From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: Rockchip DRM use-after-free & null-ptr-deref fixes Date: Thu, 04 Jun 2026 13:55:04 +1000 Message-ID: In-Reply-To: <20260601-drm-rk-fixes-v4-0-c3f3f123e1da@collabora.com> References: <20260601-drm-rk-fixes-v4-0-c3f3f123e1da@collabora.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Overall Series Review Subject: Rockchip DRM use-after-free & null-ptr-deref fixes Author: Cristian Ciocaltea Patches: 7 Reviewed: 2026-06-04T13:55:04.889679 --- This is a clean 3-patch fix series addressing a real use-after-free bug in = the Rockchip DW DP driver. The KASAN splat in patch 3's commit message conf= irms the issue is reproducible. The approach is sound: patch 1 adds the cle= anup primitive to the core library, patch 2 is a trivial cosmetic fix, and = patch 3 wires up the cleanup in the platform driver's bind error path and u= nbind callback. The series is well-structured with correct ordering of depe= ndencies between patches. The core issue is that `drm_dp_aux_register()` in `dw_dp_bind()` (line 2051= of `dw-dp.c`) is the only resource allocation in that function that is **n= ot** managed by devres =E2=80=94 all other resources use `devm_*` variants.= Without an explicit unregister, the AUX adapter leaks or triggers use-afte= r-free on module unload/reload. One question worth considering: could `dw_dp_bind()` use `devm_add_action_o= r_reset()` to register `drm_dp_aux_unregister` as a devres action instead, = eliminating the need for a separate `dw_dp_unbind()` entirely? That would f= ollow the pattern already used for `phy_exit()` at line 2071. However, the = current approach is also valid and gives the caller explicit control over c= leanup ordering. The series looks correct and ready to merge. No bugs found. --- Generated by Claude Code Patch Reviewer