Thank you for your contribution! Sashiko AI review found 1 potential issue(s) 
to consider:

Pre-existing issues:
- [High] The lockless check of `!ctx->panel.prepared` is an incomplete fix that 
leaves a TOCTOU race condition during panel teardown, allowing DCS commands to 
be sent to a powered-off panel.
--

commit 08b3ae9b50bea647e6675f125e2afbca849ac110
Author: Cédric Bellegarde <[email protected]>

drm/panel: sofef00: Fix DSI transfer errors on backlight update

Backlight updates via bl_update_status() could be triggered before the panel
was fully initialized. This commit guards bl_update_status() with a prepared
flag check to skip backlight updates when the panel is not yet ready.

> diff --git a/drivers/gpu/drm/panel/panel-samsung-sofef00.c 
> b/drivers/gpu/drm/panel/panel-samsung-sofef00.c
> index e00a497a7c961..f07d6533ed697 100644
> --- a/drivers/gpu/drm/panel/panel-samsung-sofef00.c
> +++ b/drivers/gpu/drm/panel/panel-samsung-sofef00.c
> @@ -175,9 +175,13 @@ static const struct drm_panel_funcs 
> sofef00_panel_panel_funcs = {
>  static int sofef00_panel_bl_update_status(struct backlight_device *bl)
>  {
>       struct mipi_dsi_device *dsi = bl_get_data(bl);
> +     struct sofef00_panel *ctx = mipi_dsi_get_drvdata(dsi);
>       int err;
>       u16 brightness = (u16)backlight_get_brightness(bl);
>  
> +     if (!ctx->panel.prepared)
> +             return 0;
> +

[Severity: High]
This is a pre-existing issue, but does this lockless check create a TOCTOU
race with the unprepare sequence?

During teardown, drm_panel_unprepare() calls the driver's .unprepare callback
which powers off the panel regulators, and only sets panel->prepared = false
after the callback returns. If a concurrent sysfs backlight write occurs while
.unprepare is executing, ctx->panel.prepared would still be true.

Could this allow bl_update_status() to attempt sending DCS commands to a
powered-off panel, resulting in the same DSI transmission timeouts and clock
lockups this patch is trying to fix?

Should a driver-level mutex be used to synchronize bl_update_status() with
the teardown callbacks instead?

>       dsi->mode_flags &= ~MIPI_DSI_MODE_LPM;
>  
>       err = mipi_dsi_dcs_set_display_brightness_large(dsi, brightness);

-- 
Sashiko AI review · 
https://sashiko.dev/#/patchset/[email protected]?part=1

Reply via email to