Re: [RFC PATCH] drm/meson: dw-hdmi: Propagate reset failures during initialization

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] The shared IRQ handler is registered before the hardware is fully initialized, risking a NULL pointer dereference if initialization fails.
- [High] Component bind error paths permanently leak `devm_` allocated resources.
--

commit f74bf01d3ded8b1822f2278b49d5f000e0d72a6b
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>

drm/meson: dw-hdmi: Propagate reset failures during initialization

This commit updates meson_dw_hdmi_init() to propagate reset errors instead
of ignoring them. It also updates the bind and resume paths to abort if
initialization fails.

> diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
> --- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
> +++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c

[ ... ]

> @@ -754,7 +764,9 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
>  		return ret;
>  	}
>  
> -	meson_dw_hdmi_init(meson_dw_hdmi);
> +	ret = meson_dw_hdmi_init(meson_dw_hdmi);
> +	if (ret)
> +		return ret;

[Severity: High]
This is a pre-existing issue, but does this new error path expose us to a
NULL pointer dereference from the shared IRQ?

Earlier in meson_dw_hdmi_bind(), a shared IRQ is requested using a devm_
function:

	ret = devm_request_threaded_irq(dev, irq, dw_hdmi_top_irq,
					dw_hdmi_top_thread_irq, IRQF_SHARED,
					"dw_hdmi_top_irq", meson_dw_hdmi);

If meson_dw_hdmi_init() fails and returns early here, the IRQ remains active
because its lifetime is tied to the platform device, not the bind lifecycle.
If the shared IRQ fires, dw_hdmi_top_thread_irq() unconditionally 
dereferences dw_hdmi->hdmi and dw_hdmi->bridge, which will be NULL since
dw_hdmi_probe() was skipped.

[Severity: High]
This isn't a bug introduced by this patch, but does returning early here
also cause unbounded resource leaks?

Because meson_dw_hdmi_bind() is a component bind function, it runs
repeatedly on deferred probe or unbind/bind cycles. It allocates resources
using devm_ allocation functions, such as:

	meson_dw_hdmi = devm_kzalloc(dev, sizeof(*meson_dw_hdmi),
				     GFP_KERNEL);

If this bind operation fails at meson_dw_hdmi_init(), these devm_ resources
are not automatically freed since the underlying platform device is not
destroyed. Can this lead to memory and IRQ exhaustion over time?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260828091424.6375-1-pengpeng@iscas.ac.cn?part=1

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic