* [PATCH v3 1/2] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
2026-03-27 0:55 [PATCH v3 0/2] Rockchip DRM use-after-free & null-ptr-deref fixes Cristian Ciocaltea
@ 2026-03-27 0:55 ` Cristian Ciocaltea
2026-05-31 10:27 ` Andy Yan
2026-03-27 0:55 ` [PATCH v3 2/2] drm/rockchip: dw_dp: Release core resources Cristian Ciocaltea
2026-05-30 11:29 ` [PATCH v3 0/2] Rockchip DRM use-after-free & null-ptr-deref fixes Diederik de Haas
2 siblings, 1 reply; 7+ messages in thread
From: Cristian Ciocaltea @ 2026-03-27 0:55 UTC (permalink / raw)
To: Sandy Huang, Heiko Stübner, Andy Yan, Maarten Lankhorst,
Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
Dmitry Baryshkov, Dmitry Baryshkov, Andrzej Hajda, Neil Armstrong,
Robert Foss, Laurent Pinchart, Jonas Karlman, Jernej Skrabec
Cc: kernel, dri-devel, linux-arm-kernel, linux-rockchip, linux-kernel
The DisplayPort AUX channel gets initialized and registered during
dw_dp_bind(), but it is never unregistered, which may lead to resource
leaks and/or use-after-free.
Add the missing dw_dp_unbind() function to allow the users of the
library to handle the required cleanup, i.e. unregister the AUX adapter.
Fixes: 86eecc3a9c2e ("drm/bridge: synopsys: Add DW DPTX Controller support library")
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
---
drivers/gpu/drm/bridge/synopsys/dw-dp.c | 6 ++++++
include/drm/bridge/dw_dp.h | 1 +
2 files changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/bridge/synopsys/dw-dp.c b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
index 3f4530c117c7..6211ba6ba7bd 100644
--- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
@@ -2093,6 +2093,12 @@ struct dw_dp *dw_dp_bind(struct device *dev, struct drm_encoder *encoder,
}
EXPORT_SYMBOL_GPL(dw_dp_bind);
+void dw_dp_unbind(struct dw_dp *dp)
+{
+ drm_dp_aux_unregister(&dp->aux);
+}
+EXPORT_SYMBOL_GPL(dw_dp_unbind);
+
MODULE_AUTHOR("Andy Yan <andyshrk@163.com>");
MODULE_DESCRIPTION("DW DP Core Library");
MODULE_LICENSE("GPL");
diff --git a/include/drm/bridge/dw_dp.h b/include/drm/bridge/dw_dp.h
index 25363541e69d..22105c3e8e4d 100644
--- a/include/drm/bridge/dw_dp.h
+++ b/include/drm/bridge/dw_dp.h
@@ -24,4 +24,5 @@ struct dw_dp_plat_data {
struct dw_dp *dw_dp_bind(struct device *dev, struct drm_encoder *encoder,
const struct dw_dp_plat_data *plat_data);
+void dw_dp_unbind(struct dw_dp *dp);
#endif /* __DW_DP__ */
--
2.52.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH v3 1/2] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
2026-03-27 0:55 ` [PATCH v3 1/2] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel Cristian Ciocaltea
@ 2026-05-31 10:27 ` Andy Yan
0 siblings, 0 replies; 7+ messages in thread
From: Andy Yan @ 2026-05-31 10:27 UTC (permalink / raw)
To: Cristian Ciocaltea, Sandy Huang, Heiko Stübner,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Dmitry Baryshkov, Dmitry Baryshkov, Andrzej Hajda,
Neil Armstrong, Robert Foss, Laurent Pinchart, Jonas Karlman,
Jernej Skrabec
Cc: kernel, dri-devel, linux-arm-kernel, linux-rockchip, linux-kernel
Hello,
On 3/27/26 08:55, Cristian Ciocaltea wrote:
> The DisplayPort AUX channel gets initialized and registered during
> dw_dp_bind(), but it is never unregistered, which may lead to resource
> leaks and/or use-after-free.
>
> Add the missing dw_dp_unbind() function to allow the users of the
> library to handle the required cleanup, i.e. unregister the AUX adapter.
>
> Fixes: 86eecc3a9c2e ("drm/bridge: synopsys: Add DW DPTX Controller support library")
> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Reviewed-by: Andy Yan <andy.yan@rock-chips.com>
Thanks.
> ---
> drivers/gpu/drm/bridge/synopsys/dw-dp.c | 6 ++++++
> include/drm/bridge/dw_dp.h | 1 +
> 2 files changed, 7 insertions(+)
>
> diff --git a/drivers/gpu/drm/bridge/synopsys/dw-dp.c b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> index 3f4530c117c7..6211ba6ba7bd 100644
> --- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> +++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> @@ -2093,6 +2093,12 @@ struct dw_dp *dw_dp_bind(struct device *dev, struct drm_encoder *encoder,
> }
> EXPORT_SYMBOL_GPL(dw_dp_bind);
>
> +void dw_dp_unbind(struct dw_dp *dp)
> +{
> + drm_dp_aux_unregister(&dp->aux);
> +}
> +EXPORT_SYMBOL_GPL(dw_dp_unbind);
> +
> MODULE_AUTHOR("Andy Yan <andyshrk@163.com>");
> MODULE_DESCRIPTION("DW DP Core Library");
> MODULE_LICENSE("GPL");
> diff --git a/include/drm/bridge/dw_dp.h b/include/drm/bridge/dw_dp.h
> index 25363541e69d..22105c3e8e4d 100644
> --- a/include/drm/bridge/dw_dp.h
> +++ b/include/drm/bridge/dw_dp.h
> @@ -24,4 +24,5 @@ struct dw_dp_plat_data {
>
> struct dw_dp *dw_dp_bind(struct device *dev, struct drm_encoder *encoder,
> const struct dw_dp_plat_data *plat_data);
> +void dw_dp_unbind(struct dw_dp *dp);
> #endif /* __DW_DP__ */
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v3 2/2] drm/rockchip: dw_dp: Release core resources
2026-03-27 0:55 [PATCH v3 0/2] Rockchip DRM use-after-free & null-ptr-deref fixes Cristian Ciocaltea
2026-03-27 0:55 ` [PATCH v3 1/2] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel Cristian Ciocaltea
@ 2026-03-27 0:55 ` Cristian Ciocaltea
2026-05-31 10:29 ` Andy Yan
2026-05-30 11:29 ` [PATCH v3 0/2] Rockchip DRM use-after-free & null-ptr-deref fixes Diederik de Haas
2 siblings, 1 reply; 7+ messages in thread
From: Cristian Ciocaltea @ 2026-03-27 0:55 UTC (permalink / raw)
To: Sandy Huang, Heiko Stübner, Andy Yan, Maarten Lankhorst,
Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
Dmitry Baryshkov, Dmitry Baryshkov, Andrzej Hajda, Neil Armstrong,
Robert Foss, Laurent Pinchart, Jonas Karlman, Jernej Skrabec
Cc: kernel, dri-devel, linux-arm-kernel, linux-rockchip, linux-kernel
Core resources such as the DisplayPort AUX channel get initialized and
registered during dw_dp_bind(), but are never unregistered, which may
lead to memory leaks and/or use-after-free:
[ 224.661371] BUG: KASAN: slab-use-after-free in device_is_dependent+0xe0/0x2b0
[ 224.662015] Read of size 8 at addr ffff00011aee8550 by task modprobe/658
[ 224.662612]
[ 224.662752] CPU: 7 UID: 0 PID: 658 Comm: modprobe Not tainted 7.0.0-rc2-next-20260305 #14 PREEMPT
[ 224.662759] Hardware name: Radxa ROCK 5B (DT)
[ 224.662762] Call trace:
[ 224.662764] show_stack+0x20/0x38 (C)
[ 224.662772] dump_stack_lvl+0x6c/0x98
[ 224.662777] print_report+0x160/0x4b8
[ 224.662783] kasan_report+0xb4/0xe0
[ 224.662790] __asan_report_load8_noabort+0x20/0x30
[ 224.662796] device_is_dependent+0xe0/0x2b0
[ 224.662802] device_is_dependent+0x108/0x2b0
[ 224.662808] device_link_add+0x1f8/0x10b0
[ 224.662813] devm_of_phy_get_by_index+0x120/0x200
[ 224.662819] dw_dp_bind+0x34c/0xb10 [dw_dp]
[ 224.662830] dw_dp_rockchip_bind+0x194/0x250 [rockchipdrm]
[ 224.662864] component_bind_all+0x3a8/0x720
[ 224.662869] rockchip_drm_bind+0x120/0x390 [rockchipdrm]
[ 224.662899] try_to_bring_up_aggregate_device+0x76c/0x838
[ 224.662904] component_master_add_with_match+0x1f4/0x230
[ 224.662909] rockchip_drm_platform_probe+0x420/0x538 [rockchipdrm]
[ 224.662939] platform_probe+0xe8/0x168
[ 224.662945] really_probe+0x340/0x828
[ 224.662950] __driver_probe_device+0x2e0/0x350
[ 224.662954] driver_probe_device+0x80/0x140
[ 224.662959] __driver_attach+0x398/0x460
[ 224.662964] bus_for_each_dev+0xe0/0x198
[ 224.662968] driver_attach+0x50/0x68
[ 224.662972] bus_add_driver+0x2a0/0x4c0
[ 224.662977] driver_register+0x294/0x360
[ 224.662982] __platform_driver_register+0x7c/0x98
[ 224.662987] rockchip_drm_init+0xc4/0xff8 [rockchipdrm]
Since a previous commit exported dw_dp_unbind() function in DW DP core
library to take care of the necessary cleanup, use this in the
component's unbind() callback, as well as in its bind() error path.
Fixes: d68ba7bac955 ("drm/rockchip: Add RK3588 DPTX output support")
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
---
drivers/gpu/drm/rockchip/dw_dp-rockchip.c | 20 +++++++++++++++++---
1 file changed, 17 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
index 22c0911f1896..8cba90d2dd56 100644
--- a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
@@ -108,14 +108,28 @@ static int dw_dp_rockchip_bind(struct device *dev, struct device *master, void *
connector = drm_bridge_connector_init(drm_dev, encoder);
if (IS_ERR(connector))
- return dev_err_probe(dev, PTR_ERR(connector),
- "Failed to init bridge connector");
+ ret = dev_err_probe(dev, PTR_ERR(connector),
+ "Failed to init bridge connector");
+ else
+ ret = drm_connector_attach_encoder(connector, encoder);
- return drm_connector_attach_encoder(connector, encoder);
+ if (ret)
+ dw_dp_unbind(dp->base);
+
+ return ret;
+}
+
+static void dw_dp_rockchip_unbind(struct device *dev, struct device *master,
+ void *data)
+{
+ struct rockchip_dw_dp *dp = dev_get_drvdata(dev);
+
+ dw_dp_unbind(dp->base);
}
static const struct component_ops dw_dp_rockchip_component_ops = {
.bind = dw_dp_rockchip_bind,
+ .unbind = dw_dp_rockchip_unbind,
};
static int dw_dp_probe(struct platform_device *pdev)
--
2.52.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH v3 2/2] drm/rockchip: dw_dp: Release core resources
2026-03-27 0:55 ` [PATCH v3 2/2] drm/rockchip: dw_dp: Release core resources Cristian Ciocaltea
@ 2026-05-31 10:29 ` Andy Yan
0 siblings, 0 replies; 7+ messages in thread
From: Andy Yan @ 2026-05-31 10:29 UTC (permalink / raw)
To: Cristian Ciocaltea, Sandy Huang, Heiko Stübner,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Dmitry Baryshkov, Dmitry Baryshkov, Andrzej Hajda,
Neil Armstrong, Robert Foss, Laurent Pinchart, Jonas Karlman,
Jernej Skrabec
Cc: kernel, dri-devel, linux-arm-kernel, linux-rockchip, linux-kernel
Hello,
On 3/27/26 08:55, Cristian Ciocaltea wrote:
> Core resources such as the DisplayPort AUX channel get initialized and
> registered during dw_dp_bind(), but are never unregistered, which may
> lead to memory leaks and/or use-after-free:
>
> [ 224.661371] BUG: KASAN: slab-use-after-free in device_is_dependent+0xe0/0x2b0
> [ 224.662015] Read of size 8 at addr ffff00011aee8550 by task modprobe/658
> [ 224.662612]
> [ 224.662752] CPU: 7 UID: 0 PID: 658 Comm: modprobe Not tainted 7.0.0-rc2-next-20260305 #14 PREEMPT
> [ 224.662759] Hardware name: Radxa ROCK 5B (DT)
> [ 224.662762] Call trace:
> [ 224.662764] show_stack+0x20/0x38 (C)
> [ 224.662772] dump_stack_lvl+0x6c/0x98
> [ 224.662777] print_report+0x160/0x4b8
> [ 224.662783] kasan_report+0xb4/0xe0
> [ 224.662790] __asan_report_load8_noabort+0x20/0x30
> [ 224.662796] device_is_dependent+0xe0/0x2b0
> [ 224.662802] device_is_dependent+0x108/0x2b0
> [ 224.662808] device_link_add+0x1f8/0x10b0
> [ 224.662813] devm_of_phy_get_by_index+0x120/0x200
> [ 224.662819] dw_dp_bind+0x34c/0xb10 [dw_dp]
> [ 224.662830] dw_dp_rockchip_bind+0x194/0x250 [rockchipdrm]
> [ 224.662864] component_bind_all+0x3a8/0x720
> [ 224.662869] rockchip_drm_bind+0x120/0x390 [rockchipdrm]
> [ 224.662899] try_to_bring_up_aggregate_device+0x76c/0x838
> [ 224.662904] component_master_add_with_match+0x1f4/0x230
> [ 224.662909] rockchip_drm_platform_probe+0x420/0x538 [rockchipdrm]
> [ 224.662939] platform_probe+0xe8/0x168
> [ 224.662945] really_probe+0x340/0x828
> [ 224.662950] __driver_probe_device+0x2e0/0x350
> [ 224.662954] driver_probe_device+0x80/0x140
> [ 224.662959] __driver_attach+0x398/0x460
> [ 224.662964] bus_for_each_dev+0xe0/0x198
> [ 224.662968] driver_attach+0x50/0x68
> [ 224.662972] bus_add_driver+0x2a0/0x4c0
> [ 224.662977] driver_register+0x294/0x360
> [ 224.662982] __platform_driver_register+0x7c/0x98
> [ 224.662987] rockchip_drm_init+0xc4/0xff8 [rockchipdrm]
>
> Since a previous commit exported dw_dp_unbind() function in DW DP core
> library to take care of the necessary cleanup, use this in the
> component's unbind() callback, as well as in its bind() error path.
>
> Fixes: d68ba7bac955 ("drm/rockchip: Add RK3588 DPTX output support")
> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
> ---
> drivers/gpu/drm/rockchip/dw_dp-rockchip.c | 20 +++++++++++++++++---
> 1 file changed, 17 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
> index 22c0911f1896..8cba90d2dd56 100644
> --- a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
> +++ b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
> @@ -108,14 +108,28 @@ static int dw_dp_rockchip_bind(struct device *dev, struct device *master, void *
>
> connector = drm_bridge_connector_init(drm_dev, encoder);
> if (IS_ERR(connector))
> - return dev_err_probe(dev, PTR_ERR(connector),
> - "Failed to init bridge connector");
> + ret = dev_err_probe(dev, PTR_ERR(connector),
> + "Failed to init bridge connector");
> + else
> + ret = drm_connector_attach_encoder(connector, encoder);
>
> - return drm_connector_attach_encoder(connector, encoder);
This line has already been removed in the latest code.
> + if (ret)
> + dw_dp_unbind(dp->base);
> +
> + return ret;
> +}
> +
> +static void dw_dp_rockchip_unbind(struct device *dev, struct device *master,
> + void *data)
> +{
> + struct rockchip_dw_dp *dp = dev_get_drvdata(dev);
> +
> + dw_dp_unbind(dp->base);
> }
>
> static const struct component_ops dw_dp_rockchip_component_ops = {
> .bind = dw_dp_rockchip_bind,
> + .unbind = dw_dp_rockchip_unbind,
> };
>
> static int dw_dp_probe(struct platform_device *pdev)
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v3 0/2] Rockchip DRM use-after-free & null-ptr-deref fixes
2026-03-27 0:55 [PATCH v3 0/2] Rockchip DRM use-after-free & null-ptr-deref fixes Cristian Ciocaltea
2026-03-27 0:55 ` [PATCH v3 1/2] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel Cristian Ciocaltea
2026-03-27 0:55 ` [PATCH v3 2/2] drm/rockchip: dw_dp: Release core resources Cristian Ciocaltea
@ 2026-05-30 11:29 ` Diederik de Haas
2026-05-30 12:23 ` Cristian Ciocaltea
2 siblings, 1 reply; 7+ messages in thread
From: Diederik de Haas @ 2026-05-30 11:29 UTC (permalink / raw)
To: Cristian Ciocaltea, Sandy Huang, Heiko Stübner, Andy Yan,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Dmitry Baryshkov, Dmitry Baryshkov, Andrzej Hajda,
Neil Armstrong, Robert Foss, Laurent Pinchart, Jonas Karlman,
Jernej Skrabec
Cc: kernel, dri-devel, linux-arm-kernel, linux-rockchip, linux-kernel
On Sat May 30, 2026 at 1:26 PM CEST, Cristian Ciocaltea wrote:
> The first three patches in the series are fixes for use-after-free &
> null-ptr-deref related issues found in dw_dp and inno-hdmi Rockchip DRM
> drivers.
>
> The following three patches provide a few minor improvements to dw_dp
> and dw_hdmi_qp, while the remaining two address use-after-free and
> memory allocation in DW DP core library.
What's the status of this patch set?
Cheers,
Diederik
> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
> ---
> Changes in v3:
> - Dropped patches 1..6,8 already applied by Heiko
> - Reworked remaining patch "drm/bridge: synopsys: dw-dp: Unregister AUX
> channel on bridge detach" into:
> * drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
> * drm/rockchip: dw_dp: Release core resources
> - Link to v2: https://lore.kernel.org/r/20260310-drm-rk-fixes-v2-0-645ecfb43f49@collabora.com
>
> Changes in v2:
> - Fixed conflicts while rebasing onto latest drm-misc-next
> - Added two more patches:
> * drm/bridge: synopsys: dw-dp: Unregister AUX channel on bridge detach
> * drm/bridge: synopsys: dw-dp: Drop useless memory allocation
> - Link to v1: https://lore.kernel.org/r/20260122-drm-rk-fixes-v1-0-3942f185750e@collabora.com
>
> ---
> Cristian Ciocaltea (2):
> drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
> drm/rockchip: dw_dp: Release core resources
>
> drivers/gpu/drm/bridge/synopsys/dw-dp.c | 6 ++++++
> drivers/gpu/drm/rockchip/dw_dp-rockchip.c | 20 +++++++++++++++++---
> include/drm/bridge/dw_dp.h | 1 +
> 3 files changed, 24 insertions(+), 3 deletions(-)
> ---
> base-commit: 46c31e1604d121221167cb09380de8c7d53290b9
> change-id: 20260122-drm-rk-fixes-a7622c71553e
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v3 0/2] Rockchip DRM use-after-free & null-ptr-deref fixes
2026-05-30 11:29 ` [PATCH v3 0/2] Rockchip DRM use-after-free & null-ptr-deref fixes Diederik de Haas
@ 2026-05-30 12:23 ` Cristian Ciocaltea
0 siblings, 0 replies; 7+ messages in thread
From: Cristian Ciocaltea @ 2026-05-30 12:23 UTC (permalink / raw)
To: Diederik de Haas, Sandy Huang, Heiko Stübner, Andy Yan,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Dmitry Baryshkov, Dmitry Baryshkov, Andrzej Hajda,
Neil Armstrong, Robert Foss, Laurent Pinchart, Jonas Karlman,
Jernej Skrabec
Cc: kernel, dri-devel, linux-arm-kernel, linux-rockchip, linux-kernel
On 5/30/26 2:29 PM, Diederik de Haas wrote:
> On Sat May 30, 2026 at 1:26 PM CEST, Cristian Ciocaltea wrote:
>> The first three patches in the series are fixes for use-after-free &
>> null-ptr-deref related issues found in dw_dp and inno-hdmi Rockchip DRM
>> drivers.
>>
>> The following three patches provide a few minor improvements to dw_dp
>> and dw_hdmi_qp, while the remaining two address use-after-free and
>> memory allocation in DW DP core library.
>
> What's the status of this patch set?
Just waiting to be reviewed/applied..
Regards,
Cristian
^ permalink raw reply [flat|nested] 7+ messages in thread