Re: [PATCH v9 55/61] drm/tests: hdmi_state_helper: Convert to drmm_connector_hdmi_init()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Stack-allocated `drm_connector_hdmi_funcs` struct is stored as a pointer in a KUnit-managed DRM connector, creating a dangling pointer.
--

--- Patch [55]: [PATCH v9 55/61] drm/tests: hdmi_state_helper: Convert to drmm_connector_hdmi_init() ---
commit d347c36729856832cc090215d18711ccc7662d1d
Author: Cristian Ciocaltea <[email protected]>

drm/tests: hdmi_state_helper: Convert to drmm_connector_hdmi_init()

This commit updates the HDMI state helper tests to use the new
drmm_connector_hdmi_init() signature. The previously explicit arguments
for vendor, product, formats, and bpc are now wrapped inside a
drm_connector_hdmi_funcs structure instead of being passed as discrete
arguments.

> diff --git a/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c b/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c
> --- a/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c
> +++ b/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c
> @@ -883,6 +874,7 @@ static void drm_test_check_broadcast_rgb_limited_cea_mode_vic_1(struct kunit *te
>   */
>  static void drm_test_check_broadcast_rgb_cea_mode_yuv420(struct kunit *test)
>  {
> +	struct drm_connector_hdmi_funcs hdmi_funcs = dummy_connector_hdmi_funcs;
>  	struct drm_atomic_helper_connector_hdmi_priv *priv;
>  	enum drm_hdmi_broadcast_rgb broadcast_rgb;
>  	struct drm_modeset_acquire_ctx ctx;
> @@ -895,12 +887,11 @@ static void drm_test_check_broadcast_rgb_cea_mode_yuv420(struct kunit *test)
>  	int ret;
>  
>  	broadcast_rgb = *(enum drm_hdmi_broadcast_rgb *)test->param_value;
> +	hdmi_funcs.supported_formats = BIT(DRM_OUTPUT_COLOR_FORMAT_RGB444) |
> +				       BIT(DRM_OUTPUT_COLOR_FORMAT_YCBCR420);
>  
>  	priv = drm_kunit_helper_connector_hdmi_init_with_edid_funcs(test,
> -				BIT(DRM_OUTPUT_COLOR_FORMAT_RGB444) |
> -				BIT(DRM_OUTPUT_COLOR_FORMAT_YCBCR420),
> -				8,
> -				&dummy_connector_hdmi_funcs,
> +				&hdmi_funcs,
>  				test_edid_hdmi_1080p_rgb_yuv_4k_yuv420_dc_max_200mhz);
>  	KUNIT_ASSERT_NOT_NULL(test, priv);

[Severity: Medium]
Could this lead to a use-after-scope bug during test cleanup?

A local stack variable hdmi_funcs is allocated here and its address is
passed into drm_kunit_helper_connector_hdmi_init_with_edid_funcs(). Under
the hood, drmm_connector_hdmi_init() in drivers/gpu/drm/drm_connector.c
stores this pointer directly without copying the structure:

drmm_connector_hdmi_init() {
    ...
    connector->hdmi.funcs = hdmi_funcs;
    ...
}

Because the connector is KUnit-managed and outlives the test function,
the hdmi.funcs pointer will become a dangling pointer as soon as the
test returns. If KUnit cleanup or any deferred teardown tasks attempt to
access this pointer later, it could result in memory corruption or KASAN
splats.

This same pattern appears to be repeated in numerous other tests introduced
by this patch, such as drm_test_check_output_bpc_crtc_mode_changed().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=55