Re: [PATCH v7 03/18] drm/bridge: synopsys: dw-dp: Add missing mutex cleanups on module removal

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The DRM bridge is exposed to the system before its backing resources are fully initialized, leading to a reverse-order teardown Use-After-Free (UAF) vulnerability.
--

--- Patch [3]: [PATCH v7 03/18] drm/bridge: synopsys: dw-dp: Add missing mutex cleanups on module removal ---
commit 374a35fd683724436ba90569775efd9aa551c376
Author: Sebastian Reichel <sebastian.reichel@collabora.com>

drm/bridge: synopsys: dw-dp: Add missing mutex cleanups on module removal
    
The driver is currently missing to fully clean up after itself. Ensure
that the mutex is cleaned up.

> diff --git a/drivers/gpu/drm/bridge/synopsys/dw-dp.c b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> index 8393f9c9b0f00..ca7ff544d243a 100644
> --- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> +++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> @@ -2028,10 +2028,13 @@ struct dw_dp *dw_dp_probe(struct platform_device *pdev, const struct dw_dp_plat_
>  	if (ret)
>  		return ERR_PTR(ret);
>  

[Severity: High]
This is a pre-existing issue, but since this patch focuses on teardown
cleanups, could the early bridge registration cause a use-after-free
during driver unbind?

Because devres executes cleanup callbacks in reverse order of initialization,
the bridge remains registered globally while its backing resources, such
as dp->regmap, are freed.

If an administrator triggers a driver unbind, a concurrent DRM operation
(like a DRM_IOCTL_MODE_GETCONNECTOR ioctl) querying the connector state
could invoke bridge->funcs->detect(), leading to a dereference of the freed
regmap:

dw_dp_bridge_detect()
  dw_dp_hpd_detect(dp)
    regmap_read(dp->regmap, ...)

Should the bridge be registered later in the probe function, after all
hardware resources are allocated, to avoid this reverse-order teardown race?

> -	mutex_init(&dp->irq_lock);
>  	INIT_WORK(&dp->hpd_work, dw_dp_hpd_work);
>  	init_completion(&dp->complete);
>  
> +	ret = devm_mutex_init(dev, &dp->irq_lock);
> +	if (ret)
> +		return ERR_PTR(ret);
> +
>  	res = devm_platform_ioremap_resource(pdev, 0);
>  	if (IS_ERR(res))
>  		return ERR_CAST(res);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260728-synopsys-dw-dp-improvements-v7-0-b7640fa8cf48@collabora.com?part=3