public inbox for drm-ai-reviews@public-inbox.freedesktop.org
 help / color / mirror / Atom feed
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: drm/rockchip: dw_dp: Release core resources
Date: Thu, 04 Jun 2026 13:55:05 +1000	[thread overview]
Message-ID: <review-patch3-20260601-drm-rk-fixes-v4-3-c3f3f123e1da@collabora.com> (raw)
In-Reply-To: <20260601-drm-rk-fixes-v4-3-c3f3f123e1da@collabora.com>

Patch Review

**Correctness: Good.** This is the key patch that actually fixes the use-after-free.

**Bind error path cleanup:**
```c
-	if (IS_ERR(connector))
+	if (IS_ERR(connector)) {
+		dw_dp_unbind(dp->base);
 		return dev_err_probe(dev, PTR_ERR(connector),
 				     "Failed to init bridge connector\n");
+	}
```

This correctly calls `dw_dp_unbind(dp->base)` when `drm_bridge_connector_init()` fails after `dw_dp_bind()` has already succeeded. The `dp->base` field holds the `struct dw_dp *` returned by `dw_dp_bind()`, so this is the right pointer to pass.

**Unbind callback:**
```c
+static void dw_dp_rockchip_unbind(struct device *dev, struct device *master,
+				  void *data)
+{
+	struct rockchip_dw_dp *dp = dev_get_drvdata(dev);
+
+	dw_dp_unbind(dp->base);
+}
```

This correctly retrieves the driver data and calls `dw_dp_unbind()`. The component framework's `.unbind` callback signature is correctly followed.

```c
 static const struct component_ops dw_dp_rockchip_component_ops = {
 	.bind = dw_dp_rockchip_bind,
+	.unbind = dw_dp_rockchip_unbind,
 };
```

**One thing to verify:** the unbind only unregisters the AUX channel. All other resources allocated in `dw_dp_bind()` are devres-managed (`devm_drm_bridge_alloc`, `devm_regmap_init_mmio`, `devm_of_phy_get`, `devm_clk_get_enabled`, `devm_reset_control_get`, `devm_drm_bridge_add`, `devm_request_threaded_irq`, `devm_add_action_or_reset`). The devres cleanup runs automatically when the device is unbound, so only the non-devres `drm_dp_aux_register()` needs explicit cleanup. This is correct — the AUX channel registration at line 2051 is the only non-devres resource.

**Ordering concern (not a bug):** `dw_dp_unbind()` unregisters the AUX channel, then devres tears down everything else. Since `drm_dp_aux_unregister()` just removes the I2C adapter and doesn't depend on the other resources being live, this ordering is safe.

No issues.

---
Generated by Claude Code Patch Reviewer

  parent reply	other threads:[~2026-06-04  3:55 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-06-01 16:13 [PATCH v4 0/3] Rockchip DRM use-after-free & null-ptr-deref fixes Cristian Ciocaltea
2026-06-01 16:13 ` [PATCH v4 1/3] drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel Cristian Ciocaltea
2026-06-04  3:55   ` Claude review: " Claude Code Review Bot
2026-06-01 16:13 ` [PATCH v4 2/3] drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message Cristian Ciocaltea
2026-06-03 13:01   ` Andy Yan
2026-06-04  3:55   ` Claude review: " Claude Code Review Bot
2026-06-01 16:13 ` [PATCH v4 3/3] drm/rockchip: dw_dp: Release core resources Cristian Ciocaltea
2026-06-03 13:03   ` Andy Yan
2026-06-04  3:55   ` Claude Code Review Bot [this message]
2026-06-02 19:31 ` [PATCH v4 0/3] Rockchip DRM use-after-free & null-ptr-deref fixes Heiko Stuebner
2026-06-04  3:55 ` Claude review: " Claude Code Review Bot
  -- strict thread matches above, loose matches on Subject: below --
2026-04-30 22:20 [PATCH v2 00/12] Synopsys DisplayPort Controller improvements for Rockchip platforms Sebastian Reichel
2026-04-30 22:20 ` [PATCH v2 02/12] drm/rockchip: dw_dp: Release core resources Sebastian Reichel
2026-05-04 23:49   ` Claude review: " Claude Code Review Bot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=review-patch3-20260601-drm-rk-fixes-v4-3-c3f3f123e1da@collabora.com \
    --to=claude-review@example.com \
    --cc=dri-devel-reviews@example.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox