Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
New issues: - [High] Uninitialized pointer dereference in the error handling path of `meson_drv_bind_master`. Pre-existing issues: - [High] NULL pointer dereference when `devm_kzalloc` fails to allocate the `priv` structure. -- --- Patch [19]: [PATCH v7 19/19] gpu: drm: meson: Fix DMA segment size limits and maximize allocation boundaries --- commit 5509f37f742bf971664f2f0e723c6187dedff8d4 Author: Anand Moon <[email protected]> gpu: drm: meson: Fix DMA segment size limits and maximize allocation boundaries This commit addresses DMA layout configuration constraints by setting a 32-bit coherent DMA allocation window and maximizing the scatter-gather allocation segment boundary check constraint. > diff --git a/drivers/gpu/drm/meson/meson_drv.c > b/drivers/gpu/drm/meson/meson_drv.c > index 49ff9f1f16d32..899e70bca4ce2 100644 > --- a/drivers/gpu/drm/meson/meson_drv.c > +++ b/drivers/gpu/drm/meson/meson_drv.c > @@ -202,6 +202,12 @@ static int meson_drv_bind_master(struct device *dev, > bool has_components) > if (IS_ERR(drm)) > return PTR_ERR(drm); > > + ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32)); > + if (ret) > + goto free_drm; [Severity: High] If dma_set_mask_and_coherent() fails in meson_drv_bind_master(), the code jumps to the free_drm error path before the priv pointer is allocated and initialized. Because the free_drm label unconditionally passes priv to encoder removal functions: drivers/gpu/drm/meson/meson_drv.c:meson_drv_bind_master() { ... free_drm: drm_dev_put(drm); meson_encoder_dsi_remove(priv); ... } And meson_encoder_dsi_remove() dereferences priv immediately: drivers/gpu/drm/meson/meson_encoder_dsi.c:meson_encoder_dsi_remove() { ... if (priv->encoders[MESON_ENC_DSI]) { ... } Will this result in dereferencing an uninitialized stack pointer? > + > + dma_set_max_seg_size(dev, UINT_MAX); > + > priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); > if (!priv) { > ret = -ENOMEM; > goto free_drm; [Severity: High] This is a pre-existing issue, but if devm_kzalloc() in meson_drv_bind_master() fails to allocate priv, it will be set to NULL and the code jumps to free_drm. Similar to the above issue, this will pass a NULL priv pointer to meson_encoder_dsi_remove(), which does not check for NULL before dereferencing it: drivers/gpu/drm/meson/meson_encoder_dsi.c:meson_encoder_dsi_remove() { ... if (priv->encoders[MESON_ENC_DSI]) { ... } Will this cause a NULL pointer dereference during an out-of-memory condition? > } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=19
