Hi Dave,

On Wed, Dec 09, 2020 at 03:27:05PM +0000, Dave Stevenson wrote:
> Hi Maxime
> 
> On Mon, 7 Dec 2020 at 15:57, Maxime Ripard <maxime@cerno.tech> wrote:
> >
> > The BCM2711 supports higher bpc count than just 8, so let's support it in
> > our driver.
> >
> > Signed-off-by: Maxime Ripard <maxime@cerno.tech>
> > ---
> >  drivers/gpu/drm/vc4/vc4_hdmi.c      | 71 ++++++++++++++++++++++++++++-
> >  drivers/gpu/drm/vc4/vc4_hdmi.h      |  1 +
> >  drivers/gpu/drm/vc4/vc4_hdmi_regs.h |  9 ++++
> >  3 files changed, 80 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
> > index f4ff6b5db484..fb30ddd842b1 100644
> > --- a/drivers/gpu/drm/vc4/vc4_hdmi.c
> > +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
> > @@ -76,6 +76,17 @@
> >  #define VC5_HDMI_VERTB_VSPO_SHIFT              16
> >  #define VC5_HDMI_VERTB_VSPO_MASK               VC4_MASK(29, 16)
> >
> > +#define VC5_HDMI_DEEP_COLOR_CONFIG_1_INIT_PACK_PHASE_SHIFT     8
> > +#define VC5_HDMI_DEEP_COLOR_CONFIG_1_INIT_PACK_PHASE_MASK      VC4_MASK(10, 8)
> > +
> > +#define VC5_HDMI_DEEP_COLOR_CONFIG_1_COLOR_DEPTH_SHIFT         0
> > +#define VC5_HDMI_DEEP_COLOR_CONFIG_1_COLOR_DEPTH_MASK          VC4_MASK(3, 0)
> > +
> > +#define VC5_HDMI_GCP_CONFIG_GCP_ENABLE         BIT(31)
> > +
> > +#define VC5_HDMI_GCP_WORD_1_GCP_SUBPACKET_BYTE_1_SHIFT 8
> > +#define VC5_HDMI_GCP_WORD_1_GCP_SUBPACKET_BYTE_1_MASK  VC4_MASK(15, 8)
> > +
> >  # define VC4_HD_M_SW_RST                       BIT(2)
> >  # define VC4_HD_M_ENABLE                       BIT(0)
> >
> > @@ -179,6 +190,9 @@ static void vc4_hdmi_connector_reset(struct drm_connector *connector)
> >
> >         kfree(connector->state);
> >
> > +       conn_state->base.max_bpc = 8;
> > +       conn_state->base.max_requested_bpc = 8;
> > +
> 
> Having added protection from the kzalloc failing in 4/9, this adds
> back in dereferencing conn_state without having checked it succeeded
> first :(

Yeah, you're right :/

I also noticed that we kfree the connector->state pointer, but nothing
really guarantees that the base field in our structure is at the offset
0

I've fixed both issues, I'll send a new iteration

Thanks!
Maxime