[PATCH] drm/meson: clean up KMS polling on register failure

[PATCH] drm/meson: clean up KMS polling on register failure

[Myeonghun Pak]

meson_drv_bind_master() starts the KMS polling helper before registering
the DRM device. If drm_dev_register() fails, probe unwinds the IRQ and
DRM device without stopping the polling helper.

Call drm_kms_helper_poll_fini() on that failure path before freeing the
IRQ.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/gpu/drm/meson/meson_drv.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 49ff9f1f16..e49de5df73 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -352,12 +352,14 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
 
 	ret = drm_dev_register(drm, 0);
 	if (ret)
-		goto uninstall_irq;
+		goto uninstall_poll;
 
 	drm_client_setup(drm, NULL);
 
 	return 0;
 
+uninstall_poll:
+	drm_kms_helper_poll_fini(drm);
 uninstall_irq:
 	free_irq(priv->vsync_irq, drm);
 exit_afbcd:
-- 
2.47.1

Claude review: drm/meson: clean up KMS polling on register failure

[Claude Code Review Bot]

Overall Series Review

Subject: drm/meson: clean up KMS polling on register failure
Author: Myeonghun Pak <mhun512@gmail.com>
Patches: 1
Reviewed: 2026-05-25T17:01:26.997575

---

This is a single-patch series that fixes a missing cleanup of the KMS polling helper in the error path of `meson_drv_bind_master()`. The fix is correct, minimal, and follows kernel conventions. The bug is real: `drm_kms_helper_poll_init()` is called at line 349, and if `drm_dev_register()` at line 353 subsequently fails, the original code jumped to `uninstall_irq` — skipping the necessary `drm_kms_helper_poll_fini()` call. This would leave a polling work item active against a device that is being torn down, which could lead to use-after-free or other memory corruption.

The fix adds an `uninstall_poll` label that calls `drm_kms_helper_poll_fini(drm)` before falling through to `uninstall_irq`. The unwinding order mirrors the initialization order (poll init → register, so unwind is: unregister-fail → poll fini → free irq), which is the standard kernel pattern.

**Verdict: Good patch, recommend accept.**

---
Generated by Claude Code Patch Reviewer

Claude review: drm/meson: clean up KMS polling on register failure

[Claude Code Review Bot]

Patch Review

**Correctness: Correct.**

The initialization sequence in `meson_drv_bind_master()` is:

```c
// line 343: request_irq(priv->vsync_irq, ...)
// line 349: drm_kms_helper_poll_init(drm)
// line 353: drm_dev_register(drm, 0)
```

The error unwind must be in reverse order: poll_fini → free_irq. The patch achieves this correctly:

```c
uninstall_poll:
	drm_kms_helper_poll_fini(drm);
uninstall_irq:
	free_irq(priv->vsync_irq, drm);
```

This also matches the normal teardown order in `meson_drv_unbind()` (lines 406-409), which does `drm_dev_unregister` → `drm_kms_helper_poll_fini` → `free_irq`.

**Fixes tag:** The `Fixes:` tag references `bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller")`, which is the commit that introduced this function. This is appropriate since the bug has existed since the original code.

**Stable tag:** The `Cc: stable@vger.kernel.org` tag is appropriate for a resource-leak/use-after-free fix on an error path.

**No issues found.** The patch is minimal, correct, and well-described. The commit message accurately explains the problem and the fix.

---
Generated by Claude Code Patch Reviewer