Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Calling `kfree()` on a devres-managed pointer returned by `drmm_kzalloc()` causes memory corruption and a slab allocator panic. -- --- Patch [20]: [PATCH v2 20/61] drm/kmb: Convert to atomic_create_state --- commit 20dcd87ff6633adea5f70221b0a5e891634f5f0a Author: Maxime Ripard <[email protected]> drm/kmb: Convert to atomic_create_state The plane only initializes a pristine state in its reset hook using drm_atomic_helper_plane_reset(), which is equivalent to what atomic_create_state expects. Convert to it. [ ... ] > diff --git a/drivers/gpu/drm/kmb/kmb_plane.c b/drivers/gpu/drm/kmb/kmb_plane.c > index a0001edb1e21a..1742c2c6dfd89 100644 > --- a/drivers/gpu/drm/kmb/kmb_plane.c > +++ b/drivers/gpu/drm/kmb/kmb_plane.c > @@ -561,7 +561,7 @@ static const struct drm_plane_funcs kmb_plane_funcs = { > .update_plane = drm_atomic_helper_update_plane, > .disable_plane = drm_atomic_helper_disable_plane, > .destroy = kmb_plane_destroy, [Severity: High] This isn't a bug introduced by this patch, but does calling kfree() on a drm-managed pointer in kmb_plane_destroy() cause a slab allocator panic? In kmb_plane_init(), the plane structure is allocated using the DRM managed allocator: kmb_plane_init() { ... plane = drmm_kzalloc(drm, sizeof(*plane), GFP_KERNEL); ... } However, the .destroy hook points to kmb_plane_destroy(), which uses kfree(): kmb_plane_destroy() { ... kfree(kmb_plane); ... } Since drmm_kzalloc() returns an interior pointer embedded within a drmres tracking structure, would passing this pointer directly to kfree() bypass the DRM managed resource system and cause an immediate SLUB allocator panic? Also, if the kernel survived the free, would a double-free occur during device teardown when the DRM devres framework attempts to clean up the same allocation? This path appears reachable on device removal, unbind, or probe failure, for example, if drm_crtc_init_with_planes() fails in kmb_setup_crtc(): kmb_setup_crtc() { ... kmb_plane_destroy(&primary->base_plane); ... } > - .reset = drm_atomic_helper_plane_reset, > + .atomic_create_state = drm_atomic_helper_plane_create_state, > .atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state, > .atomic_destroy_state = drm_atomic_helper_plane_destroy_state, > }; -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=20
