Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider: - [High] High Speed (HS) AXI command payload is silently truncated to 128 bytes. - [High] Use-After-Free of the AXI DMA buffer during device removal due to teardown order inversion. - [High] Large TX payloads combined with an RX or ACK request are forced into register mode and truncated. - [Medium] Memory leak of the DMA coherent buffer on probe error paths. --
--- Patch [1]: [PATCH] drm/rcar-du: dsi: Implement DSI command TX using AXI memory access --- commit b5f3f6a7ebb3a67c9d4682699f04e9f66eb46473 Author: Marek Vasut <[email protected]> drm/rcar-du: dsi: Implement DSI command TX using AXI memory access This commit implements support for DSI command TX using AXI memory access mode. It extends the packet transfer length up to 128 Bytes long in LP and 1024 Bytes long in HS by allocating a DMAble 4k page for large transfers. > diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c > b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c > index 6e46d6d99f3c0..c25218ca4320a 100644 > --- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c > +++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c > @@ -977,6 +981,7 @@ static ssize_t rcar_mipi_dsi_host_tx_transfer(struct > mipi_dsi_host *host, > bool is_rx_xfer) > { > const bool is_tx_long = mipi_dsi_packet_format_is_long(msg->type); > + const bool is_tx_axi = !is_rx_xfer && is_tx_long && (msg->tx_len > 16); [Severity: High] If a caller requests a transfer with a payload larger than 16 bytes and also expects a response or requests an ACK (MIPI_DSI_MSG_REQ_ACK), is_tx_axi evaluates to false. Will this cause the hardware to be misconfigured? The packet header is instructed to transmit the full msg->tx_len, but since it falls back to register mode, the payload is truncated to 16 bytes in the TXCMPPD* registers. Does this lead to sending stale data or hardware timeouts? > struct rcar_mipi_dsi *dsi = host_to_rcar_mipi_dsi(host); > struct mipi_dsi_packet packet; [ ... ] > @@ -1011,7 +1021,10 @@ static ssize_t rcar_mipi_dsi_host_tx_transfer(struct > mipi_dsi_host *host, > TXCMPHDR_DATA1(packet.header[2]) | > TXCMPHDR_DATA0(packet.header[1])); > > - if (is_tx_long) { > + if (is_tx_axi) { > + memcpy(dsi->cmd_axi_cpu, packet.payload, > + min(msg->tx_len, 128)); [Severity: High] Does this silently truncate High Speed (HS) AXI command payloads to 128 bytes? The validation in rcar_mipi_dsi_host_transfer() explicitly allows up to 1024 bytes in HS mode, but this memcpy() caps the copy at 128 bytes regardless of the actual requested transfer size. > + } else if (is_tx_long) { > memcpy(payload, packet.payload, > min(msg->tx_len, sizeof(payload))); [ ... ] > @@ -1276,6 +1295,13 @@ static int rcar_mipi_dsi_probe(struct platform_device > *pdev) > dsi->dev = &pdev->dev; > dsi->info = of_device_get_match_data(&pdev->dev); > > + dsi->cmd_axi_cpu = dma_alloc_coherent(&pdev->dev, SZ_4K, > &dsi->cmd_axi_dma, > + GFP_KERNEL | GFP_DMA32); > + if (!dsi->cmd_axi_cpu) { > + return dev_err_probe(&pdev->dev, -ENOMEM, > + "Failed to allocate DSI AXI Access command > buffer\n"); > + } > + > ret = rcar_mipi_dsi_parse_dt(dsi); > if (ret < 0) > return ret; [Severity: Medium] Does this leak the DMA coherent buffer on probe error paths? If an error occurs during rcar_mipi_dsi_probe() after dma_alloc_coherent() succeeds (such as in rcar_mipi_dsi_parse_dt() or clock setup), the function returns directly without calling dma_free_coherent(). [ ... ] > @@ -1309,6 +1335,8 @@ static void rcar_mipi_dsi_remove(struct platform_device > *pdev) > { > struct rcar_mipi_dsi *dsi = platform_get_drvdata(pdev); > > + dma_free_coherent(&pdev->dev, SZ_4K, dsi->cmd_axi_cpu, > dsi->cmd_axi_dma); > + > mipi_dsi_host_unregister(&dsi->host); > } [Severity: High] Could this create a use-after-free of the AXI DMA buffer during device removal? The DMA buffer is freed before mipi_dsi_host_unregister() is called. Unregistering the host detaches child DSI panels, triggering their remove callbacks. If a panel driver sends DSI commands (like entering sleep mode) during unbind, it will attempt to memcpy() into the already-freed dsi->cmd_axi_cpu buffer. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
