From nobody Thu Apr 2 19:01:22 2026 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A0A8B2882A7 for ; Fri, 27 Mar 2026 00:55:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774572935; cv=none; b=uMtGH50thp+D3GFW8WDHaBmchmw0zF+7ZlxJw3YKUpZLXbp/PS0bNcEwjmNst+piy8VRMFzh3E2i6tTLfzpx4jhD8CNz1D6+l8s4MGGIbRiUJ9SKuzKyXR5G+7Ip3gbNkGbd1aBRg7kpbIp8m20Td89TBb530jHNyrd+Zqory5Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774572935; c=relaxed/simple; bh=V8lVwih9AzBJwR4ANDMYIaupy1aCX2o2M8JPQlL0kck=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=lyoetyJw6nvKmyiryN/8Zn2yDhkLLUrzw2k1gLBmEtIVrCKl88iynBJxg0kb2Tvff97eIvoZ+C3MTqYMKAoGtFGCxP7ivPskaYqntAAWgohx85Nu6fcvAOHH9qMRohpeELL6K4XsfYTZn4Eced2Mtj7pm7jKLql1YjtmaQci8+U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=IrIqb/7G; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="IrIqb/7G" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1774572933; bh=V8lVwih9AzBJwR4ANDMYIaupy1aCX2o2M8JPQlL0kck=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=IrIqb/7GAIVHD1guC5m94AkcXTs3mqc4CtY9+J/qK/KXKq8Qxy4SbbNfudUXL78px Eh55aVvqNAWTtfqRTWTm0vO4/4Li30CogCg8tNoCpSPWyxEgO/vagQVw2U5G7oW4+s 6M7i8ezglpfGmaHsosAyC+54eZlnX2Psa1A6MZHPx+zL8Q/ALQYKez7HRpEoywU7pT ZNNRJjkQjUAW4TpQCV1ZTs+UFfq0BbdIWNYC8qIkGoAqrFmEoo8bo7pbdEajg/z1gT PqW+W83gyJuFdWFrR9bV92PRZTmKXemWs3rK74Jp4AlgbSaSuhRjITOZ3tzogkjHHD ktetw3MEYQ5wg== Received: from localhost (unknown [86.123.23.225]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: cristicc) by bali.collaboradmins.com (Postfix) with ESMTPSA id 1380117E6255; Fri, 27 Mar 2026 01:55:33 +0100 (CET) From: Cristian Ciocaltea Date: Fri, 27 Mar 2026 02:55:07 +0200 Subject: [PATCH v3 1/2] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260327-drm-rk-fixes-v3-1-fd2e6900c08c@collabora.com> References: <20260327-drm-rk-fixes-v3-0-fd2e6900c08c@collabora.com> In-Reply-To: <20260327-drm-rk-fixes-v3-0-fd2e6900c08c@collabora.com> To: Sandy Huang , =?utf-8?q?Heiko_St=C3=BCbner?= , Andy Yan , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dmitry Baryshkov , Dmitry Baryshkov , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec Cc: kernel@collabora.com, dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-rockchip@lists.infradead.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.14.3 The DisplayPort AUX channel gets initialized and registered during dw_dp_bind(), but it is never unregistered, which may lead to resource leaks and/or use-after-free. Add the missing dw_dp_unbind() function to allow the users of the library to handle the required cleanup, i.e. unregister the AUX adapter. Fixes: 86eecc3a9c2e ("drm/bridge: synopsys: Add DW DPTX Controller support = library") Signed-off-by: Cristian Ciocaltea --- drivers/gpu/drm/bridge/synopsys/dw-dp.c | 6 ++++++ include/drm/bridge/dw_dp.h | 1 + 2 files changed, 7 insertions(+) diff --git a/drivers/gpu/drm/bridge/synopsys/dw-dp.c b/drivers/gpu/drm/brid= ge/synopsys/dw-dp.c index 3f4530c117c7..6211ba6ba7bd 100644 --- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c +++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c @@ -2093,6 +2093,12 @@ struct dw_dp *dw_dp_bind(struct device *dev, struct = drm_encoder *encoder, } EXPORT_SYMBOL_GPL(dw_dp_bind); =20 +void dw_dp_unbind(struct dw_dp *dp) +{ + drm_dp_aux_unregister(&dp->aux); +} +EXPORT_SYMBOL_GPL(dw_dp_unbind); + MODULE_AUTHOR("Andy Yan "); MODULE_DESCRIPTION("DW DP Core Library"); MODULE_LICENSE("GPL"); diff --git a/include/drm/bridge/dw_dp.h b/include/drm/bridge/dw_dp.h index 25363541e69d..22105c3e8e4d 100644 --- a/include/drm/bridge/dw_dp.h +++ b/include/drm/bridge/dw_dp.h @@ -24,4 +24,5 @@ struct dw_dp_plat_data { =20 struct dw_dp *dw_dp_bind(struct device *dev, struct drm_encoder *encoder, const struct dw_dp_plat_data *plat_data); +void dw_dp_unbind(struct dw_dp *dp); #endif /* __DW_DP__ */ --=20 2.52.0 From nobody Thu Apr 2 19:01:22 2026 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9B477288530 for ; Fri, 27 Mar 2026 00:55:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774572937; cv=none; b=b4sSip+mBVFwj6088Jhlx6xahzwJ1cj7gmhyOPGGPa5KNrpNZJBafQtbZqyhtGlo8Awpz2IcbZhOap9MEjXOvipjQxQESyIqE1WTCgeaPAfxm2GAxcEBt7AI98SLHiRTFKHd+tY89qGX9IPNyBitjA/1bOEdlrmKhMdIZ3hnseM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774572937; c=relaxed/simple; bh=tztSE7SMotP2ApOQgMs6VQN4mKHjZGlxVgzyCALnvg4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=WUVql5LxsZf/k3CpqjuqEUUPaY4Hn7p8ramEwETWEqfRSa66sI3zbSsX3qsZix5yqJZZqVi0SfVbqT0GE64lg2aP4dUVydL62bkJ2ycP4i5tAAZAEzmQAb1BTK9A/YK+rXu6gt8QktYfvYGFvRMcPacnf8OEM6dkaccWEss7NaE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=gd9qyZa6; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="gd9qyZa6" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1774572934; bh=tztSE7SMotP2ApOQgMs6VQN4mKHjZGlxVgzyCALnvg4=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=gd9qyZa6f50EQ2woQAKWdffWYXSMAqJ+wJclbePclFRXIMJ9yiJ352MBi3TAaLSm/ IDUx3XTs/zByAj+fYw99zFfxJoSIZ713uPswMLC10F6u9oXeTV904QTdXHu3tmT+l7 1NCzaROrVBjO8xuC0FGrIttA9ZsIHQ0MsEGcR+Rsn0Y5rmEujGPRy9Ewxttxskj06U w0lpA1+RQMh/kkC2i3fn8FqlbyVR9Kx80d/Y1R6iGL4Csf2C4+zvgHARLCek8cyppC BLuFcdP/7FVPaVjfVwAjso28p959SYh4RV2qJ43CKimEbL/PG7Z7ae1tZGKf3NcCG2 Szz63pa5tASFQ== Received: from localhost (unknown [86.123.23.225]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: cristicc) by bali.collaboradmins.com (Postfix) with ESMTPSA id E32CC17E62BF; Fri, 27 Mar 2026 01:55:33 +0100 (CET) From: Cristian Ciocaltea Date: Fri, 27 Mar 2026 02:55:08 +0200 Subject: [PATCH v3 2/2] drm/rockchip: dw_dp: Release core resources Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260327-drm-rk-fixes-v3-2-fd2e6900c08c@collabora.com> References: <20260327-drm-rk-fixes-v3-0-fd2e6900c08c@collabora.com> In-Reply-To: <20260327-drm-rk-fixes-v3-0-fd2e6900c08c@collabora.com> To: Sandy Huang , =?utf-8?q?Heiko_St=C3=BCbner?= , Andy Yan , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dmitry Baryshkov , Dmitry Baryshkov , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec Cc: kernel@collabora.com, dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-rockchip@lists.infradead.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.14.3 Core resources such as the DisplayPort AUX channel get initialized and registered during dw_dp_bind(), but are never unregistered, which may lead to memory leaks and/or use-after-free: [ 224.661371] BUG: KASAN: slab-use-after-free in device_is_dependent+0xe0/= 0x2b0 [ 224.662015] Read of size 8 at addr ffff00011aee8550 by task modprobe/658 [ 224.662612] [ 224.662752] CPU: 7 UID: 0 PID: 658 Comm: modprobe Not tainted 7.0.0-rc2-= next-20260305 #14 PREEMPT [ 224.662759] Hardware name: Radxa ROCK 5B (DT) [ 224.662762] Call trace: [ 224.662764] show_stack+0x20/0x38 (C) [ 224.662772] dump_stack_lvl+0x6c/0x98 [ 224.662777] print_report+0x160/0x4b8 [ 224.662783] kasan_report+0xb4/0xe0 [ 224.662790] __asan_report_load8_noabort+0x20/0x30 [ 224.662796] device_is_dependent+0xe0/0x2b0 [ 224.662802] device_is_dependent+0x108/0x2b0 [ 224.662808] device_link_add+0x1f8/0x10b0 [ 224.662813] devm_of_phy_get_by_index+0x120/0x200 [ 224.662819] dw_dp_bind+0x34c/0xb10 [dw_dp] [ 224.662830] dw_dp_rockchip_bind+0x194/0x250 [rockchipdrm] [ 224.662864] component_bind_all+0x3a8/0x720 [ 224.662869] rockchip_drm_bind+0x120/0x390 [rockchipdrm] [ 224.662899] try_to_bring_up_aggregate_device+0x76c/0x838 [ 224.662904] component_master_add_with_match+0x1f4/0x230 [ 224.662909] rockchip_drm_platform_probe+0x420/0x538 [rockchipdrm] [ 224.662939] platform_probe+0xe8/0x168 [ 224.662945] really_probe+0x340/0x828 [ 224.662950] __driver_probe_device+0x2e0/0x350 [ 224.662954] driver_probe_device+0x80/0x140 [ 224.662959] __driver_attach+0x398/0x460 [ 224.662964] bus_for_each_dev+0xe0/0x198 [ 224.662968] driver_attach+0x50/0x68 [ 224.662972] bus_add_driver+0x2a0/0x4c0 [ 224.662977] driver_register+0x294/0x360 [ 224.662982] __platform_driver_register+0x7c/0x98 [ 224.662987] rockchip_drm_init+0xc4/0xff8 [rockchipdrm] Since a previous commit exported dw_dp_unbind() function in DW DP core library to take care of the necessary cleanup, use this in the component's unbind() callback, as well as in its bind() error path. Fixes: d68ba7bac955 ("drm/rockchip: Add RK3588 DPTX output support") Signed-off-by: Cristian Ciocaltea --- drivers/gpu/drm/rockchip/dw_dp-rockchip.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c b/drivers/gpu/drm/ro= ckchip/dw_dp-rockchip.c index 22c0911f1896..8cba90d2dd56 100644 --- a/drivers/gpu/drm/rockchip/dw_dp-rockchip.c +++ b/drivers/gpu/drm/rockchip/dw_dp-rockchip.c @@ -108,14 +108,28 @@ static int dw_dp_rockchip_bind(struct device *dev, st= ruct device *master, void * =20 connector =3D drm_bridge_connector_init(drm_dev, encoder); if (IS_ERR(connector)) - return dev_err_probe(dev, PTR_ERR(connector), - "Failed to init bridge connector"); + ret =3D dev_err_probe(dev, PTR_ERR(connector), + "Failed to init bridge connector"); + else + ret =3D drm_connector_attach_encoder(connector, encoder); =20 - return drm_connector_attach_encoder(connector, encoder); + if (ret) + dw_dp_unbind(dp->base); + + return ret; +} + +static void dw_dp_rockchip_unbind(struct device *dev, struct device *maste= r, + void *data) +{ + struct rockchip_dw_dp *dp =3D dev_get_drvdata(dev); + + dw_dp_unbind(dp->base); } =20 static const struct component_ops dw_dp_rockchip_component_ops =3D { .bind =3D dw_dp_rockchip_bind, + .unbind =3D dw_dp_rockchip_unbind, }; =20 static int dw_dp_probe(struct platform_device *pdev) --=20 2.52.0