Re: [PATCH v2 07/11] drm/mediatek: mtk_dp: Add support for PHY from devicetree

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Double-unregister of the `mediatek-dp-phy` platform device on `devm_phy_get` failure.
--

--- Patch [7]: [PATCH v2 07/11] drm/mediatek: mtk_dp: Add support for PHY from devicetree ---
commit 21392ccaeb903069c1e4a92500d58612e1669daf
Author: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Subject: drm/mediatek: mtk_dp: Add support for PHY from devicetree

This commit adds support for parsing the DisplayPort PHY from the devicetree
via the phys property. For older devicetrees, it falls back to a legacy
configuration by registering a mediatek-dp-phy platform device and reading
legacy PHY calibration data.

> diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c
> index b4cb1996a3314..cabfc833c0a80 100644
> --- a/drivers/gpu/drm/mediatek/mtk_dp.c
> +++ b/drivers/gpu/drm/mediatek/mtk_dp.c

[ ... ]

> @@ -2754,6 +2775,7 @@ static int mtk_dp_register_phy(struct mtk_dp *mtk_dp)
>  		return dev_err_probe(dev, ret,
>  				     "Failed to add phy unregister devm action");
>  
> +	/* PHY calibration data is in mtk_dp only for legacy devicetree */
>  	mtk_dp_get_calibration_data(mtk_dp);
>  
>  	mtk_dp->phy = devm_phy_get(&mtk_dp->phy_dev->dev, "dp");

[Severity: High]
Does this code double-unregister the mediatek-dp-phy platform device?

Earlier in mtk_dp_register_phy(), mtk_dp->phy_dev is registered with devres:

	ret = devm_add_action_or_reset(dev, mtk_dp_unregister_pdevs,
				       mtk_dp->phy_dev);

If devm_phy_get() fails immediately after the lines modified above:

	mtk_dp->phy = devm_phy_get(&mtk_dp->phy_dev->dev, "dp");
	if (IS_ERR(mtk_dp->phy)) {
		platform_device_unregister(mtk_dp->phy_dev);
		return dev_err_probe(dev, PTR_ERR(mtk_dp->phy),
				     "Failed to get phy\n");
	}

It explicitly calls platform_device_unregister() on the failure path. Since
devres will also execute mtk_dp_unregister_pdevs() (which unregisters the
same device) when probe fails, can this lead to a double-free and list
corruption in the driver core?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709100617.42583-1-angelogioacchino.delregno@collabora.com?part=7