Re: [PATCH v7 09/12] drm/bridge: auto-link panel backlight in bridge connector

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing cleanup of `drm_backlight_link()` on probe error paths causes a Use-After-Free on a global list and a reference leak.
--

commit a0dd986fcfc01d36a6bb91afe25a294e80d0f4e6
Author: Mario Limonciello <mario.limonciello@amd.com>

drm/bridge: auto-link panel backlight in bridge connector

This commit links a panel's backlight_device to the bridge connector so
luminance-aware clients can drive it through the LUMINANCE property.

> diff --git a/drivers/gpu/drm/display/drm_bridge_connector.c b/drivers/gpu/drm/display/drm_bridge_connector.c
> index 8b54069fa53a4..d4b4e59cea51c 100644
> --- a/drivers/gpu/drm/display/drm_bridge_connector.c
> +++ b/drivers/gpu/drm/display/drm_bridge_connector.c
[ ... ]
> @@ -1082,9 +1084,16 @@ struct drm_connector *drm_bridge_connector_init(struct drm_device *drm,
>  		connector->polled = DRM_CONNECTOR_POLL_CONNECT
>  				  | DRM_CONNECTOR_POLL_DISCONNECT;
>  
> -	if (panel_bridge)
> +	if (panel_bridge) {
> +		struct drm_panel *panel;
> +
>  		drm_panel_bridge_set_orientation(connector, panel_bridge);
>  
> +		panel = drm_panel_bridge_to_panel(panel_bridge);
> +		if (panel && panel->backlight)
> +			drm_backlight_link(connector, panel->backlight);

[Severity: High]
Does this cause a use-after-free and a reference leak on probe error paths?

During early initialization here, drm_backlight_link() links the connector's
backlight to the global list. If the driver's probe function subsequently
fails before calling drm_dev_register() (e.g., due to EPROBE_DEFER or
hardware errors), the device is never registered.

Because drm_connector_unregister() is never called in this error path, the
backlight is not unlinked. Later, when drmm managed cleanup runs
drm_connector_cleanup(), it calls drm_backlight_connector_cleanup().

Looking at drm_backlight_connector_cleanup():

void drm_backlight_connector_cleanup(struct drm_connector *connector)
{
	struct drm_backlight *b = &connector->backlight;

	WARN_ON(__drm_backlight_is_linked(b));
	WARN_ON(b->funcs);
	WARN_ON(b->luminance_clients);
}

This function only warns and does not actually unlink the backlight. The
connector is then freed, leaving a dangling pointer in the global
drm_backlight_list. Iterating this global list later (e.g., during backlight
brightness changes) could dereference the freed connector memory.

> +	}
> +
>  	if (support_hdcp && IS_REACHABLE(CONFIG_DRM_DISPLAY_HELPER) &&
>  	    IS_ENABLED(CONFIG_DRM_DISPLAY_HDCP_HELPER))
>  		drm_connector_attach_content_protection_property(connector, true);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831210531.2334221-1-mario.limonciello@amd.com?part=9