At 2026-08-26 15:09:53, [email protected] wrote: >Thank you for your contribution! Sashiko AI review found 1 potential issue(s) >to consider: > >Pre-existing issues: >- [High] Mixing devm_kzalloc for DRM objects (like planes and CRTCs) with >drmm_mode_config_init causes a guaranteed Use-After-Free during driver unbind >or probe failure. >-- > >commit 6e5820173d0237a07dd104b640171197be436f49 >Author: Qingshuang Fu <[email protected]> > >drm/logicvc: fix device_node refcount leak in logicvc_layers_init() > >This commit fixes a device node reference leak in logicvc_layers_init(). It >adds a missing of_node_put() on the error path to ensure the reference >acquired by for_each_child_of_node() is properly released when >logicvc_layer_init() fails. > >> diff --git a/drivers/gpu/drm/logicvc/logicvc_layer.c >> b/drivers/gpu/drm/logicvc/logicvc_layer.c >> index 7f5ba000188ab..e83a2aafed779 100644 >> --- a/drivers/gpu/drm/logicvc/logicvc_layer.c >> +++ b/drivers/gpu/drm/logicvc/logicvc_layer.c >> @@ -613,6 +613,7 @@ int logicvc_layers_init(struct logicvc_drm *logicvc) >> >> ret = logicvc_layer_init(logicvc, layer_node, index); >> if (ret) { >> + of_node_put(layer_node); >> of_node_put(layers_node); >> goto error; > >[Severity: High] >This isn't a bug introduced by this patch, but could this error path lead to a >use-after-free during mode config cleanup? > >When logicvc_layer_init() fails and the code jumps to the error label, >logicvc_layers_init() cleans up previously initialized layers by calling >logicvc_layer_fini(). This function calls devm_kfree(dev, layer) without >first calling drm_plane_cleanup(), leaving dangling pointers in the drm_dev >plane_list. > >Additionally, because logicvc_drm_probe() sets up mode config via >drmm_mode_config_init(), the mode config cleanup is registered as a DRM managed >action. The layer and CRTC structures are allocated with devres (devm_kzalloc() >in logicvc_layer_init() and logicvc_crtc_init()). > >During a probe failure or driver unbind, devres runs in LIFO order and frees >the layers and CRTC before releasing the drm_dev. When the drm_dev is finally >released, drmm_mode_config_cleanup() iterates over mode_config.plane_list and >crtc_list to call their destroy hooks, dereferencing the already freed memory. > >> } >> > >-- >Sashiko AI review · >https://sashiko.dev/#/patchset/[email protected]?part=1
Thanks Sashiko AI for the careful review and raising this important pre‑existing use‑after‑free concern. This change only adds a missing of_node_put(layer_node) to fix a device‑tree reference leak on the error‑path inside logicvc_layers_init(). No plane, CRTC, devres or drmm_mode_config_init‑related allocation or cleanup logic has been altered by this commit. The devres vs drmm cleanup‑order UAF defect is an independent pre‑existing bug, completely unrelated to the refcount leak being fixed here. As such, it falls outside the scope of this patch. Qingshuang Fu
