Re: [PATCH v2] drm/amd/display: Fix dm i2c adapter lifetime on teardown

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] drm/amd/display: NULL deref and bad kfree() in
  amdgpu_dm_create_i2c() tests
--

commit 34d2cc7ca5025a414952478c53098d172f5f6cc4
Author: Lu Yao <yaolu@kylinos.cn>

drm/amd/display: Fix dm i2c adapter lifetime on teardown

This commit allocates struct amdgpu_i2c_adapter with devm_kzalloc_obj()
and moves the release of dm.i2c_devres_group into amdgpu_dm_fini() before
dc_destroy().

> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_connector.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_connector.c
> index 8db7956c01d32..ae99058dafba4 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_connector.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_connector.c
> @@ -3437,7 +3437,7 @@ amdgpu_dm_create_i2c(struct ddc_service *ddc_service, bool oem)
>  	struct amdgpu_device *adev = ddc_service->ctx->driver_context;
>  	struct amdgpu_i2c_adapter *i2c;
>  
> -	i2c = kzalloc_obj(struct amdgpu_i2c_adapter);
> +	i2c = devm_kzalloc_obj(adev->dev, struct amdgpu_i2c_adapter);

[Severity: Medium]
Does switching amdgpu_dm_create_i2c() to devm_kzalloc_obj() break the
dm_test_create_i2c_oem() and dm_test_create_i2c_hw_bus() KUnit tests in
drivers/gpu/drm/amd/display/amdgpu_dm/tests/amdgpu_dm_connector_test.c?

dm_test_create_i2c_setup() leaves ctx->adev->dev as NULL, so
devm_kzalloc_obj(adev->dev, ...) triggers a NULL pointer dereference in
devres_node_add() when locking dev->devres_lock.  Both tests also call
raw kfree(i2c) on the returned pointer, which is no longer valid for a
devres-managed allocation.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111021925.63610-1-yaolu@kylinos.cn?part=1