Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Devm lifecycle mismatch with DRM device leads to a Use-After-Free of the encoder structure if userspace holds the DRM file descriptor open after the device unbinds. -- --- Patch [13]: [PATCH 13/15] drm/meson: remove dependency on DRM simple helpers --- commit 2b596eefd506c3e256e80a53bf84b95edfa9824a Author: Diogo Silva <[email protected]> drm/meson: remove dependency on DRM simple helpers The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. > diff --git a/drivers/gpu/drm/meson/meson_encoder_cvbs.c > b/drivers/gpu/drm/meson/meson_encoder_cvbs.c > index 22cacb1660c4f..cdb84d2283f83 100644 > --- a/drivers/gpu/drm/meson/meson_encoder_cvbs.c > +++ b/drivers/gpu/drm/meson/meson_encoder_cvbs.c [ ... ] > @@ -257,8 +261,9 @@ int meson_encoder_cvbs_probe(struct meson_drm *priv) > meson_encoder_cvbs->priv = priv; > > /* Encoder */ > - ret = drm_simple_encoder_init(priv->drm, &meson_encoder_cvbs->encoder, > - DRM_MODE_ENCODER_TVDAC); > + ret = drm_encoder_init(priv->drm, &meson_encoder_cvbs->encoder, > + &meson_encoder_cvbs_funcs, > + DRM_MODE_ENCODER_TVDAC, NULL); [Severity: High] This is a pre-existing issue, but does this create a use-after-free risk during device unbind? In meson_encoder_cvbs_probe(), the encoder is embedded within meson_encoder_cvbs, which is allocated via devm_drm_bridge_alloc() and tied to the device lifetime. However, by using drm_encoder_init(), the encoder is registered with the DRM device's lifecycle. If a driver unbind occurs (e.g., via sysfs) while userspace holds an open DRM file descriptor, devres will execute and free the bridge memory along with the embedded encoder. Later, when the file descriptor is closed, drm_mode_config_cleanup() iterates over the encoder_list and attempts to call the encoder's destroy function on the already freed memory. Could we use drmm_encoder_init() instead to safely tie the encoder's lifetime to the DRM device? This same devm vs DRM lifecycle mismatch is also present in meson_encoder_dsi_probe() in drivers/gpu/drm/meson/meson_encoder_dsi.c and meson_encoder_hdmi_probe() in drivers/gpu/drm/meson/meson_encoder_hdmi.c. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=13
