Re: [PATCH v11 38/74] drm/rockchip: dw_hdmi_qp: Factor out HPD interrupt (un)mask helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free and resource leak due to devm_ usage in component bind
--

commit cea67879af1ca4ad52b13c14999be678a504386f
Author: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>

drm/rockchip: dw_hdmi_qp: Factor out HPD interrupt (un)mask helpers

Extract the GRF-level HPD interrupt mask/unmask register writes into
dedicated dw_hdmi_qp_rk35{88,76}_{mask,unmask}_hpd() helpers, and use
them from the .enable_hpd()/.disable_hpd() phy ops as well as the
hardirq, threaded re-arm and io_init() paths.

This is a preparatory refactor that separates the SoC-level HPD mask
from the phy op entry points, so a subsequent change can gate the
platform HPD IRQ line without affecting the debounce paths.

> diff --git a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c
> index 9e48ec06eb660..ecf12403101da 100644
> --- a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c
> +++ b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c

[ ... ]

This is a pre-existing issue, but I noticed a potential problem in
dw_hdmi_qp_rockchip_bind():

drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c:dw_hdmi_qp_rockchip_bind() {
...
	hdmi = drmm_kzalloc(drm, sizeof(*hdmi), GFP_KERNEL);
...
	ret = devm_clk_bulk_get_all_enabled(dev, &clks);
...
	ret = devm_request_threaded_irq(dev, hdmi->hpd_irq,
					cfg->ctrl_ops->hardirq_callback,
					cfg->ctrl_ops->irq_callback,
					IRQF_NO_AUTOEN, "dw-hdmi-qp-hpd",
					hdmi);
...
}

[Severity: High]
Can this component bind sequence result in a Use-After-Free?

The hdmi structure is allocated with drmm_kzalloc() on the master DRM
device, meaning it is freed when the master DRM device unbinds.

However, the IRQ is registered using devm_request_threaded_irq() on the
component platform device (dev).

Because devm_ resources are tied to the platform device's probe/remove
lifecycle rather than the component bind/unbind lifecycle, they are not
freed during component_unbind().

If the master device unbinds, the hdmi structure is freed, but the IRQ
remains active with a pointer to the freed memory.

If the IRQ fires after unbind, will it access the freed hdmi struct?

Additionally, are the devm_ allocations in the component bind leaked on
every component unbind and re-bind sequence?

Since devm_clk_bulk_get_all_enabled() is tied to the component device,
won't these clocks be leaked when the component unbinds and re-binds?

A similar issue appears in dw_hdmi_qp_bind():

drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c:dw_hdmi_qp_bind() {
...
	hdmi = devm_drm_bridge_alloc(dev, struct dw_hdmi_qp, bridge,
				     &dw_hdmi_qp_bridge_funcs);
...
}

[Severity: High]
Does this code leak the bridge structure every time the component is
re-bound?

Because devm_drm_bridge_alloc() is called on the component device, it
appears this memory will not be freed during component unbind.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901-dw-hdmi-qp-scramb-v11-0-bc12954a0688@collabora.com?part=38