Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] This problem wasn't introduced by this patch, but calling kfree() on an interior pointer allocated by drmm_kzalloc() causes heap corruption and a double free during DRM device teardown. -- commit 8cb00e04f7c7c0f7305c33451c9eebfc86df5dd2 Author: Maxime Ripard <[email protected]> drm/kmb: Convert to atomic_create_state The plane only initializes a pristine state in its reset hook using drm_atomic_helper_plane_reset(), which is equivalent to what atomic_create_state expects. Convert to it. [ ... ] > diff --git a/drivers/gpu/drm/kmb/kmb_plane.c b/drivers/gpu/drm/kmb/kmb_plane.c > index a0001edb1e21a..1742c2c6dfd89 100644 > --- a/drivers/gpu/drm/kmb/kmb_plane.c > +++ b/drivers/gpu/drm/kmb/kmb_plane.c > @@ -561,7 +561,7 @@ static const struct drm_plane_funcs kmb_plane_funcs = { > .update_plane = drm_atomic_helper_update_plane, > .disable_plane = drm_atomic_helper_disable_plane, > .destroy = kmb_plane_destroy, [Severity: High] This isn't a bug introduced by this patch, but calling kfree() on an interior pointer allocated by drmm_kzalloc() causes heap corruption and a double free during DRM device teardown. Looking at kmb_plane_init(), the plane is allocated using the DRM-managed allocator: drivers/gpu/drm/kmb/kmb_plane.c:kmb_plane_init() { ... plane = drmm_kzalloc(drm, sizeof(*plane), GFP_KERNEL); ... } However, in kmb_plane_destroy(), an unmanaged kfree() is erroneously called: drivers/gpu/drm/kmb/kmb_plane.c:kmb_plane_destroy() { ... kfree(kmb_plane); ... } Since this is reachable during normal device teardown or initialization failure, will this trigger a kernel panic due to an invalid free followed by a double free when the DRM managed resource is cleaned up by drm_dev_put()? > - .reset = drm_atomic_helper_plane_reset, > + .atomic_create_state = drm_atomic_helper_plane_create_state, > .atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state, > .atomic_destroy_state = drm_atomic_helper_plane_destroy_state, > }; -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=8
