Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] drm: panel: novatek-nt51021: UAF and crash due to premature devm_drm_panel_add() --
commit 32c00aa725aa38b42eafcacc07a8f05495f7ed3d Author: Nickolay Goppen <[email protected]> drivers: gpu: drm: panel: Add BOE NT51021 driver Add driver for BOE NT51021-based 8-inch and 10-inch DSI video mode panels used in Xiaomi Mi Pad 4, Mi Pad 4 Plus (xiaomi-clover) and Amazon Fire HD 10 (2017) (amazon-suez) tablets. > diff --git a/drivers/gpu/drm/panel/panel-novatek-nt51021.c > b/drivers/gpu/drm/panel/panel-novatek-nt51021.c > new file mode 100644 > index 0000000000000..94e7d6aaf0cb9 > --- /dev/null > +++ b/drivers/gpu/drm/panel/panel-novatek-nt51021.c [ ... ] > +static int nt51021_novatek_probe(struct mipi_dsi_device *dsi) > +{ > + struct device *dev = &dsi->dev; [ ... ] > + ctx->panel.prepare_prev_first = true; > + > + ret = drm_panel_of_backlight(&ctx->panel); > + if (ret) > + return dev_err_probe(dev, ret, "Failed to get backlight\n"); > + > + ret = devm_drm_panel_add(dev, &ctx->panel); > + if (ret) > + return ret; > + > + return devm_mipi_dsi_attach(dev, dsi); [Severity: High] Can this sequence lead to a use-after-free or kernel crash? By calling devm_drm_panel_add() before devm_mipi_dsi_attach(), the panel is published globally before DSI attachment completes. If a DRM consumer discovers the panel via of_drm_find_panel() during this window, it takes a reference on the panel. If devm_mipi_dsi_attach() then fails, the probe function returns an error and devres cleans up the allocated GPIO and regulator resources. However, the panel memory remains allocated because of the consumer's reference. When the consumer later calls drm_panel_prepare(), the panel driver will dereference the freed GPIO and regulator pointers, causing a use-after-free. Additionally, if a consumer calls drm_panel_prepare() before mipi_dsi_attach() completes, it will trigger DSI commands on an unattached device, crashing the DSI host. Should devm_mipi_dsi_attach() be called before devm_drm_panel_add() to prevent this race window? > +} -- Sashiko AI review ยท https://sashiko.dev/#/patchset/20260917-qcom-novatek-nt51021-panels-v4-0-30afbc35d...@mainlining.org?part=2
