Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Dangling pointer leading to Use-After-Free in vmw_du_connector_reset when kzalloc_obj fails. -- commit 0910404d300f75561678f127f981fe7f17dcd288 Author: Maxime Ripard <[email protected]> drm/vmwgfx: Convert to atomic_create_state The plane reset implementation creates a custom state subclass, but only initializes a pristine state without resetting any hardware. This is equivalent to what atomic_create_state expects. Convert to it. > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c > b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c > index 0b470809661c7..9031dccad31d7 100644 > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c > @@ -279,27 +279,24 @@ vmw_du_plane_duplicate_state(struct drm_plane *plane) > > > /** > - * vmw_du_plane_reset - creates a blank vmw plane state > + * vmw_du_plane_create_state - creates a blank vmw plane state > * @plane: drm plane > * > - * Resets the atomic state for @plane by freeing the state pointer (which > might > - * be NULL, e.g. at driver load time) and allocating a new empty state > object. > + * Allocates a new empty state object. > */ > -void vmw_du_plane_reset(struct drm_plane *plane) > +struct drm_plane_state *vmw_du_plane_create_state(struct drm_plane *plane) > { > struct vmw_plane_state *vps; > > - if (plane->state) > - vmw_du_plane_destroy_state(plane, plane->state); > - > vps = kzalloc_obj(*vps); > - > if (!vps) { > DRM_ERROR("Cannot allocate vmw_plane_state\n"); > - return; > + return ERR_PTR(-ENOMEM); > } [Severity: High] This isn't a bug introduced by this patch, but while reviewing this change I noticed a similar pre-existing issue remains in vmw_du_connector_reset(). When kzalloc_obj() fails during memory pressure (e.g., during device probe, modeset, or hotplug handling), connector->state is left dangling as a pointer to the previously freed memory: drivers/gpu/drm/vmwgfx/vmwgfx_kms.c:vmw_du_connector_reset() { if (connector->state) { __drm_atomic_helper_connector_destroy_state(connector->state); kfree(vmw_connector_state_to_vcs(connector->state)); } vcs = kzalloc_obj(*vcs); if (!vcs) { DRM_ERROR("Cannot allocate vmw_connector_state\n"); return; } ... } Does this leave connector->state pointing to freed memory, leading to a use-after-free when the DRM core later accesses it? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=38
