Re: [PATCH v5 04/15] drm/bridge: synopsys: dw-dp: Move dw_dp_bridge_atomic_get_output_bus_fmts()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The dynamically allocated `output_fmts` array is leaked when no matching bus formats are found.
--

--- Patch [4]: [PATCH v5 04/15] drm/bridge: synopsys: dw-dp: Move dw_dp_bridge_atomic_get_output_bus_fmts() ---
commit c989bc992dcfd432abf52123b03475b9fb318ca0
Author: Sebastian Reichel <sebastian.reichel@collabora.com>

drm/bridge: synopsys: dw-dp: Move dw_dp_bridge_atomic_get_output_bus_fmts()

This commit moves dw_dp_bridge_atomic_get_output_bus_fmts() before
dw_dp_bridge_atomic_check() in preparation for reusing it. No functional
changes are intended.

> diff --git a/drivers/gpu/drm/bridge/synopsys/dw-dp.c b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> index b28040d69fabf..3dec7777fb285 100644
> --- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> +++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c

[ ... ]

> @@ -1522,6 +1522,54 @@ static ssize_t dw_dp_aux_transfer(struct drm_dp_aux *aux,
>   * 2. the minimum hsync should be 9 pixel;
>   * 3. the minimum hbp should be 16 pixel;
>   */
> +static u32 *dw_dp_bridge_atomic_get_output_bus_fmts(struct drm_bridge *bridge,
> +						    struct drm_bridge_state *bridge_state,
> +						    struct drm_crtc_state *crtc_state,
> +						    struct drm_connector_state *conn_state,
> +						    unsigned int *num_output_fmts)
> +{

[ ... ]

> +	output_fmts = kcalloc(ARRAY_SIZE(dw_dp_output_formats), sizeof(*output_fmts), GFP_KERNEL);
> +	if (!output_fmts)
> +		return NULL;
> +
> +	for (i = 0; i < ARRAY_SIZE(dw_dp_output_formats); i++) {

[ ... ]

> +		if (!dw_dp_bandwidth_ok(dp, &mode, fmt->bpp, link->lanes, link->rate))
> +			continue;
> +
> +		output_fmts[j++] = fmt->bus_format;
> +	}
> +
> +	*num_output_fmts = j;
> +
> +	return output_fmts;

[Severity: High]
This isn't a bug introduced by this patch, but does this code leak the
dynamically allocated output_fmts array when no formats match?

If a display mode has a very high pixel clock, dw_dp_bandwidth_ok() might 
return false for all formats, leaving j as 0. The function then sets 
*num_output_fmts = 0 and returns the allocated output_fmts array.

In the DRM core, if drm_atomic_bridge_chain_select_bus_fmts() receives 0 in
num_out_bus_fmts, it immediately returns -ENOTSUPP without calling kfree() 
on the returned pointer. Since this can be repeatedly triggered via the 
atomic test ioctl by a process with DRM Master privileges, could this be 
exploited to exhaust memory?

> +}

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724-synopsys-dw-dp-improvements-v5-0-9445c2e87441@collabora.com?part=4