Re: [PATCH v2 44/59] drm/bridge: synopsys: dw-hdmi: Convert to atomic_create_state

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/bridge: dw-hdmi: missing connector cleanup in dw_hdmi_connector_create()
--

commit 79a659d48a2ba43f6a6effe5800fc818debe3d47
Author: Maxime Ripard <mripard@kernel.org>

drm/bridge: synopsys: dw-hdmi: Convert to atomic_create_state

This commit replaces the call to drm_atomic_helper_connector_reset() in
dw_hdmi_connector_create() with drm_atomic_helper_connector_create_state() to
allocate the initial connector state required by
drm_connector_attach_max_bpc_property().

> diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
> index 917cf764c9c5d..5f11707c67b5c 100644
> --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
> +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
> @@ -2605,7 +2605,15 @@ static int dw_hdmi_connector_create(struct dw_hdmi *hdmi)
>  	 * drm_connector_attach_max_bpc_property() requires the
>  	 * connector to have a state.
>  	 */
> -	drm_atomic_helper_connector_reset(connector);
> +	if (!connector->state) {
> +		struct drm_connector_state *conn_state;
> +
> +		conn_state = drm_atomic_helper_connector_create_state(connector);
> +		if (IS_ERR(conn_state))
> +			return PTR_ERR(conn_state);

[Severity: High]
If drm_atomic_helper_connector_create_state() fails in
dw_hdmi_connector_create() in drivers/gpu/drm/bridge/synopsys/dw-hdmi.c,
does returning PTR_ERR(conn_state) directly leak the initialized connector
and leave &hdmi->connector linked on dev->mode_config.connector_list?

Just before allocating the state, dw_hdmi_connector_create() initializes
the unmanaged embedded connector:

	drm_connector_init_with_ddc(hdmi->bridge.dev, connector,
				    &dw_hdmi_connector_funcs,
				    DRM_MODE_CONNECTOR_HDMIA,
				    hdmi->ddc);

which registers &connector->base in dev->mode_config.object_idr, allocates
connector->name, and adds &connector->head to
dev->mode_config.connector_list.

When dw_hdmi_connector_create() returns an error via
dw_hdmi_bridge_attach() -> drm_bridge_attach() during component binding,
dw_hdmi_bind() cleans up the bridge and component_bind() in
drivers/base/component.c releases the component devres group, freeing
struct dw_hdmi while &hdmi->connector remains on
dev->mode_config.connector_list. When the master driver later runs
drm_mode_config_cleanup() in drivers/gpu/drm/drm_mode_config.c, iterating
connector_list will dereference the already-freed &hdmi->connector.

Should this error path call drm_connector_cleanup(connector) before
returning?

> +
> +		connector->state = conn_state;
> +	}
>  
>  	drm_connector_attach_max_bpc_property(connector, 8, 16);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261022-drm-no-more-connector-reset-v2-0-0b7e4e85b1e8@kernel.org?part=44