Re: [PATCH v5 08/21] drm: bridge: dw_hdmi: Unregister CEC notifier during connector cleanup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] State Corruption / Lifecycle Imbalance due to delayed CEC notifier unregistration
--

commit 5799bf779b149e6405697c67460f8e90064bcce9
Author: Jonas Karlman <jonas@kwiboo.se>

drm: bridge: dw_hdmi: Unregister CEC notifier during connector cleanup

This commit moves the unregistration of the CEC notifier from the bridge
detach path to the connector destroy path to better align the lifetime of
the connector and the CEC notifier.

> diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
> index cbbd155780425..5fd26ff8f55b4 100644
> --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
> +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
> @@ -2532,6 +2532,11 @@ static void dw_hdmi_connector_destroy(struct drm_connector *connector)
>  {
>  	struct dw_hdmi *hdmi = container_of(connector, struct dw_hdmi, connector);
>  
> +	mutex_lock(&hdmi->cec_notifier_mutex);
> +	cec_notifier_conn_unregister(hdmi->cec_notifier);

Could moving this to the connector destroy path cause CEC state to be wiped
out if the bridge is unbound and re-bound while a userspace application holds
a DRM file descriptor open?

Because DRM connectors are refcounted, their destruction is delayed until
userspace closes all references. If the driver is unbound and re-bound before
the old connector is destroyed, the new driver instance will call
cec_notifier_conn_register(). Since the old notifier hasn't been unregistered
yet, it will reuse it.

When the userspace application finally closes the file descriptor, the delayed
dw_hdmi_connector_destroy() executes for the old connector and calls
cec_notifier_conn_unregister(), wiping out the active CEC state for the newly
bound bridge.

This issue also doesn't seem to be fixed by the later patch 'drm: bridge:
dw_hdmi: Use generic CEC notifier helpers', as tying unregistration to the
drm_device lifetime means it is still delayed by open file descriptors.

> +	hdmi->cec_notifier = NULL;
> +	mutex_unlock(&hdmi->cec_notifier_mutex);
> +
>  	drm_connector_cleanup(connector);
>  	drm_bridge_put(&hdmi->bridge);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260510124111.1226584-1-jonas@kwiboo.se?part=8