Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] This problem wasn't introduced by this patch, but there is a Use-After-Free in the driver unbind path due to an ignored error return value from devm_mipi_dsi_attach. -- --- Patch [3]: [PATCH v3 3/6] drm/panel: Use devm_mipi_dsi_attach in Novatek and Raydium panels --- commit 4038e87306192174f8d35deb13351bd8c956f7e3 Author: Osama Abdelkader <[email protected]> drm/panel: Use devm_mipi_dsi_attach in Novatek and Raydium panels Use the managed MIPI DSI attach helper in Novatek and Raydium panel drivers and drop the corresponding manual detach calls from remove paths. > diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35510.c > b/drivers/gpu/drm/panel/panel-novatek-nt35510.c > index 3189d89c7ca00..e75b6ac3df5c3 100644 > --- a/drivers/gpu/drm/panel/panel-novatek-nt35510.c > +++ b/drivers/gpu/drm/panel/panel-novatek-nt35510.c > @@ -1175,7 +1175,7 @@ static int nt35510_probe(struct mipi_dsi_device *dsi) > > drm_panel_add(&nt->panel); > > - ret = mipi_dsi_attach(dsi); > + ret = devm_mipi_dsi_attach(&dsi->dev, dsi); > if (ret < 0) > drm_panel_remove(&nt->panel); [Severity: High] This is a pre-existing issue, but if devm_mipi_dsi_attach() fails here, drm_panel_remove() is called, but the nt35510_probe() function still returns 0 (success) immediately after this. Because probe succeeds, devres cleanup isn't triggered at probe time. [ ... ] > @@ -1186,8 +1186,6 @@ static void nt35510_remove(struct mipi_dsi_device *dsi) > { > struct nt35510 *nt = mipi_dsi_get_drvdata(dsi); > int ret; > - > - mipi_dsi_detach(dsi); [Severity: High] This isn't a bug introduced by this patch, but when the driver is later unbound, nt35510_remove() calls drm_panel_remove() a second time. This drops the refcount to 0, freeing the panel memory prematurely. After nt35510_remove() completes, the devres cleanup handlers execute, including drm_panel_put_void(), which will access the already freed panel memory resulting in a use-after-free. Should nt35510_probe() return the error code instead of 0 when devm_mipi_dsi_attach() fails? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=3
