public inbox for linux-arm-kernel@lists.infradead.org 
 help / color / mirror / Atom feed
* [PATCH v4 0/3] Rockchip DRM use-after-free & null-ptr-deref fixes
@ 2026-06-01 16:13 Cristian Ciocaltea
  2026-06-01 16:13 ` [PATCH v4 1/3] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel Cristian Ciocaltea
                   ` (3 more replies)
  0 siblings, 4 replies; 7+ messages in thread
From: Cristian Ciocaltea @ 2026-06-01 16:13 UTC (permalink / raw)
  To: Sandy Huang, Heiko Stübner, Andy Yan, Maarten Lankhorst,
	Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
	Dmitry Baryshkov, Dmitry Baryshkov, Andrzej Hajda, Neil Armstrong,
	Robert Foss, Laurent Pinchart, Jonas Karlman, Jernej Skrabec,
	Luca Ceresoli
  Cc: kernel, dri-devel, linux-arm-kernel, linux-rockchip, linux-kernel

The first three patches in the series are fixes for use-after-free &
null-ptr-deref related issues found in dw_dp and inno-hdmi Rockchip DRM
drivers.

The following three patches provide a few minor improvements to dw_dp
and dw_hdmi_qp, while the remaining two address use-after-free and
memory allocation in DW DP core library.

Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora•com>
---
Changes in v4:
- Collected R-b from Andy
- Fixed a conflict while rebasing onto latest drm-misc-next
- Added new patch: drm/rockchip: dw_dp: Add missing newline in
  dev_err_probe() message
- Link to v3: https://lore.kernel.org/r/20260327-drm-rk-fixes-v3-0-fd2e6900c08c@collabora.com

Changes in v3:
- Dropped patches 1..6,8 already applied by Heiko
- Reworked remaining patch "drm/bridge: synopsys: dw-dp: Unregister AUX
  channel on bridge detach" into:
  * drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
  * drm/rockchip: dw_dp: Release core resources
- Link to v2: https://lore.kernel.org/r/20260310-drm-rk-fixes-v2-0-645ecfb43f49@collabora.com

Changes in v2:
- Fixed conflicts while rebasing onto latest drm-misc-next
- Added two more patches:
  * drm/bridge: synopsys: dw-dp: Unregister AUX channel on bridge detach
  * drm/bridge: synopsys: dw-dp: Drop useless memory allocation
- Link to v1: https://lore.kernel.org/r/20260122-drm-rk-fixes-v1-0-3942f185750e@collabora.com

To: Andy Yan <andy.yan@rock-chips•com>
To: Andrzej Hajda <andrzej.hajda@intel•com>
To: Neil Armstrong <neil.armstrong@linaro•org>
To: Robert Foss <rfoss@kernel•org>
To: Laurent Pinchart <Laurent.pinchart@ideasonboard•com>
To: Jonas Karlman <jonas@kwiboo•se>
To: Jernej Skrabec <jernej.skrabec@gmail•com>
To: Luca Ceresoli <luca.ceresoli@bootlin•com>
To: Maarten Lankhorst <maarten.lankhorst@linux•intel.com>
To: Maxime Ripard <mripard@kernel•org>
To: Thomas Zimmermann <tzimmermann@suse•de>
To: David Airlie <airlied@gmail•com>
To: Simona Vetter <simona@ffwll•ch>
To: Dmitry Baryshkov <dmitry.baryshkov@oss•qualcomm.com>
To: Sandy Huang <hjc@rock-chips•com>
To: Heiko Stübner <heiko@sntech•de>
To: Dmitry Baryshkov <lumag@kernel•org>
To: Cristian Ciocaltea <cristian.ciocaltea@collabora•com>
Cc: kernel@collabora•com
Cc: dri-devel@lists•freedesktop.org
Cc: linux-kernel@vger•kernel.org
Cc: linux-arm-kernel@lists•infradead.org
Cc: linux-rockchip@lists•infradead.org

---
Cristian Ciocaltea (3):
      drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
      drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message
      drm/rockchip: dw_dp: Release core resources

 drivers/gpu/drm/bridge/synopsys/dw-dp.c   |  6 ++++++
 drivers/gpu/drm/rockchip/dw_dp-rockchip.c | 15 +++++++++++++--
 include/drm/bridge/dw_dp.h                |  1 +
 3 files changed, 20 insertions(+), 2 deletions(-)
---
base-commit: e84b07e0a30b371117f9a1120a4645c213f39cd9
change-id: 20260122-drm-rk-fixes-a7622c71553e



^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH v4 1/3] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
  2026-06-01 16:13 [PATCH v4 0/3] Rockchip DRM use-after-free & null-ptr-deref fixes Cristian Ciocaltea
@ 2026-06-01 16:13 ` Cristian Ciocaltea
  2026-06-01 16:13 ` [PATCH v4 2/3] drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message Cristian Ciocaltea
                   ` (2 subsequent siblings)
  3 siblings, 0 replies; 7+ messages in thread
From: Cristian Ciocaltea @ 2026-06-01 16:13 UTC (permalink / raw)
  To: Sandy Huang, Heiko Stübner, Andy Yan, Maarten Lankhorst,
	Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
	Dmitry Baryshkov, Dmitry Baryshkov, Andrzej Hajda, Neil Armstrong,
	Robert Foss, Laurent Pinchart, Jonas Karlman, Jernej Skrabec,
	Luca Ceresoli
  Cc: kernel, dri-devel, linux-arm-kernel, linux-rockchip, linux-kernel

The DisplayPort AUX channel gets initialized and registered during
dw_dp_bind(), but it is never unregistered, which may lead to resource
leaks and/or use-after-free.

Add the missing dw_dp_unbind() function to allow the users of the
library to handle the required cleanup, i.e. unregister the AUX adapter.

Fixes: 86eecc3a9c2e ("drm/bridge: synopsys: Add DW DPTX Controller support library")
Reviewed-by: Andy Yan <andy.yan@rock-chips•com>
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora•com>
---
 drivers/gpu/drm/bridge/synopsys/dw-dp.c | 6 ++++++
 include/drm/bridge/dw_dp.h              | 1 +
 2 files changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/bridge/synopsys/dw-dp.c b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
index 21541be094c4..36ee6e027af5 100644
--- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
@@ -2093,6 +2093,12 @@ struct dw_dp *dw_dp_bind(struct device *dev, struct drm_encoder *encoder,
 }
 EXPORT_SYMBOL_GPL(dw_dp_bind);
 
+void dw_dp_unbind(struct dw_dp *dp)
+{
+	drm_dp_aux_unregister(&dp->aux);
+}
+EXPORT_SYMBOL_GPL(dw_dp_unbind);
+
 MODULE_AUTHOR("Andy Yan <andyshrk@163•com>");
 MODULE_DESCRIPTION("DW DP Core Library");
 MODULE_LICENSE("GPL");
diff --git a/include/drm/bridge/dw_dp.h b/include/drm/bridge/dw_dp.h
index 25363541e69d..22105c3e8e4d 100644
--- a/include/drm/bridge/dw_dp.h
+++ b/include/drm/bridge/dw_dp.h
@@ -24,4 +24,5 @@ struct dw_dp_plat_data {
 
 struct dw_dp *dw_dp_bind(struct device *dev, struct drm_encoder *encoder,
 			 const struct dw_dp_plat_data *plat_data);
+void dw_dp_unbind(struct dw_dp *dp);
 #endif /* __DW_DP__ */

-- 
2.54.0



^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH v4 2/3] drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message
  2026-06-01 16:13 [PATCH v4 0/3] Rockchip DRM use-after-free & null-ptr-deref fixes Cristian Ciocaltea
  2026-06-01 16:13 ` [PATCH v4 1/3] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel Cristian Ciocaltea
@ 2026-06-01 16:13 ` Cristian Ciocaltea
  2026-06-03 13:01   ` Andy Yan
  2026-06-01 16:13 ` [PATCH v4 3/3] drm/rockchip: dw_dp: Release core resources Cristian Ciocaltea
  2026-06-02 19:31 ` [PATCH v4 0/3] Rockchip DRM use-after-free & null-ptr-deref fixes Heiko Stuebner
  3 siblings, 1 reply; 7+ messages in thread
From: Cristian Ciocaltea @ 2026-06-01 16:13 UTC (permalink / raw)
  To: Sandy Huang, Heiko Stübner, Andy Yan, Maarten Lankhorst,
	Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
	Dmitry Baryshkov, Dmitry Baryshkov, Andrzej Hajda, Neil Armstrong,
	Robert Foss, Laurent Pinchart, Jonas Karlman, Jernej Skrabec,
	Luca Ceresoli
  Cc: kernel, dri-devel, linux-arm-kernel, linux-rockchip, linux-kernel

Add the missing trailing newline to dev_err_probe() call in
dw_dp_rockchip_bind().

Fixes: d68ba7bac955 ("drm/rockchip: Add RK3588 DPTX output support")
Fixes: 26cb3e26efa7 ("drm/rockchip: dw_dp: Simplify error handling")
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora•com>
---
 drivers/gpu/drm/rockchip/dw_dp-rockchip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
index 32bc73a1d5e4..f137f699737c 100644
--- a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
@@ -109,7 +109,7 @@ static int dw_dp_rockchip_bind(struct device *dev, struct device *master, void *
 	connector = drm_bridge_connector_init(drm_dev, encoder);
 	if (IS_ERR(connector))
 		return dev_err_probe(dev, PTR_ERR(connector),
-				     "Failed to init bridge connector");
+				     "Failed to init bridge connector\n");
 
 	return 0;
 }

-- 
2.54.0



^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH v4 3/3] drm/rockchip: dw_dp: Release core resources
  2026-06-01 16:13 [PATCH v4 0/3] Rockchip DRM use-after-free & null-ptr-deref fixes Cristian Ciocaltea
  2026-06-01 16:13 ` [PATCH v4 1/3] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel Cristian Ciocaltea
  2026-06-01 16:13 ` [PATCH v4 2/3] drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message Cristian Ciocaltea
@ 2026-06-01 16:13 ` Cristian Ciocaltea
  2026-06-03 13:03   ` Andy Yan
  2026-06-02 19:31 ` [PATCH v4 0/3] Rockchip DRM use-after-free & null-ptr-deref fixes Heiko Stuebner
  3 siblings, 1 reply; 7+ messages in thread
From: Cristian Ciocaltea @ 2026-06-01 16:13 UTC (permalink / raw)
  To: Sandy Huang, Heiko Stübner, Andy Yan, Maarten Lankhorst,
	Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
	Dmitry Baryshkov, Dmitry Baryshkov, Andrzej Hajda, Neil Armstrong,
	Robert Foss, Laurent Pinchart, Jonas Karlman, Jernej Skrabec,
	Luca Ceresoli
  Cc: kernel, dri-devel, linux-arm-kernel, linux-rockchip, linux-kernel

Core resources such as the DisplayPort AUX channel get initialized and
registered during dw_dp_bind(), but are never unregistered, which may
lead to memory leaks and/or use-after-free:

[  224.661371] BUG: KASAN: slab-use-after-free in device_is_dependent+0xe0/0x2b0
[  224.662015] Read of size 8 at addr ffff00011aee8550 by task modprobe/658
[  224.662612]
[  224.662752] CPU: 7 UID: 0 PID: 658 Comm: modprobe Not tainted 7.0.0-rc2-next-20260305 #14 PREEMPT
[  224.662759] Hardware name: Radxa ROCK 5B (DT)
[  224.662762] Call trace:
[  224.662764]  show_stack+0x20/0x38 (C)
[  224.662772]  dump_stack_lvl+0x6c/0x98
[  224.662777]  print_report+0x160/0x4b8
[  224.662783]  kasan_report+0xb4/0xe0
[  224.662790]  __asan_report_load8_noabort+0x20/0x30
[  224.662796]  device_is_dependent+0xe0/0x2b0
[  224.662802]  device_is_dependent+0x108/0x2b0
[  224.662808]  device_link_add+0x1f8/0x10b0
[  224.662813]  devm_of_phy_get_by_index+0x120/0x200
[  224.662819]  dw_dp_bind+0x34c/0xb10 [dw_dp]
[  224.662830]  dw_dp_rockchip_bind+0x194/0x250 [rockchipdrm]
[  224.662864]  component_bind_all+0x3a8/0x720
[  224.662869]  rockchip_drm_bind+0x120/0x390 [rockchipdrm]
[  224.662899]  try_to_bring_up_aggregate_device+0x76c/0x838
[  224.662904]  component_master_add_with_match+0x1f4/0x230
[  224.662909]  rockchip_drm_platform_probe+0x420/0x538 [rockchipdrm]
[  224.662939]  platform_probe+0xe8/0x168
[  224.662945]  really_probe+0x340/0x828
[  224.662950]  __driver_probe_device+0x2e0/0x350
[  224.662954]  driver_probe_device+0x80/0x140
[  224.662959]  __driver_attach+0x398/0x460
[  224.662964]  bus_for_each_dev+0xe0/0x198
[  224.662968]  driver_attach+0x50/0x68
[  224.662972]  bus_add_driver+0x2a0/0x4c0
[  224.662977]  driver_register+0x294/0x360
[  224.662982]  __platform_driver_register+0x7c/0x98
[  224.662987]  rockchip_drm_init+0xc4/0xff8 [rockchipdrm]

Since a previous commit exported dw_dp_unbind() function in DW DP core
library to take care of the necessary cleanup, use this in the
component's unbind() callback, as well as in its bind() error path.

Fixes: d68ba7bac955 ("drm/rockchip: Add RK3588 DPTX output support")
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora•com>
---
 drivers/gpu/drm/rockchip/dw_dp-rockchip.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
index f137f699737c..0de822360c8d 100644
--- a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
@@ -107,15 +107,26 @@ static int dw_dp_rockchip_bind(struct device *dev, struct device *master, void *
 		return PTR_ERR(dp->base);
 
 	connector = drm_bridge_connector_init(drm_dev, encoder);
-	if (IS_ERR(connector))
+	if (IS_ERR(connector)) {
+		dw_dp_unbind(dp->base);
 		return dev_err_probe(dev, PTR_ERR(connector),
 				     "Failed to init bridge connector\n");
+	}
 
 	return 0;
 }
 
+static void dw_dp_rockchip_unbind(struct device *dev, struct device *master,
+				  void *data)
+{
+	struct rockchip_dw_dp *dp = dev_get_drvdata(dev);
+
+	dw_dp_unbind(dp->base);
+}
+
 static const struct component_ops dw_dp_rockchip_component_ops = {
 	.bind = dw_dp_rockchip_bind,
+	.unbind = dw_dp_rockchip_unbind,
 };
 
 static int dw_dp_probe(struct platform_device *pdev)

-- 
2.54.0



^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH v4 0/3] Rockchip DRM use-after-free & null-ptr-deref fixes
  2026-06-01 16:13 [PATCH v4 0/3] Rockchip DRM use-after-free & null-ptr-deref fixes Cristian Ciocaltea
                   ` (2 preceding siblings ...)
  2026-06-01 16:13 ` [PATCH v4 3/3] drm/rockchip: dw_dp: Release core resources Cristian Ciocaltea
@ 2026-06-02 19:31 ` Heiko Stuebner
  3 siblings, 0 replies; 7+ messages in thread
From: Heiko Stuebner @ 2026-06-02 19:31 UTC (permalink / raw)
  To: Sandy Huang, Andy Yan, Maarten Lankhorst, Maxime Ripard,
	Thomas Zimmermann, David Airlie, Simona Vetter, Dmitry Baryshkov,
	Dmitry Baryshkov, Andrzej Hajda, Neil Armstrong, Robert Foss,
	Laurent Pinchart, Jonas Karlman, Jernej Skrabec, Luca Ceresoli,
	Cristian Ciocaltea
  Cc: Heiko Stuebner, kernel, dri-devel, linux-arm-kernel,
	linux-rockchip, linux-kernel


On Mon, 01 Jun 2026 19:13:43 +0300, Cristian Ciocaltea wrote:
> The first three patches in the series are fixes for use-after-free &
> null-ptr-deref related issues found in dw_dp and inno-hdmi Rockchip DRM
> drivers.
> 
> The following three patches provide a few minor improvements to dw_dp
> and dw_hdmi_qp, while the remaining two address use-after-free and
> memory allocation in DW DP core library.
> 
> [...]

Applied, thanks!

[1/3] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
      commit: ed04e8e2307f35b3d8d49a554faf5e72d3d224e6
[2/3] drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message
      commit: 0a01412178047bf3ff351c7e75d373e411072a87
[3/3] drm/rockchip: dw_dp: Release core resources
      commit: cc6d7aca2f37a1525a94ef97eb3ce361732c876c

Best regards,
-- 
Heiko Stuebner <heiko@sntech•de>


^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re:[PATCH v4 2/3] drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message
  2026-06-01 16:13 ` [PATCH v4 2/3] drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message Cristian Ciocaltea
@ 2026-06-03 13:01   ` Andy Yan
  0 siblings, 0 replies; 7+ messages in thread
From: Andy Yan @ 2026-06-03 13:01 UTC (permalink / raw)
  To: Cristian Ciocaltea
  Cc: Sandy Huang, Heiko Stübner, Andy Yan, Maarten Lankhorst,
	Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
	Dmitry Baryshkov, Dmitry Baryshkov, Andrzej Hajda, Neil Armstrong,
	Robert Foss, Laurent Pinchart, Jonas Karlman, Jernej Skrabec,
	Luca Ceresoli, kernel, dri-devel, linux-arm-kernel,
	linux-rockchip, linux-kernel


Hello Cristian,

At 2026-06-02 00:13:45, "Cristian Ciocaltea" <cristian.ciocaltea@collabora•com> wrote:
>Add the missing trailing newline to dev_err_probe() call in
>dw_dp_rockchip_bind().
>
>Fixes: d68ba7bac955 ("drm/rockchip: Add RK3588 DPTX output support")
>Fixes: 26cb3e26efa7 ("drm/rockchip: dw_dp: Simplify error handling")


Just one Fixes tag?


>Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora•com>
>---
> drivers/gpu/drm/rockchip/dw_dp-rockchip.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
>index 32bc73a1d5e4..f137f699737c 100644
>--- a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
>+++ b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
>@@ -109,7 +109,7 @@ static int dw_dp_rockchip_bind(struct device *dev, struct device *master, void *
> 	connector = drm_bridge_connector_init(drm_dev, encoder);
> 	if (IS_ERR(connector))
> 		return dev_err_probe(dev, PTR_ERR(connector),
>-				     "Failed to init bridge connector");
>+				     "Failed to init bridge connector\n");
> 
> 	return 0;
> }
>
>-- 
>2.54.0

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re:[PATCH v4 3/3] drm/rockchip: dw_dp: Release core resources
  2026-06-01 16:13 ` [PATCH v4 3/3] drm/rockchip: dw_dp: Release core resources Cristian Ciocaltea
@ 2026-06-03 13:03   ` Andy Yan
  0 siblings, 0 replies; 7+ messages in thread
From: Andy Yan @ 2026-06-03 13:03 UTC (permalink / raw)
  To: Cristian Ciocaltea
  Cc: Sandy Huang, Heiko Stübner, Andy Yan, Maarten Lankhorst,
	Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
	Dmitry Baryshkov, Dmitry Baryshkov, Andrzej Hajda, Neil Armstrong,
	Robert Foss, Laurent Pinchart, Jonas Karlman, Jernej Skrabec,
	Luca Ceresoli, kernel, dri-devel, linux-arm-kernel,
	linux-rockchip, linux-kernel


Hello Cristian,

At 2026-06-02 00:13:46, "Cristian Ciocaltea" <cristian.ciocaltea@collabora•com> wrote:
>Core resources such as the DisplayPort AUX channel get initialized and
>registered during dw_dp_bind(), but are never unregistered, which may
>lead to memory leaks and/or use-after-free:
>
>[  224.661371] BUG: KASAN: slab-use-after-free in device_is_dependent+0xe0/0x2b0
>[  224.662015] Read of size 8 at addr ffff00011aee8550 by task modprobe/658
>[  224.662612]
>[  224.662752] CPU: 7 UID: 0 PID: 658 Comm: modprobe Not tainted 7.0.0-rc2-next-20260305 #14 PREEMPT
>[  224.662759] Hardware name: Radxa ROCK 5B (DT)
>[  224.662762] Call trace:
>[  224.662764]  show_stack+0x20/0x38 (C)
>[  224.662772]  dump_stack_lvl+0x6c/0x98
>[  224.662777]  print_report+0x160/0x4b8
>[  224.662783]  kasan_report+0xb4/0xe0
>[  224.662790]  __asan_report_load8_noabort+0x20/0x30
>[  224.662796]  device_is_dependent+0xe0/0x2b0
>[  224.662802]  device_is_dependent+0x108/0x2b0
>[  224.662808]  device_link_add+0x1f8/0x10b0
>[  224.662813]  devm_of_phy_get_by_index+0x120/0x200
>[  224.662819]  dw_dp_bind+0x34c/0xb10 [dw_dp]
>[  224.662830]  dw_dp_rockchip_bind+0x194/0x250 [rockchipdrm]
>[  224.662864]  component_bind_all+0x3a8/0x720
>[  224.662869]  rockchip_drm_bind+0x120/0x390 [rockchipdrm]
>[  224.662899]  try_to_bring_up_aggregate_device+0x76c/0x838
>[  224.662904]  component_master_add_with_match+0x1f4/0x230
>[  224.662909]  rockchip_drm_platform_probe+0x420/0x538 [rockchipdrm]
>[  224.662939]  platform_probe+0xe8/0x168
>[  224.662945]  really_probe+0x340/0x828
>[  224.662950]  __driver_probe_device+0x2e0/0x350
>[  224.662954]  driver_probe_device+0x80/0x140
>[  224.662959]  __driver_attach+0x398/0x460
>[  224.662964]  bus_for_each_dev+0xe0/0x198
>[  224.662968]  driver_attach+0x50/0x68
>[  224.662972]  bus_add_driver+0x2a0/0x4c0
>[  224.662977]  driver_register+0x294/0x360
>[  224.662982]  __platform_driver_register+0x7c/0x98
>[  224.662987]  rockchip_drm_init+0xc4/0xff8 [rockchipdrm]
>
>Since a previous commit exported dw_dp_unbind() function in DW DP core
>library to take care of the necessary cleanup, use this in the
>component's unbind() callback, as well as in its bind() error path.
>
>Fixes: d68ba7bac955 ("drm/rockchip: Add RK3588 DPTX output support")
>Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora•com>

   Reviewed-by: Andy Yan <andy.yan@rock-chips•com>

Thanks

>---
> drivers/gpu/drm/rockchip/dw_dp-rockchip.c | 13 ++++++++++++-
> 1 file changed, 12 insertions(+), 1 deletion(-)
>
>diff --git a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
>index f137f699737c..0de822360c8d 100644
>--- a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
>+++ b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c
>@@ -107,15 +107,26 @@ static int dw_dp_rockchip_bind(struct device *dev, struct device *master, void *
> 		return PTR_ERR(dp->base);
> 
> 	connector = drm_bridge_connector_init(drm_dev, encoder);
>-	if (IS_ERR(connector))
>+	if (IS_ERR(connector)) {
>+		dw_dp_unbind(dp->base);
> 		return dev_err_probe(dev, PTR_ERR(connector),
> 				     "Failed to init bridge connector\n");
>+	}
> 
> 	return 0;
> }
> 
>+static void dw_dp_rockchip_unbind(struct device *dev, struct device *master,
>+				  void *data)
>+{
>+	struct rockchip_dw_dp *dp = dev_get_drvdata(dev);
>+
>+	dw_dp_unbind(dp->base);
>+}
>+
> static const struct component_ops dw_dp_rockchip_component_ops = {
> 	.bind = dw_dp_rockchip_bind,
>+	.unbind = dw_dp_rockchip_unbind,
> };
> 
> static int dw_dp_probe(struct platform_device *pdev)
>
>-- 
>2.54.0

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2026-06-03 13:05 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-01 16:13 [PATCH v4 0/3] Rockchip DRM use-after-free & null-ptr-deref fixes Cristian Ciocaltea
2026-06-01 16:13 ` [PATCH v4 1/3] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel Cristian Ciocaltea
2026-06-01 16:13 ` [PATCH v4 2/3] drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message Cristian Ciocaltea
2026-06-03 13:01   ` Andy Yan
2026-06-01 16:13 ` [PATCH v4 3/3] drm/rockchip: dw_dp: Release core resources Cristian Ciocaltea
2026-06-03 13:03   ` Andy Yan
2026-06-02 19:31 ` [PATCH v4 0/3] Rockchip DRM use-after-free & null-ptr-deref fixes Heiko Stuebner

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox