Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Missing drm_panel_remove() on devm_mipi_dsi_attach() error path in boe_bf060y8m_aj0_probe() causes a dangling pointer and use-after-free. -- --- Patch [1]: [PATCH v3 1/6] drm/panel: Use devm_mipi_dsi_attach in BOE panels --- commit 1f4d2947471e6cb49ce506f1077843c672e21899 Author: Osama Abdelkader <[email protected]> drm/panel: Use devm_mipi_dsi_attach in BOE panels Use the managed MIPI DSI attach helper in BOE panel drivers and drop the corresponding manual detach calls from remove paths. > diff --git a/drivers/gpu/drm/panel/panel-boe-bf060y8m-aj0.c > b/drivers/gpu/drm/panel/panel-boe-bf060y8m-aj0.c > index 84c21c62a43e4..6a74523a66141 100644 > --- a/drivers/gpu/drm/panel/panel-boe-bf060y8m-aj0.c > +++ b/drivers/gpu/drm/panel/panel-boe-bf060y8m-aj0.c > @@ -359,7 +359,7 @@ static int boe_bf060y8m_aj0_probe(struct mipi_dsi_device > *dsi) > > drm_panel_add(&boe->panel); > > - ret = mipi_dsi_attach(dsi); > + ret = devm_mipi_dsi_attach(&dsi->dev, dsi); > if (ret < 0) { > dev_err(dev, "Failed to attach to DSI host: %d\n", ret); > return ret; [Severity: High] This is a pre-existing issue, but should drm_panel_remove(&boe->panel) be called on this error path? In boe_bf060y8m_aj0_probe(), drm_panel_add() inserts the panel into the global panel_list. If devm_mipi_dsi_attach() fails, the function returns an error without calling drm_panel_remove(). During probe failure, the devres cleanup drops the panel's refcount but it remains in the global panel_list since the refcount doesn't reach zero. If another driver later looks up this panel (e.g., via of_drm_find_panel()) and invokes its operations, it will dereference freed devres-managed resources like boe->reset_gpio, causing a use-after-free. Other BOE panel drivers updated in this patch seem to correctly handle this cleanup. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
