Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Mixing manual framebuffer_release() with devm_lcd_device_register() creates a Use-After-Free vulnerability on module remove and probe error paths. -- --- Patch [1]: [PATCH] fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call --- commit e41c02db93213803fd7424c13289c71da7816b02 Author: Karl Mehltretter <[email protected]> fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call This commit removes an unreachable unregister_framebuffer() call in clps711x_fb_probe(). The code previously jumped to an unwind label on failure or returned immediately on success. > diff --git a/drivers/video/fbdev/clps711x-fb.c > b/drivers/video/fbdev/clps711x-fb.c > index 7a7db7100499e..6789773b22fbe 100644 > --- a/drivers/video/fbdev/clps711x-fb.c > +++ b/drivers/video/fbdev/clps711x-fb.c > @@ -329,8 +329,6 @@ static int clps711x_fb_probe(struct platform_device *pdev) > > return 0; > > - unregister_framebuffer(info); > - > out_fb_dealloc_cmap: > regmap_update_bits(cfb->syscon, SYSCON_OFFSET, SYSCON1_LCDEN, 0); > fb_dealloc_cmap(&info->cmap); [Severity: High] This is a pre-existing issue, but does mixing manual framebuffer_release() with devm_lcd_device_register() create a use-after-free vulnerability on probe error paths and module removal? Because the LCD device is registered using devm_lcd_device_register(), its unregistration is deferred to the devres cleanup phase. This cleanup executes after clps711x_fb_probe() returns an error, or after clps711x_fb_remove() finishes. However, the driver manually frees the info structure and its private data cfb via framebuffer_release() just below this unwind label: drivers/video/fbdev/clps711x-fb.c:clps711x_fb_probe() { ... out_fb_release: framebuffer_release(info); return ret; } During the window between framebuffer_release() and devres cleanup, the LCD device remains fully visible in sysfs. Could a concurrent sysfs read of lcd_power trigger a use-after-free by accessing the already freed cfb pointer in clps711x_lcd_get_power()? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
