From: Heiko Stuebner <heiko@sntech.de>
To: Sandy Huang <hjc@rock-chips.com>,
Andy Yan <andy.yan@rock-chips.com>,
Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
Maxime Ripard <mripard@kernel.org>,
Thomas Zimmermann <tzimmermann@suse.de>,
Andrzej Hajda <andrzej.hajda@intel.com>,
Neil Armstrong <neil.armstrong@linaro.org>,
Robert Foss <rfoss@kernel.org>,
Laurent Pinchart <Laurent.pinchart@ideasonboard.com>,
Jonas Karlman <jonas@kwiboo.se>,
Jernej Skrabec <jernej.skrabec@gmail.com>,
Rob Herring <robh@kernel.org>,
Krzysztof Kozlowski <krzk+dt@kernel.org>,
Conor Dooley <conor+dt@kernel.org>,
David Airlie <airlied@gmail.com>, Simona Vetter <simona@ffwll.ch>,
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>,
Luca Ceresoli <luca.ceresoli@bootlin.com>,
Sebastian Reichel <sebastian.reichel@collabora.com>
Cc: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>,
Damon Ding <damon.ding@rock-chips.com>,
Dmitry Baryshkov <lumag@kernel.org>,
Alexey Charkov <alchark@gmail.com>,
dri-devel@lists.freedesktop.org,
linux-rockchip@lists.infradead.org, linux-kernel@vger.kernel.org,
devicetree@vger.kernel.org, kernel@collabora.com,
linux-arm-kernel@lists.infradead.org,
Sebastian Reichel <sebastian.reichel@collabora.com>
Subject: Re: [PATCH v2 02/12] drm/rockchip: dw_dp: Release core resources
Date: Tue, 02 Jun 2026 21:48:35 +0200 [thread overview]
Message-ID: <27595863.kmuVQn2iE0@phil> (raw)
In-Reply-To: <20260501-synopsys-dw-dp-improvements-v2-2-d7e7f6bac77f@collabora.com>
Am Freitag, 1. Mai 2026, 00:20:29 Mitteleuropäische Sommerzeit schrieb Sebastian Reichel:
> From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
>
> Core resources such as the DisplayPort AUX channel get initialized and
> registered during dw_dp_bind(), but are never unregistered, which may
> lead to memory leaks and/or use-after-free:
>
> [ 224.661371] BUG: KASAN: slab-use-after-free in device_is_dependent+0xe0/0x2b0
> [ 224.662015] Read of size 8 at addr ffff00011aee8550 by task modprobe/658
> [ 224.662612]
> [ 224.662752] CPU: 7 UID: 0 PID: 658 Comm: modprobe Not tainted 7.0.0-rc2-next-20260305 #14 PREEMPT
> [ 224.662759] Hardware name: Radxa ROCK 5B (DT)
> [ 224.662762] Call trace:
> [ 224.662764] show_stack+0x20/0x38 (C)
> [ 224.662772] dump_stack_lvl+0x6c/0x98
> [ 224.662777] print_report+0x160/0x4b8
> [ 224.662783] kasan_report+0xb4/0xe0
> [ 224.662790] __asan_report_load8_noabort+0x20/0x30
> [ 224.662796] device_is_dependent+0xe0/0x2b0
> [ 224.662802] device_is_dependent+0x108/0x2b0
> [ 224.662808] device_link_add+0x1f8/0x10b0
> [ 224.662813] devm_of_phy_get_by_index+0x120/0x200
> [ 224.662819] dw_dp_bind+0x34c/0xb10 [dw_dp]
> [ 224.662830] dw_dp_rockchip_bind+0x194/0x250 [rockchipdrm]
> [ 224.662864] component_bind_all+0x3a8/0x720
> [ 224.662869] rockchip_drm_bind+0x120/0x390 [rockchipdrm]
> [ 224.662899] try_to_bring_up_aggregate_device+0x76c/0x838
> [ 224.662904] component_master_add_with_match+0x1f4/0x230
> [ 224.662909] rockchip_drm_platform_probe+0x420/0x538 [rockchipdrm]
> [ 224.662939] platform_probe+0xe8/0x168
> [ 224.662945] really_probe+0x340/0x828
> [ 224.662950] __driver_probe_device+0x2e0/0x350
> [ 224.662954] driver_probe_device+0x80/0x140
> [ 224.662959] __driver_attach+0x398/0x460
> [ 224.662964] bus_for_each_dev+0xe0/0x198
> [ 224.662968] driver_attach+0x50/0x68
> [ 224.662972] bus_add_driver+0x2a0/0x4c0
> [ 224.662977] driver_register+0x294/0x360
> [ 224.662982] __platform_driver_register+0x7c/0x98
> [ 224.662987] rockchip_drm_init+0xc4/0xff8 [rockchipdrm]
>
> Since a previous commit exported dw_dp_unbind() function in DW DP core
> library to take care of the necessary cleanup, use this in the
> component's unbind() callback, as well as in its bind() error path.
>
> Fixes: d68ba7bac955 ("drm/rockchip: Add RK3588 DPTX output support")
> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
picked the same one from Cristian's series
next prev parent reply other threads:[~2026-06-02 19:49 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-30 22:20 [PATCH v2 00/12] Synopsys DisplayPort Controller improvements for Rockchip platforms Sebastian Reichel
2026-04-30 22:20 ` [PATCH v2 01/12] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel Sebastian Reichel
2026-06-02 19:48 ` Heiko Stuebner
2026-04-30 22:20 ` [PATCH v2 02/12] drm/rockchip: dw_dp: Release core resources Sebastian Reichel
2026-06-02 19:48 ` Heiko Stuebner [this message]
2026-04-30 22:20 ` [PATCH v2 03/12] drm/bridge: synopsys: dw-dp: Simplify driver data setting Sebastian Reichel
2026-04-30 22:20 ` [PATCH v2 04/12] drm/bridge: synopsys: dw-dp: Support MEDIA_BUS_FMT_FIXED Sebastian Reichel
2026-04-30 22:20 ` [PATCH v2 05/12] drm/bridge: synopsys: dw-dp: Add follow-up bridge support Sebastian Reichel
2026-05-19 11:08 ` Luca Ceresoli
2026-04-30 22:20 ` [PATCH v2 06/12] drm/bridge: Add out-of-band HPD notify handler Sebastian Reichel
2026-04-30 22:20 ` [PATCH v2 07/12] drm/rockchip: dw_dp: Implement out-of-band HPD handling Sebastian Reichel
2026-06-02 8:30 ` Chaoyi Chen
2026-04-30 22:20 ` [PATCH v2 08/12] drm/bridge: synopsys: dw-dp: Support software triggered OOB HPD Sebastian Reichel
2026-04-30 22:20 ` [PATCH v2 09/12] drm/bridge: synopsys: dw-dp: Add Runtime PM support Sebastian Reichel
2026-04-30 22:20 ` [PATCH v2 10/12] drm/rockchip: dw_dp: Add runtime " Sebastian Reichel
2026-04-30 22:20 ` [PATCH RFC v2 11/12] dt-bindings: display: rockchip: dw-dp: fix sound DAI cells Sebastian Reichel
2026-04-30 22:20 ` [PATCH v2 12/12] drm/bridge: synopsys: dw-dp: Add audio support Sebastian Reichel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=27595863.kmuVQn2iE0@phil \
--to=heiko@sntech.de \
--cc=Laurent.pinchart@ideasonboard.com \
--cc=airlied@gmail.com \
--cc=alchark@gmail.com \
--cc=andrzej.hajda@intel.com \
--cc=andy.yan@rock-chips.com \
--cc=conor+dt@kernel.org \
--cc=cristian.ciocaltea@collabora.com \
--cc=damon.ding@rock-chips.com \
--cc=devicetree@vger.kernel.org \
--cc=dmitry.baryshkov@oss.qualcomm.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=hjc@rock-chips.com \
--cc=jernej.skrabec@gmail.com \
--cc=jonas@kwiboo.se \
--cc=kernel@collabora.com \
--cc=krzk+dt@kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rockchip@lists.infradead.org \
--cc=luca.ceresoli@bootlin.com \
--cc=lumag@kernel.org \
--cc=maarten.lankhorst@linux.intel.com \
--cc=mripard@kernel.org \
--cc=neil.armstrong@linaro.org \
--cc=rfoss@kernel.org \
--cc=robh@kernel.org \
--cc=sebastian.reichel@collabora.com \
--cc=simona@ffwll.ch \
--cc=tzimmermann@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox