Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Use-After-Free during teardown due to object lifetime mismatch between `drm_bridge` and `drm_encoder`. -- --- Patch [7]: [PATCH 07/15] drm/tidss: remove dependency on DRM simple helpers --- commit e6abfa8d59d485697fcfe2a3a199e7f378a7e23a Author: Diogo Silva <[email protected]> drm/tidss: remove dependency on DRM simple helpers The patch removes the deprecated simple KMS helpers from the tidss driver. It replaces drm_simple_encoder_init() with a direct call to drm_encoder_init(), providing driver-local drm_encoder_funcs to handle cleanup. > diff --git a/drivers/gpu/drm/tidss/tidss_encoder.c > b/drivers/gpu/drm/tidss/tidss_encoder.c > index 698f8d964ca00..10dbcc6cdf6a8 100644 > --- a/drivers/gpu/drm/tidss/tidss_encoder.c > +++ b/drivers/gpu/drm/tidss/tidss_encoder.c [ ... ] > @@ -81,6 +81,10 @@ static const struct drm_bridge_funcs tidss_bridge_funcs = { > .atomic_destroy_state = > drm_atomic_helper_bridge_destroy_state, > }; > > +static const struct drm_encoder_funcs tidss_encoder_funcs = { > + .destroy = drm_encoder_cleanup, > +}; > + > int tidss_encoder_create(struct tidss_device *tidss, > struct drm_bridge *next_bridge, > u32 encoder_type, u32 possible_crtcs) > @@ -95,8 +99,8 @@ int tidss_encoder_create(struct tidss_device *tidss, > if (IS_ERR(t_enc)) > return PTR_ERR(t_enc); > > - ret = drm_simple_encoder_init(&tidss->ddev, &t_enc->encoder, > - encoder_type); > + ret = drm_encoder_init(&tidss->ddev, &t_enc->encoder, > + &tidss_encoder_funcs, encoder_type, NULL); [Severity: High] This is a pre-existing issue, but can this lead to a use-after-free during teardown due to mismatched object lifetimes? In tidss_encoder_create(), the t_enc structure is allocated via devm_drm_bridge_alloc(), which ties the memory's lifetime to the bridge's kref. Then the embedded encoder is initialized here and its destroy callback is set to drm_encoder_cleanup() in tidss_encoder_funcs. If the driver unbinds while a userspace application holds a DRM file descriptor, devm drops the initial bridge references. Later, when the final DRM reference is dropped, drm_mode_config_cleanup() calls the encoder's destroy callback. Inside drm_encoder_cleanup(), it detaches the bridge. This drops the final kref and frees the t_enc container. However, drm_encoder_cleanup() then continues to access the freed encoder memory, causing a use-after-free. Does this sequence cause memory corruption during teardown? > if (ret) > return ret; > -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=7
