[PATCH v2] drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

[PATCH v2] drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

[Li Youhong]

From: Li Youhong <liyouhong@kylinos.cn>

When the Exynos DSI driver was generalized into samsung-dsim, the TE
GPIO acquisition was switched from gpiod_get_optional() to
devm_gpiod_get_optional() while keeping the matching gpiod_put() calls.
That combination is wrong for a managed descriptor.

However, dropping the puts and keeping the managed get is also wrong:
samsung_dsim_register_te_irq() runs from the DSI host attach callback,
and host detach/reattach can happen without destroying the device that
owns the managed action. A second attach would then request the GPIO
again without having released it.

Switch back to a non-managed gpiod_get_optional() and keep the explicit
gpiod_put() on the request_irq() error path and in
samsung_dsim_unregister_te_irq().

Fixes: e7447128ca4a ("drm: bridge: Generalize Exynos-DSI driver into a Samsung DSIM bridge")
Suggested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Li Youhong <liyouhong@kylinos.cn>
---
v2:
- Prefer non-devm gpiod_get_optional() and keep gpiod_put(), because TE
  GPIO is acquired in host attach and must be released on host detach

 drivers/gpu/drm/bridge/samsung-dsim.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/bridge/samsung-dsim.c
+++ b/drivers/gpu/drm/bridge/samsung-dsim.c
@@ -1862,7 +1862,8 @@ static int samsung_dsim_register_te_irq(struct samsung_dsim *dsi, struct device
 	int te_gpio_irq;
 	int ret;
 
-	dsi->te_gpio = devm_gpiod_get_optional(dev, "te", GPIOD_IN);
+	/* Released on host detach; do not use the managed get. */
+	dsi->te_gpio = gpiod_get_optional(dev, "te", GPIOD_IN);
 	if (!dsi->te_gpio)
 		return 0;
 	else if (IS_ERR(dsi->te_gpio))
-- 
2.25.1

Re: [PATCH v2] drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] dsi->te_gpio is not cleared to NULL after being freed via gpiod_put() or after an ERR_PTR assignment. This leaves a dangling pointer that can lead to Use-After-Free and Double-Free bugs on subsequent attach/detach cycles or IRQ enable/disable operations.
--

commit ae0d9af500f3fda4ddfaac130c60cd01aa1ce58f
Author: Li Youhong <liyouhong@kylinos.cn>
Subject: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

This commit switches the TE GPIO acquisition back from
devm_gpiod_get_optional() to gpiod_get_optional() to fix a lifetime issue on
host detach/reattach. It keeps explicit gpiod_put() calls on the error path
and in samsung_dsim_unregister_te_irq().

> diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c
> index e2fc69fc51b60..8f3fd50e52f80 100644
> --- a/drivers/gpu/drm/bridge/samsung-dsim.c
> +++ b/drivers/gpu/drm/bridge/samsung-dsim.c
> @@ -1862,7 +1862,8 @@ static int samsung_dsim_register_te_irq(struct samsung_dsim *dsi, struct device
>  	int te_gpio_irq;
>  	int ret;
>  
> -	dsi->te_gpio = devm_gpiod_get_optional(dev, "te", GPIOD_IN);
> +	/* Released on host detach; do not use the managed get. */
> +	dsi->te_gpio = gpiod_get_optional(dev, "te", GPIOD_IN);
>  	if (!dsi->te_gpio)
>  		return 0;
>  	else if (IS_ERR(dsi->te_gpio))

[Severity: High]
This is a pre-existing issue, but is it possible we are leaving a dangling
pointer in dsi->te_gpio here?

If gpiod_get_optional() fails, dsi->te_gpio is assigned an error pointer and
the function returns early, leaving the error pointer exposed in the dsi
struct. If a video-mode panel is later attached and samsung_dsim_enable_irq()
is called, could this lead to an invalid memory access when it operates on the
error pointer?

There appear to be similar pre-existing issues where dsi->te_gpio isn't
cleared to NULL after being freed. For example, further down in the error
handling of samsung_dsim_register_te_irq():

	if (ret) {
		dev_err(dsi->dev, "request interrupt failed with %d\n", ret);
		gpiod_put(dsi->te_gpio);
		return ret;
	}

And in samsung_dsim_unregister_te_irq():

	if (dsi->te_gpio) {
		free_irq(gpiod_to_irq(dsi->te_gpio), dsi);
		gpiod_put(dsi->te_gpio);
	}

Since this patch addresses detach/reattach cycles where the device isn't
destroyed, if we switch from a command-mode panel to a video-mode panel,
could these dangling pointers lead to a use-after-free or double-free on a
subsequent cycle?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904014958.1572918-1-dayou5941@163.com?part=1

Re: [PATCH v2] drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

[Luca Ceresoli]

Hello Li,

On Fri Sep 4, 2026 at 3:49 AM CEST, Li Youhong wrote:
> From: Li Youhong <liyouhong@kylinos.cn>
>
> When the Exynos DSI driver was generalized into samsung-dsim, the TE
> GPIO acquisition was switched from gpiod_get_optional() to
> devm_gpiod_get_optional() while keeping the matching gpiod_put() calls.
> That combination is wrong for a managed descriptor.
>
> However, dropping the puts and keeping the managed get is also wrong:
> samsung_dsim_register_te_irq() runs from the DSI host attach callback,
> and host detach/reattach can happen without destroying the device that
> owns the managed action. A second attach would then request the GPIO
> again without having released it.
>
> Switch back to a non-managed gpiod_get_optional() and keep the explicit
> gpiod_put() on the request_irq() error path and in
> samsung_dsim_unregister_te_irq().
>
> Fixes: e7447128ca4a ("drm: bridge: Generalize Exynos-DSI driver into a Samsung DSIM bridge")
> Suggested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
> Signed-off-by: Li Youhong <liyouhong@kylinos.cn>
> ---
> v2:
> - Prefer non-devm gpiod_get_optional() and keep gpiod_put(), because TE
>   GPIO is acquired in host attach and must be released on host detach
>
>  drivers/gpu/drm/bridge/samsung-dsim.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> --- a/drivers/gpu/drm/bridge/samsung-dsim.c
> +++ b/drivers/gpu/drm/bridge/samsung-dsim.c
> @@ -1862,7 +1862,8 @@ static int samsung_dsim_register_te_irq(struct samsung_dsim *dsi, struct device
>  	int te_gpio_irq;
>  	int ret;
>
> -	dsi->te_gpio = devm_gpiod_get_optional(dev, "te", GPIOD_IN);
> +	/* Released on host detach; do not use the managed get. */
> +	dsi->te_gpio = gpiod_get_optional(dev, "te", GPIOD_IN);

The comment is not really needed, this should be obvious by reading the
code. No need to resend just for that, I can remove it while applying.

Other than that it's OK:
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>

Luca

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com