Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] drm/panel: UAF/race in panel-simple due to devres teardown inversion --
commit 16997c0bba9fd7e98551173f3a8332211618f894 Author: Osama Abdelkader <[email protected]> drm/panel: simple: Use managed helpers in panel-simple This commit replaces the manual drm_panel_add and drm_panel_remove calls in panel-simple with devm_drm_panel_add, removing the explicit drm_panel_remove call from the remove path. > diff --git a/drivers/gpu/drm/panel/panel-simple.c > b/drivers/gpu/drm/panel/panel-simple.c > index c95964ba25a95..02d21dde57663 100644 > --- a/drivers/gpu/drm/panel/panel-simple.c > +++ b/drivers/gpu/drm/panel/panel-simple.c > @@ -737,7 +737,9 @@ static struct panel_simple *panel_simple_probe(struct > device *dev) > goto disable_pm_runtime; > } > > - drm_panel_add(&panel->base); > + err = devm_drm_panel_add(dev, &panel->base); > + if (err) > + goto disable_pm_runtime; > > return panel; > [ ... ] > @@ -785,7 +787,6 @@ static void panel_simple_remove(struct device *dev) > { > struct panel_simple *panel = dev_get_drvdata(dev); > > - drm_panel_remove(&panel->base); > panel_simple_shutdown(dev); > > pm_runtime_dont_use_autosuspend(dev); > pm_runtime_disable(dev); > if (panel->ddc) > put_device(&panel->ddc->dev); [Severity: High] Does this devres conversion introduce a teardown sequence inversion that leads to a use-after-free window? By switching to devm_drm_panel_add in panel_simple_probe, the panel's removal from the global DRM panel list is deferred until after the panel_simple_remove callback completes and devres cleanup runs. However, panel_simple_remove manually shuts down the panel, disables PM runtime, and drops the DDC adapter reference (via put_device) while the panel is still registered and discoverable. If a concurrent display driver probes during this window, can it find the panel via of_drm_find_panel and call drm_panel_get_modes? This would dereference the already-released panel->ddc adapter and call PM runtime functions on a disabled device. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
