Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Panel is published globally before initialization is complete, exposing a race condition that leads to Use-After-Free of DSI devices and devm-managed resources if an error occurs. -- commit 06a7a4ea81475e17e3e167d525f0a49d30e5896a Author: Guangshuo Li <[email protected]> drm/panel: novatek-nt35950: fix potential use-after-free on attach failure This commit attempts to fix a potential use-after-free issue by detaching DSI hosts and removing the panel from the DRM panel registry if mipi_dsi_attach() fails during probe. > diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35950.c > b/drivers/gpu/drm/panel/panel-novatek-nt35950.c > index 94aa6489d99fc..8edd0aa363cec 100644 > --- a/drivers/gpu/drm/panel/panel-novatek-nt35950.c > +++ b/drivers/gpu/drm/panel/panel-novatek-nt35950.c > @@ -514,12 +514,19 @@ static int nt35950_probe(struct mipi_dsi_device *dsi) > > ret = mipi_dsi_attach(nt->dsi[i]); > if (ret < 0) { > - /* If we fail to attach to either host, we're done */ > + dev_err_probe(dev, ret, > + "Cannot attach to DSI%d host.\n", i); > + > + /* Detach from all previously attached DSI hosts */ > + while (i--) > + mipi_dsi_detach(nt->dsi[i]); > + > if (num_dsis == 2) > mipi_dsi_device_unregister(nt->dsi[1]); > > - return dev_err_probe(dev, ret, > - "Cannot attach to DSI%d host.\n", > i); > + drm_panel_remove(&nt->panel); > + > + return ret; [Severity: High] This is a pre-existing issue, but does this still leave a race condition since the panel is published globally before mipi_dsi_attach() is called? Earlier in nt35950_probe(), the panel is published globally: drm_panel_add(&nt->panel); If a concurrent thread (like a display controller) discovers the panel via of_drm_find_panel() and acquires a reference, and then mipi_dsi_attach() fails, this error path executes: if (num_dsis == 2) mipi_dsi_device_unregister(nt->dsi[1]); drm_panel_remove(&nt->panel); The concurrent thread will keep the panel structure alive. If that thread subsequently initiates a display modeset, it will call drm_panel_prepare() which invokes nt35950_on() and dereferences the now-freed secondary DSI device: nt->dsi[1]->mode_flags |= MIPI_DSI_MODE_LPM; Could drm_panel_add() be moved to the very end of the probe function, after all initializations (including mipi_dsi_attach) have successfully completed? > } > } > -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
