_WORK(&it6505->hdcp_wait_ksv_list, it6505_hdcp_wait_ksv_list);
-- 
2.34.1

[PATCH 08/10] drm/bridge/sii8620: Remove redundant dev_err_probe()

[Pan Chuang]

Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err_probe() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/gpu/drm/bridge/sil-sii8620.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
index 22c81b38b41e..0b03142faa37 100644
--- a/drivers/gpu/drm/bridge/sil-sii8620.c
+++ b/drivers/gpu/drm/bridge/sil-sii8620.c
@@ -2320,8 +2320,7 @@ static int sii8620_probe(struct i2c_client *client)
 					IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
 					"sii8620", ctx);
 	if (ret < 0)
-		return dev_err_probe(dev, ret,
-				     "failed to install IRQ handler\n");
+		return ret;
 
 	ctx->gpio_reset = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH);
 	if (IS_ERR(ctx->gpio_reset))
-- 
2.34.1

[PATCH 09/10] drm/bridge: ti-sn65dsi83: Remove redundant dev_err_probe()

[Pan Chuang]

Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err_probe() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/gpu/drm/bridge/ti-sn65dsi83.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
index e6dbe51d0dba..3bc422c9d77a 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
@@ -1040,7 +1040,7 @@ static int sn65dsi83_probe(struct i2c_client *client)
 		ret = devm_request_threaded_irq(ctx->dev, ctx->irq, NULL, sn65dsi83_irq,
 						IRQF_ONESHOT, dev_name(ctx->dev), ctx);
 		if (ret)
-			return dev_err_probe(dev, ret, "failed to request irq\n");
+			return ret;
 	}
 
 	dev_set_drvdata(dev, ctx);
-- 
2.34.1

[PATCH 10/10] drm/bridge: ti-sn65dsi86: Remove redundant dev_err_probe()

[Pan Chuang]

Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err_probe() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
index 1da242f17413..2fcb4039fd61 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
@@ -2080,7 +2080,7 @@ static int ti_sn65dsi86_probe(struct i2c_client *client)
 						dev_name(pdata->dev), pdata);
 
 		if (ret)
-			return dev_err_probe(dev, ret, "failed to request interrupt\n");
+			return ret;
 	}
 
 	/*
-- 
2.34.1

Re: [PATCH 09/10] drm/bridge: ti-sn65dsi83: Remove redundant dev_err_probe()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The background work `ctx->reset_work` is never explicitly canceled, which can lead to a Use-After-Free if it executes after `ctx` is freed.
--

--- Patch [9]: [PATCH 09/10] drm/bridge: ti-sn65dsi83: Remove redundant dev_err_probe() ---
commit ae3029f9f75aff0082e24f794cc2c0d8fb473908
Author: Pan Chuang <panchuang@vivo.com>

drm/bridge: ti-sn65dsi83: Remove redundant dev_err_probe()

Since commit 55b48e23f5c4, devm_request_threaded_irq() automatically logs
detailed error messages on failure. This patch removes the now-redundant
driver-specific dev_err_probe() call.

> diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
> --- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c
> +++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
> @@ -1040,7 +1040,7 @@ static int sn65dsi83_probe(struct i2c_client *client)
>  		ret = devm_request_threaded_irq(ctx->dev, ctx->irq, NULL, sn65dsi83_irq,
>  						IRQF_ONESHOT, dev_name(ctx->dev), ctx);
>  		if (ret)
> -			return dev_err_probe(dev, ret, "failed to request irq\n");
> +			return ret;
>  	}
>  
>  	dev_set_drvdata(dev, ctx);

[Severity: High]
This is a pre-existing issue, but looking at the driver initialization and
teardown, is there a risk of a use-after-free with ctx->reset_work?

When the IRQ is successfully requested, the handler sn65dsi83_irq() becomes
active. If a hardware error triggers the IRQ handler, it calls
sn65dsi83_handle_errors() which schedules the reset work:

drivers/gpu/drm/bridge/ti-sn65dsi83.c:sn65dsi83_handle_errors() {
    ...
    schedule_work(&ctx->reset_work);
    ...
}

If the probe fails later (for example, when sn65dsi83_host_attach() fails),
the err_remove_bridge path is taken:

drivers/gpu/drm/bridge/ti-sn65dsi83.c:sn65dsi83_probe() {
err_remove_bridge:
    drm_bridge_remove(&ctx->bridge);
    return ret;
}

Since there is no explicit cancellation of the work here, and devres will
subsequently free the ctx structure upon probe failure, could a scheduled
reset work execute and dereference the freed ctx pointer?

The same pattern appears to exist in the normal driver removal path:

drivers/gpu/drm/bridge/ti-sn65dsi83.c:sn65dsi83_remove() {
    struct sn65dsi83 *ctx = i2c_get_clientdata(client);

    drm_bridge_unplug(&ctx->bridge);
}

Could this also leave a dangling work item that outlives the device context
if the device is unbound via sysfs while the background work is pending?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723131649.134127-1-panchuang@vivo.com?part=9

Re: [PATCH 03/10] drm/bridge: lt9611: Remove redundant dev_err()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Devm-managed IRQ can fire while regulators are disabled during probe error path, causing an interrupt storm.
--

--- Patch [3]: [PATCH 03/10] drm/bridge: lt9611: Remove redundant dev_err() ---
commit 31b83af0309fdf55db58f4bc292c02026a269afc
Author: Pan Chuang <panchuang@vivo.com>

drm/bridge: lt9611: Remove redundant dev_err()

This commit removes a redundant dev_err() message on failure to request
the devm-managed IRQ, as the core already logs detailed error messages
on failure.

> diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
> index b6a368f712853..05950cbc0a90f 100644
> --- a/drivers/gpu/drm/bridge/lontium-lt9611.c
> +++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
[ ... ]
> @@ -1156,10 +1156,8 @@ static int lt9611_probe(struct i2c_client *client)
>  	ret = devm_request_threaded_irq(dev, client->irq, NULL,
>  					lt9611_irq_thread_handler,
>  					IRQF_ONESHOT, "lt9611", lt9611);
> -	if (ret) {
> -		dev_err(dev, "failed to request irq\n");
> +	if (ret)
>  		goto err_disable_regulators;

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a potential
interrupt storm in the error handling path for this IRQ request.

If a subsequent initialization step fails (for example, if
lt9611_attach_dsi() returns -EPROBE_DEFER), the probe function jumps to
err_disable_regulators:

err_disable_regulators:
        regulator_bulk_disable(ARRAY_SIZE(lt9611->supplies),
                               lt9611->supplies);

Because the IRQ is managed by devres (devm_request_threaded_irq()), it
remains active until the probe function returns and the devres cleanup
runs.

If the IRQ fires during this window while the regulators are disabled,
lt9611_irq_thread_handler() will attempt to communicate with the unpowered
device via I2C to read and clear the interrupt flag:

lt9611_irq_thread_handler() {
        ...
        regmap_read(lt9611->regmap, 0x820f, &irq_flag3);
        ...
}

Since the device is unpowered, the read will fail, the interrupt will not
be cleared in hardware, and the handler will still return IRQ_HANDLED.

Will this cause the interrupt controller to immediately re-trigger the
handler, leading to a soft or hard CPU lockup?

While lt9611_remove() correctly calls disable_irq() before disabling
regulators, is a similar disable_irq() call needed in this probe error
path before regulator_bulk_disable()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723131649.134127-1-panchuang@vivo.com?part=3

Re: [PATCH 02/10] drm/bridge: cdns-mhdp8546: Remove redundant dev_err()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free in cdns_mhdp_remove() due to active interrupt handler rescheduling work
- [High] Uninitialized workqueue and waitqueue accessed by interrupt handler on probe
- [High] Use-After-Free due to asynchronous firmware loading timeout in cdns_mhdp_remove()
--

--- Patch [2]: [PATCH 02/10] drm/bridge: cdns-mhdp8546: Remove redundant dev_err() ---
commit bcaae5554e2b18efb874ecbcbc1b83f650920be8
Author: Pan Chuang <panchuang@vivo.com>

    drm/bridge: cdns-mhdp8546: Remove redundant dev_err()

This commit removes a redundant dev_err() call after devm_request_threaded_irq()
fails. The genirq subsystem already logs detailed error messages automatically,
making the driver-specific print unnecessary.

> diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
> index 504a3186ebb3a..f47717bd10798 100644
> --- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
> +++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
> @@ -2343,7 +2343,6 @@ static int cdns_mhdp_probe(struct platform_device *pdev)
>  					cdns_mhdp_irq_handler, IRQF_ONESHOT,
>  					"mhdp8546", mhdp);

[Severity: High]
This is a pre-existing issue, but waitqueues and workqueues accessed by the
interrupt handler are uninitialized at this point.

Because devm_request_threaded_irq() enables the interrupt immediately, an
active interrupt line from the bootloader could trigger cdns_mhdp_irq_handler()
before the driver initializes mhdp->sw_events_wq and mhdp->hpd_work.

Will the interrupt handler trigger a kernel panic due to iterating over
uninitialized waitqueue list heads if the interrupt fires early?

>  	if (ret) {
> -		dev_err(dev, "cannot install IRQ %d\n", irq);
>  		ret = -EIO;
>  		goto plat_fini;
>  	}

[Severity: High]
This is a pre-existing issue, but using devm_request_threaded_irq() without
explicitly disabling the irq creates a use-after-free window in
cdns_mhdp_remove().

Because the devm action frees the IRQ after cdns_mhdp_remove() returns, the
interrupt remains fully active during driver unbind:

drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c:cdns_mhdp_remove() {
	...
	cancel_work_sync(&mhdp->modeset_retry_work);
	flush_work(&mhdp->hpd_work);
	/* Ignoring mhdp->hdcp.check_work and mhdp->hdcp.prop_work here. */
}

Could the active interrupt handler reschedule mhdp->hpd_work after flush_work()
completes, leading to a use-after-free when the devres cleanup subsequently
frees the mhdp structure?

[Severity: High]
This is a pre-existing issue, but is it safe to use a strict 100ms timeout in
cdns_mhdp_remove() while firmware is still loading?

drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c:cdns_mhdp_remove() {
	...
	unsigned long timeout = msecs_to_jiffies(100);
	...
	ret = wait_event_timeout(mhdp->fw_load_wq,
				 mhdp->hw_state == MHDP_HW_READY,
				 timeout);
	...
}

If the asynchronous firmware request takes longer than 100ms (e.g. waiting for
a user-mode helper fallback which times out after 60s), remove() will proceed
and devres will free the mhdp structure.

When the firmware subsystem later invokes cdns_mhdp_fw_cb(), won't it
dereference the freed mhdp context pointer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723131649.134127-1-panchuang@vivo.com?part=2

Re: [PATCH 00/10] drm/bridge: Remove redundant error messages on IRQ request failure

[Luca Ceresoli]

On Thu, 23 Jul 2026 21:16:32 +0800, Pan Chuang <panchuang@vivo.com> wrote:
> drm/bridge: Remove redundant error messages on IRQ request failure
> 
> Commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()") added automatic error logging to
> devm_request_threaded_irq() and devm_request_any_context_irq()
> via the new devm_request_result() helper, which prints device
> name, IRQ number, handler functions, and error code on failure.
> 
> [...]

Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>

-- 
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [PATCH 01/10] drm/bridge: analogix_dp: Remove redundant dev_err()

[Damon Ding]

Hi Pan,

On 7/23/2026 9:16 PM, Pan Chuang wrote:
> Since commit
> 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
> devm_request_threaded_irq() automatically logs detailed error messages on
> failure. Remove the now-redundant driver-specific dev_err() call.
> 
> Signed-off-by: Pan Chuang <panchuang@vivo.com>
> ---
>   drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 4 +---
>   1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
> index 30c0c0b41d5a..566f1e5eb8cd 100644
> --- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
> +++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
> @@ -1414,10 +1414,8 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data)
>   					analogix_dp_hardirq,
>   					analogix_dp_irq_thread,
>   					irq_flags, "analogix-dp", dp);
> -	if (ret) {
> -		dev_err(&pdev->dev, "failed to request irq\n");
> +	if (ret)
>   		return ERR_PTR(ret);
> -	}
>   
>   	dp->aux.name = "DP-AUX";
>   	dp->aux.transfer = analogix_dpaux_transfer;

Reviewed-by: Damon Ding <damon.ding@rock-chips.com>