Re: [PATCH] drm/amd/display: Don't free devres-owned i2c adapter on init failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] drm/amd/display: leak and dangling ddc_service in
  amdgpu_dm_connector_init()
--

commit cd13d71ccba1fac1ae6d56da56c40ca922c6fa4a
Author: Lu Yao <yaolu@kylinos.cn>

drm/amd/display: Don't free devres-owned i2c adapter on init failure

This commit changes amdgpu_dm_connector_init() to return directly instead of
jumping to out_free when drm_connector_init_with_ddc() fails.

> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_connector.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_connector.c
> index b498fc5fbb140..ccbda54c3add8 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_connector.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_connector.c
> @@ -3514,7 +3514,7 @@ int amdgpu_dm_connector_init(struct amdgpu_display_manager *dm,
>  	if (res) {
>  		drm_err(adev_to_drm(dm->adev), "connector_init failed\n");
>  		aconnector->connector_id = -1;
> -		goto out_free;
> +		return res;
>  	}

[Severity: Medium]
Does returning here leak the struct amdgpu_i2c_adapter and leave the adapter
registered with a freed i2c->ddc_service during error unwind?

amdgpu_dm_create_i2c() allocates i2c with kzalloc_obj(), while
devm_i2c_add_adapter() only schedules i2c_del_adapter(&i2c->base) via devres
and never frees the enclosing struct amdgpu_i2c_adapter.  When
amdgpu_dm_connector_init() fails, amdgpu_dm_initialize_drm_device() frees
aconnector and loses the only pointer to i2c.

In addition, amdgpu_dm_init() calls amdgpu_dm_fini() -> dc_destroy(), which
frees link->ddc (i2c->ddc_service) before dm_hw_init() reaches
devres_release_group() to unregister &i2c->base.  Unregistering the adapter
and freeing i2c (or allocating i2c with devm_kzalloc() and releasing the
devres group before dc_destroy()) would avoid both the leak and the dangling
ddc_service window.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110070204.307887-1-yaolu@kylinos.cn?part=1