Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Potential Use-After-Free when accessing `endpoint.local_node` after its reference count has been dropped. -- commit fc6c7cf47483df3837bf09097a92c40c4a5aed65 Author: Yudi Yang <[email protected]> drm/rockchip: analogix_dp: bound endpoint name formatting This commit modifies rockchip_dp_drm_encoder_enable() to use snprintf() instead of sprintf() when formatting a device tree path into a stack buffer. This prevents potential buffer overflows from sufficiently long device tree paths. > diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c > b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c > index 587e60232ec7c..efd5a98e80bd2 100644 > --- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c > +++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c > @@ -241,10 +241,11 @@ static void rockchip_dp_drm_encoder_enable(struct > drm_encoder *encoder, > of_graph_get_remote_port(endpoint.local_node); [Severity: High] This isn't a bug introduced by this patch, but does this code use endpoint.local_node after its reference count has been dropped? In rockchip_dp_drm_encoder_enable(), drm_of_encoder_active_endpoint() is called, which internally calls of_graph_parse_endpoint(). This sets endpoint->local_node without acquiring a reference and then explicitly drops its reference by calling of_node_put(ep) before returning. This leaves endpoint.local_node as a dangling pointer, which is then passed to of_graph_get_remote_port() here (and earlier to of_graph_get_remote_port_parent()). Could this result in a Use-After-Free if the device tree node is dynamically freed? > > of_property_read_u32(remote_port, "reg", &port_id); > - sprintf(name, "%s vp%d", remote_port_parent->full_name, > port_id); > + snprintf(name, sizeof(name), "%s vp%d", > + remote_port_parent->full_name, port_id); > } else { > - sprintf(name, "%s %s", > - remote_port_parent->full_name, endpoint.id ? > "vopl" : "vopb"); > + snprintf(name, sizeof(name), "%s %s", > + remote_port_parent->full_name, endpoint.id ? > "vopl" : "vopb"); > } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
