Claude review: drm/amdgpu/amdgpu_connectors: remove amdgpu_connector_free_edid

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**This patch has a critical bug.** The removed function was:

```c
static void amdgpu_connector_free_edid(struct drm_connector *connector)
{
	struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);

	kfree(amdgpu_connector->edid);
	amdgpu_connector->edid = NULL;   // <-- THIS IS IMPORTANT
}
```

`drm_edid_free()` only frees the memory — it **does not** and **cannot** set the caller's pointer to NULL. Every replacement site leaves `amdgpu_connector->edid` as a dangling pointer.

**Specific use-after-free sites:**

1. **`amdgpu_connector_vga_detect()` line 868:**
   ```c
   drm_edid_free(amdgpu_connector->edid);
   amdgpu_connector_get_edid(connector);
   ```
   `amdgpu_connector_get_edid()` starts with `if (amdgpu_connector->edid) return;` — the dangling non-NULL pointer causes it to return immediately without reading a new EDID. The subsequent `if (!amdgpu_connector->edid)` check at line 871 then sees a non-NULL freed pointer and proceeds to call `drm_edid_is_digital()` on freed memory.

2. **`amdgpu_connector_vga_detect()` line 884** (shared DDC disconnect path): `drm_edid_free()` without NULL leaves a dangling pointer that persists in the struct for future accesses.

3. **`amdgpu_connector_shared_ddc()` line 979:** Same dangling pointer issue.

4. **`amdgpu_connector_dvi_detect()` line 1048:** Same bug as site 1 — `amdgpu_connector_get_edid()` will see the dangling pointer and skip the EDID read.

5. **`amdgpu_connector_dvi_detect()` line 1064** (shared DDC disconnect): Same dangling pointer.

6. **`amdgpu_connector_dp_detect()` line 1412:** Dangling pointer left after free.

7. **`amdgpu_connector_destroy()` line 749:** This is the **only** safe call site — the connector struct is `kfree()`d at line 753, so the dangling pointer is irrelevant.

**Fix:** Every `drm_edid_free(amdgpu_connector->edid)` call (except in `_destroy`) must be followed by `amdgpu_connector->edid = NULL`. Alternatively, keep a helper function:

```c
static void amdgpu_connector_free_edid(struct drm_connector *connector)
{
	struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);

	drm_edid_free(amdgpu_connector->edid);
	amdgpu_connector->edid = NULL;
}
```

This would preserve the original behavior while still removing the old `kfree()` call. The commit message claim that "we can just call drm_edid_free directly" is incorrect because the semantics differ — the wrapper provided NULL-clearing that `drm_edid_free()` does not.

**Verdict: Patch 2 must be reworked. It introduces use-after-free bugs at 6 call sites.**

---
Generated by Claude Code Patch Reviewer