Re: [PATCH v4 2/3] drivers: gpu: drm: panel: Add BOE NT51021 driver

[Nickolay Goppen <setotau@mainlining.org>]

17.09.2026 16:01, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] drm: panel: novatek-nt51021: UAF and crash due to premature devm_drm_panel_add()
> --
>
> commit 32c00aa725aa38b42eafcacc07a8f05495f7ed3d
> Author: Nickolay Goppen <setotau@mainlining.org>
>
>      drivers: gpu: drm: panel: Add BOE NT51021 driver
>      
>      Add driver for BOE NT51021-based 8-inch and 10-inch DSI video mode
>      panels used in Xiaomi Mi Pad 4, Mi Pad 4 Plus (xiaomi-clover)
>      and Amazon Fire HD 10 (2017) (amazon-suez) tablets.
>
>> diff --git a/drivers/gpu/drm/panel/panel-novatek-nt51021.c b/drivers/gpu/drm/panel/panel-novatek-nt51021.c
>> new file mode 100644
>> index 0000000000000..94e7d6aaf0cb9
>> --- /dev/null
>> +++ b/drivers/gpu/drm/panel/panel-novatek-nt51021.c
> [ ... ]
>
>> +static int nt51021_novatek_probe(struct mipi_dsi_device *dsi)
>> +{
>> +	struct device *dev = &dsi->dev;
> [ ... ]
>
>> +	ctx->panel.prepare_prev_first = true;
>> +
>> +	ret = drm_panel_of_backlight(&ctx->panel);
>> +	if (ret)
>> +		return dev_err_probe(dev, ret, "Failed to get backlight\n");
>> +
>> +	ret = devm_drm_panel_add(dev, &ctx->panel);
>> +	if (ret)
>> +		return ret;
>> +
>> +	return devm_mipi_dsi_attach(dev, dsi);
> [Severity: High]
> Can this sequence lead to a use-after-free or kernel crash?
>
> By calling devm_drm_panel_add() before devm_mipi_dsi_attach(), the panel is
> published globally before DSI attachment completes.
>
> If a DRM consumer discovers the panel via of_drm_find_panel() during this
> window, it takes a reference on the panel. If devm_mipi_dsi_attach() then
> fails, the probe function returns an error and devres cleans up the allocated
> GPIO and regulator resources. However, the panel memory remains allocated
> because of the consumer's reference.
>
> When the consumer later calls drm_panel_prepare(), the panel driver will
> dereference the freed GPIO and regulator pointers, causing a use-after-free.
>
> Additionally, if a consumer calls drm_panel_prepare() before mipi_dsi_attach()
> completes, it will trigger DSI commands on an unattached device, crashing the
> DSI host.
>
> Should devm_mipi_dsi_attach() be called before devm_drm_panel_add() to prevent
> this race window?
Other drivers do the same sequence of add and attach functions as I did.
>> +}

-- 
Best regards,
Nickolay