Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Critical] drm/logicvc: UAF of drm_plane during probe failure or unbind --
commit 81e314862f436f8aee3b4c3a043bbab040bd125b Author: Myeonghun Pak <[email protected]> drm/logicvc: keep the IRQ within the display resource lifetime The interrupt handler accesses the CRTC and the register map. Its device-managed release currently happens after remove has unprepared the clocks, and the CRTC is allocated after the interrupt is requested. Consequently a running handler can outlive the resources it uses, both on removal and when probe unwinds. Request the interrupt after initializing the display objects, and release it explicitly before tearing down the mode state and clocks. Keep it available through drm_atomic_helper_shutdown(), which may need vblank completion. Also release it on drm_dev_register() failure before unwinding the display resources. > diff --git a/drivers/gpu/drm/logicvc/logicvc_drm.c > b/drivers/gpu/drm/logicvc/logicvc_drm.c > index bbebf4fc7f51a..cf60bbb9800c5 100644 > --- a/drivers/gpu/drm/logicvc/logicvc_drm.c > +++ b/drivers/gpu/drm/logicvc/logicvc_drm.c [ ... ] > @@ -434,16 +428,26 @@ static int logicvc_drm_probe(struct platform_device > *pdev) > goto error_clocks; > } > > + ret = devm_request_irq(dev, irq, logicvc_drm_irq_handler, 0, > + dev_name(dev), logicvc); > + if (ret) { > + drm_err(drm_dev, "Failed to request IRQ\n"); > + goto error_mode; > + } > + [Severity: Critical] Does this error path (and other probe failures or device unbinds) trigger a use-after-free of the drm_plane structures? During probe failure unwinding or device unbind, devres will automatically free the layer memory (which contains the drm_plane) because it was allocated with devm_kzalloc(). However, neither devres nor logicvc_layer_fini() calls drm_plane_cleanup() before the memory is freed: drivers/gpu/drm/logicvc/logicvc_layer.c:logicvc_layer_fini() { struct device *dev = logicvc->drm_dev.dev; list_del(&layer->list); devm_kfree(dev, layer); } Because the plane is still linked in the DRM core plane list, the later call to drm_mode_config_cleanup() traverses the list and dereferences the already freed memory: drivers/gpu/drm/drm_mode_config.c:drm_mode_config_cleanup() { ... list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list, head) { plane->funcs->destroy(plane); } ... } Should logicvc_layer_fini() call drm_plane_cleanup() before explicitly freeing the layer structure? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/179203400409.2736079.4502160101423826217.g31.logicvc-...@gmail.com?part=1
