Re: [PATCH RESEND v3 5/6] soc: qcom: pmic-glink-altmode: pass down HPD_IRQ events

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free on device unbind due to uncancelled workqueue items.
--

commit c9a05fdb7ae95c5650ccfbbd12196c4169d2d1c4
Author: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>

soc: qcom: pmic-glink-altmode: pass down HPD_IRQ events
    
This commit updates the PMIC GLINK altmode driver to pass IRQ_HPD events
to the HPD bridge. This allows the events to be delivered to the DisplayPort
driver.

> diff --git a/drivers/soc/qcom/pmic_glink_altmode.c b/drivers/soc/qcom/pmic_glink_altmode.c
> --- a/drivers/soc/qcom/pmic_glink_altmode.c
> +++ b/drivers/soc/qcom/pmic_glink_altmode.c
> @@ -373,7 +373,11 @@ static void pmic_glink_altmode_worker(struct work_struct *work)
>  		else
>  			conn_status = connector_status_disconnected;
>  
> -		drm_aux_hpd_bridge_notify(&alt_port->bridge->dev, conn_status);
> +		drm_aux_hpd_bridge_notify_extra(&alt_port->bridge->dev,
> +						conn_status,
> +						alt_port->hpd_irq ?
> +						DRM_CONNECTOR_DP_IRQ_HPD :
> +						DRM_CONNECTOR_NO_EXTRA_STATUS);

While reviewing this change, I noticed a pre-existing issue with the lifecycle
of this work item.

The altmode structure is allocated using devm_kzalloc, and multiple work
items like alt_port->work and altmode->enable_work are initialized, but they
are never explicitly canceled during device teardown.

When the device is unbound, devres automatically frees the altmode structure.
If this work item is pending or executing concurrently on the system workqueue
during unbind, could it dereference the freed altmode or alt_port structures
and cause a use-after-free?

Should a cancel_work_sync action be registered via devm_add_action_or_reset
to ensure these work items are flushed before the memory is freed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260513-hpd-irq-events-v3-0-086857017f16@oss.qualcomm.com?part=5

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic