Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Missing `drm_panel_remove()` in the error path of `ili9881c_dsi_probe()` when `devm_mipi_dsi_attach()` fails, leaving a dangling pointer in the global panel list and causing a Use-After-Free. -- --- Patch [4]: [PATCH v3 4/6] drm/panel: Use devm_mipi_dsi_attach in Himax and Ilitek panels --- commit 3a10b5f724df17d382396b95194d7b29446eceae Author: Osama Abdelkader <[email protected]> drm/panel: Use devm_mipi_dsi_attach in Himax and Ilitek panels Use the managed MIPI DSI attach helper in Himax and Ilitek panel drivers and drop the corresponding manual detach calls from remove paths. > diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c > b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c > index 3abdd0870e831..ca7037a4242c7 100644 > --- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c > +++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c > @@ -2597,14 +2597,12 @@ static int ili9881c_dsi_probe(struct mipi_dsi_device > *dsi) > dsi->format = MIPI_DSI_FMT_RGB888; > dsi->lanes = ctx->desc->lanes; > > - return mipi_dsi_attach(dsi); > + return devm_mipi_dsi_attach(&dsi->dev, dsi); > } [Severity: High] This is a pre-existing issue, but if devm_mipi_dsi_attach() fails here, does it leave a dangling pointer in the global panel list? Since ili9881c_dsi_probe() directly returns the result of the attach attempt without calling drm_panel_remove() on failure, and the panel context was allocated with devm_drm_panel_alloc(), the devres cleanup will free the memory while it remains linked in panel_list. Could this cause a use-after-free when the list is next traversed? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
