Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Explicitly calling drmm_kfree() on a connector object after drmm_writeback_connector_init() fails causes a Use-After-Free during device teardown. --
--- Patch [4]: [PATCH v7 4/9] drm/komeda: use drmm_writeback_connector_init() --- commit 3173648ea1f2a16e64287bfe2ee141ab88437977 Author: Dmitry Baryshkov <[email protected]> drm/komeda: use drmm_writeback_connector_init() This commit updates the komeda driver to use drmm_writeback_connector_init() instead of its non-managed counterpart to ensure proper cleanup of the job queue. It also converts the encoder and connector allocations to use the drmm_ APIs. > --- a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c > +++ b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c [ ... ] > @@ -161,18 +157,29 @@ static int komeda_wb_connector_add(struct > komeda_kms_dev *kms, [ ... ] > + err = drmm_writeback_connector_init(&kms->base, wb_conn, > + &komeda_wb_connector_funcs, > + encoder, > + formats, n_formats); > komeda_put_fourcc_list(formats); > if (err) { > - kfree(kwb_conn); > + drmm_kfree(&kms->base, kwb_conn); [Severity: High] Does explicitly calling drmm_kfree() here in komeda_wb_connector_add() on the error path cause a use-after-free during device teardown? If drmm_writeback_connector_init() fails after successfully calling drmm_connector_init() internally (e.g., if property creation fails in __drm_writeback_connector_init()), a managed cleanup action (drm_connector_cleanup_action) will have already been registered. Calling drmm_kfree() frees the kwb_conn memory, but leaves the cleanup action registered in the DRM managed resources list. When drm_managed_release() is later called, won't it execute the cleanup action with a pointer to the already-freed connector? > return err; > } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
