Re: [PATCH v6 5/6] arm64: dts: renesas: sparrow-hawk: Enable DisplayPort by adding DSC

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The DRM bridge reference obtained via of_drm_get_bridge_by_endpoint() is leaked on error paths and during driver removal.
--

commit a2a78077050a0efecae114552f483f67a6423d4c
Author: Marek Vasut <marek.vasut+renesas@mailbox.org>

drm/rcar-du: dsc: Add rudimentary Renesas R-Car V4H DSC driver

The Renesas DSC Display Stream Compression is a bridge embedded in the
Renesas R-Car V4H SoC. The bridge performs VESA DSC encoding of up to
8k or 400 Mpixel/s. Add rudimentary driver, which currently acts as a
pass-through bridge and allows DSI1 to be operational on R-Car V4H.

> diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_dsc.c b/drivers/gpu/drm/renesas/rcar-du/rcar_dsc.c
> new file mode 100644
> index 0000000000000..1882ae34ce8f5
> --- /dev/null
> +++ b/drivers/gpu/drm/renesas/rcar-du/rcar_dsc.c
[ ... ]
> +static int rcar_dsc_probe(struct platform_device *pdev)
> +{
> +	struct device *dev = &pdev->dev;
> +	struct rcar_dsc *dsc;
> +	int ret;
> +
> +	dsc = devm_drm_bridge_alloc(dev, struct rcar_dsc, bridge,
> +				    &rcar_dsc_bridge_ops);
> +	if (IS_ERR(dsc))
> +		return PTR_ERR(dsc);
> +
> +	platform_set_drvdata(pdev, dsc);
> +
> +	dsc->dev = &pdev->dev;
> +
> +	dsc->bridge.next_bridge = of_drm_get_bridge_by_endpoint(dev->of_node,
> +								1, 0);

[Severity: Medium]
Does this code leak the DRM bridge reference obtained via
of_drm_get_bridge_by_endpoint()?

If devm_drm_bridge_add() fails later in rcar_dsc_probe(), the cleanup path
fails to drop this bridge reference.

This means the memory for the downstream bridge object will never be freed.

Since driver probe errors and unbinds are cold paths that require root
privileges or hardware faults to trigger, this leaks the bridge reference
on a cold path.

> +	if (IS_ERR(dsc->bridge.next_bridge))
> +		return PTR_ERR(dsc->bridge.next_bridge);
> +
> +	dsc->bridge.of_node = dev->of_node;
> +
> +	pm_runtime_enable(&pdev->dev);
> +
> +	ret = devm_drm_bridge_add(dev, &dsc->bridge);
> +	if (ret)
> +		goto err_runtime_disable;
> +
> +	return 0;
> +
> +err_runtime_disable:
> +	pm_runtime_disable(&pdev->dev);
> +
> +	return ret;
> +}
> +
> +static void rcar_dsc_remove(struct platform_device *pdev)
> +{
> +	pm_runtime_disable(&pdev->dev);

[Severity: Medium]
Could this leak the DRM bridge reference during driver removal?

Since the reference acquired in rcar_dsc_probe() isn't dropped here,
unbinding the device will leave the struct drm_bridge kref leaked.

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907-rcar-du-dsc-v6-0-f8ef711a7494@ideasonboard.com?part=5