From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: drm/rockchip: dw_dp: Release core resources
Date: Thu, 04 Jun 2026 13:55:05 +1000
Message-ID: <review-patch3-20260601-drm-rk-fixes-v4-3-c3f3f123e1da@collabora.com>
In-Reply-To: <20260601-drm-rk-fixes-v4-3-c3f3f123e1da@collabora.com>
References: <20260601-drm-rk-fixes-v4-0-c3f3f123e1da@collabora.com> <20260601-drm-rk-fixes-v4-3-c3f3f123e1da@collabora.com>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Patch Review

**Correctness: Good.** This is the key patch that actually fixes the use-af=
ter-free.

**Bind error path cleanup:**
```c
-	if (IS_ERR(connector))
+	if (IS_ERR(connector)) {
+		dw_dp_unbind(dp->base);
 		return dev_err_probe(dev, PTR_ERR(connector),
 				     "Failed to init bridge connector\n");
+	}
```

This correctly calls `dw_dp_unbind(dp->base)` when `drm_bridge_connector_in=
it()` fails after `dw_dp_bind()` has already succeeded. The `dp->base` fiel=
d holds the `struct dw_dp *` returned by `dw_dp_bind()`, so this is the rig=
ht pointer to pass.

**Unbind callback:**
```c
+static void dw_dp_rockchip_unbind(struct device *dev, struct device *maste=
r,
+				  void *data)
+{
+	struct rockchip_dw_dp *dp =3D dev_get_drvdata(dev);
+
+	dw_dp_unbind(dp->base);
+}
```

This correctly retrieves the driver data and calls `dw_dp_unbind()`. The co=
mponent framework's `.unbind` callback signature is correctly followed.

```c
 static const struct component_ops dw_dp_rockchip_component_ops =3D {
 	.bind =3D dw_dp_rockchip_bind,
+	.unbind =3D dw_dp_rockchip_unbind,
 };
```

**One thing to verify:** the unbind only unregisters the AUX channel. All o=
ther resources allocated in `dw_dp_bind()` are devres-managed (`devm_drm_br=
idge_alloc`, `devm_regmap_init_mmio`, `devm_of_phy_get`, `devm_clk_get_enab=
led`, `devm_reset_control_get`, `devm_drm_bridge_add`, `devm_request_thread=
ed_irq`, `devm_add_action_or_reset`). The devres cleanup runs automatically=
 when the device is unbound, so only the non-devres `drm_dp_aux_register()`=
 needs explicit cleanup. This is correct =E2=80=94 the AUX channel registra=
tion at line 2051 is the only non-devres resource.

**Ordering concern (not a bug):** `dw_dp_unbind()` unregisters the AUX chan=
nel, then devres tears down everything else. Since `drm_dp_aux_unregister()=
` just removes the I2C adapter and doesn't depend on the other resources be=
ing live, this ordering is safe.

No issues.

---
Generated by Claude Code Patch Reviewer