Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Use-after-free and list corruption in `amdgpu_dm_crtc_init()` error path. --
commit 0347668ca054c8ea5682a0562b13ea3c763f5fc2 Author: Maxime Ripard <[email protected]> drm/amdgpu: dm: Convert to atomic_create_state This commit converts the AMDGPU DM CRTC implementation to use the atomic_create_state hook rather than a custom reset hook. It initializes the state with __drm_atomic_helper_crtc_state_init() and handles the newly created state during CRTC initialization. [ ... ] > diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c > b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c > index 62eac6e65334b..cfe1fbfbab8ea 100644 > --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c > +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c > @@ -781,9 +780,18 @@ int amdgpu_dm_crtc_init(struct amdgpu_display_manager > *dm, > > drm_crtc_helper_add(&acrtc->base, &amdgpu_dm_crtc_helper_funcs); > > - /* Create (reset) the plane state */ > - if (acrtc->base.funcs->reset) > - acrtc->base.funcs->reset(&acrtc->base); > + /* Create the plane state */ > + if (acrtc->base.funcs->atomic_create_state) { > + struct drm_crtc_state *crtc_state; > + > + crtc_state = > acrtc->base.funcs->atomic_create_state(&acrtc->base); > + if (IS_ERR(crtc_state)) { > + res = PTR_ERR(crtc_state); > + goto fail; [Severity: High] Does this error path leave dangling pointers in the DRM core lists? This patch introduces a new failure point that jumps to the fail block after the CRTC and plane have already been successfully initialized and linked via drm_crtc_init_with_planes() earlier in amdgpu_dm_crtc_init(). Looking at the fail block in amdgpu_dm_crtc_init(): fail: kfree(acrtc); kfree(cursor_plane); return res; Freeing acrtc and cursor_plane directly without unregistering them via drm_crtc_cleanup() and drm_plane_cleanup() leaves freed memory linked in the DRM mode configuration lists. Subsequent traversals of these lists will dereference the freed memory, which can cause a kernel panic. While the plane cleanup omission existed previously, the CRTC list corruption was newly introduced in this patch. > + } > + > + acrtc->base.state = crtc_state; > + } [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=7
