Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] This problem wasn't introduced by this patch, but there is a use-after-free vulnerability and missing cleanup of the HPD registration on the `tfp410_attach` error path. -- --- Patch [22]: [PATCH v2 22/37] drm/bridge: ti-tfp410: Switch to atomic bridge callbacks --- commit fb525e8e18293a40cab99e1a43c62c7f5ee18083 Author: Maxime Ripard <[email protected]> drm/bridge: ti-tfp410: Switch to atomic bridge callbacks This commit switches the ti-tfp410 bridge from legacy non-atomic enable and disable callbacks to their atomic counterparts. It also adds the necessary atomic state handlers to help remove legacy support from the DRM bridge core. > diff --git a/drivers/gpu/drm/bridge/ti-tfp410.c > b/drivers/gpu/drm/bridge/ti-tfp410.c > index 6f06f7b4e9926..f0a14f52aaace 100644 > --- a/drivers/gpu/drm/bridge/ti-tfp410.c > +++ b/drivers/gpu/drm/bridge/ti-tfp410.c [ ... ] > @@ -242,8 +244,8 @@ static int tfp410_atomic_check(struct drm_bridge *bridge, > static const struct drm_bridge_funcs tfp410_bridge_funcs = { > .attach = tfp410_attach, > .detach = tfp410_detach, > - .enable = tfp410_enable, > - .disable = tfp410_disable, [Severity: High] This isn't a bug introduced by this patch, but there appears to be a use-after-free risk and missing cleanup of the HPD registration on the error path in tfp410_attach(). When tfp410_attach() successfully registers the HPD callback on the next bridge, but drm_connector_init_with_ddc() subsequently fails, it returns an error without disabling the HPD callback: drivers/gpu/drm/bridge/ti-tfp410.c:tfp410_attach() { ... ret = drm_connector_init_with_ddc(bridge->dev, &dvi->connector, &tfp410_con_funcs, dvi->bridge.next_bridge->type, dvi->bridge.next_bridge->ddc); if (ret) { dev_err(dvi->dev, "drm_connector_init_with_ddc() failed: %d\n", ret); return ret; } ... } If the attachment fails, .detach() isn't called, and the next bridge might still retain the HPD callback pointing to the freed dvi structure. A hardware hotplug event could then trigger the callback and dereference the freed pointer. Should this error path deregister the HPD callback before returning? > + .atomic_enable = tfp410_enable, > + .atomic_disable = tfp410_disable, > .mode_valid = tfp410_mode_valid, > .atomic_create_state = drm_atomic_helper_bridge_create_state, > .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state, -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=22
