From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA2A3390C8C for ; Wed, 3 Jun 2026 07:11:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780470668; cv=none; b=H/zGdAK62lDmbz+XiHvj8LmO6vCjB/3oEphiBFWgtk3V8NX10mA2UtKX9oHDt6Ul8RrCvyV8E4CxNlbRsMApJ7TcayLUNg6fKykm8HQDBHf6ugB9Y/AMjAkmu5X72ReA2nfsyWIZdk4kIWtScVpHjYfdPbF2NqScJJfQxATF/0o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780470668; c=relaxed/simple; bh=TM+UMee5C+cLrttuBAyk62bsMANY6jDmr83c8aYqsYc=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=VKsGyZWMnsNnWgumuEwgWWkKoWU2qiOk+LDcNUCW6DZygWAMGonkooL51vgfyeOHIyIoTpz9Tdc7RIxcS300ZbM75EOO1yvV/aE63h8Uz8gDU8nKbpM7H5fVhFqRtyrfM8xtQPUSkqWbxquQm82g7nbT9rKpoor+uOSUpvcjz48= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FFI5cV9P; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FFI5cV9P" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4D32E1F00893; Wed, 3 Jun 2026 07:11:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780470667; bh=50EegfUa1SqBpGOEFWH5G34wKdm3LDBxaTU84uCiy4I=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=FFI5cV9PJOI8IsaztEPtF5Ks8VLRvR2XReGxOgJ6kHQ8o1fexKrxw6WnHXKtX3BfV sN+W8IZHyXaP6NdGPkD8bwuVU1KFbxVGr8OzTiAt0WeH6ZMZL1I7eiZdQ22Bhhrj0/ KrUJgqE14E0+GxuEQEkYqYEdbsazOc7zCHQ6k77pVwSFyzPmeRPdz3vDLIJq0ltc2e Ys91FXb9szWgemk+nCWNvm0sSNfM9zPYbU5zVcp0XSpDk+Tx0iWmLS1tJJCswPEkqa /o01rX9REkjqCq59d1NDccspQC0gex4lC7WUAgL7mtSrRG3sdosxm1NQrH4eKmFRtC uWwNiIxVhLlJg== From: sashiko-bot@kernel.org Subject: Re: [PATCH v6 06/12] media: microchip-isc: set SAM9X7 maximum resolution to 2560x1920 Reply-To: sashiko-reviews@lists.linux.dev To: "Balakrishnan Sambath" Cc: linux-media@vger.kernel.org In-Reply-To: <20260603-microchip-isc-fixes-v6-6-8c3d7474a768@microchip.com> References: <20260603-microchip-isc-fixes-v6-6-8c3d7474a768@microchip.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Wed, 03 Jun 2026 07:11:06 +0000 Message-Id: <20260603071107.4D32E1F00893@smtp.kernel.org> Precedence: bulk X-Mailing-List: linux-media@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 2 potential issue(= s) to consider: New issues: - [Medium] The driver checks the machine root compatible string to infer de= vice-specific hardware parameters instead of using a device match table. Pre-existing issues: - [High] The driver saves OF endpoint nodes into a persistent list without = acquiring a reference, leading to a use-after-free and double-free during p= robe. -- commit c91e2880e308dc3e7795189aa50b13e996251309 Author: Balakrishnan Sambath media: microchip-isc: set SAM9X7 maximum resolution to 2560x1920 This patch updates the microchip-sama7g5-isc driver to support the SAM9X7 SoC. It reduces the maximum horizontal and vertical resolutions due to smaller internal line buffer constraints on the SAM9X7 compared to the SAMA7G5. > diff --git a/drivers/media/platform/microchip/microchip-sama7g5-isc.c b/d= rivers/media/platform/microchip/microchip-sama7g5-isc.c > index ca23e8adecbdc..4119cfe12cdf2 100644 > --- a/drivers/media/platform/microchip/microchip-sama7g5-isc.c > +++ b/drivers/media/platform/microchip/microchip-sama7g5-isc.c > @@ -432,8 +435,13 @@ static int microchip_xisc_probe(struct platform_devi= ce *pdev) > isc->gamma_table =3D isc_sama7g5_gamma_table; > isc->gamma_max =3D 0; > =20 > - isc->max_width =3D ISC_SAMA7G5_MAX_SUPPORT_WIDTH; > - isc->max_height =3D ISC_SAMA7G5_MAX_SUPPORT_HEIGHT; > + if (of_machine_is_compatible("microchip,sam9x7")) { [Severity: Medium] Is checking the machine root compatible string the best approach here? Typically, a device driver relies on its own device node's compatible string to infer device-specific hardware parameters, rather than the root machine's compatible string. Could this be implemented by introducing a new compatible string for the SAM9X7 XISC (e.g., microchip,sam9x7-isc) to the driver's of_match_table, and associating the specific resolution limits using of_device_get_match_data()? > + isc->max_width =3D ISC_SAM9X7_MAX_SUPPORT_WIDTH; > + isc->max_height =3D ISC_SAM9X7_MAX_SUPPORT_HEIGHT; > + } else { > + isc->max_width =3D ISC_SAMA7G5_MAX_SUPPORT_WIDTH; > + isc->max_height =3D ISC_SAMA7G5_MAX_SUPPORT_HEIGHT; > + } > =20 > isc->config_dpc =3D isc_sama7g5_config_dpc; [Severity: High] This isn't a bug introduced by this patch, but while reviewing the probe sequence, I noticed a potential reference counting issue with the endpoint nodes. In xisc_parse_dt(), the endpoint node is assigned without taking a reference: xisc_parse_dt() { ... for_each_endpoint_of_node(np, epn) { ... subdev_entity->epn =3D epn; ... } Since for_each_endpoint_of_node() drops the reference on the current epn when it advances, subdev_entity->epn might point to a node whose reference count has already been decremented. Later in microchip_xisc_probe(), this endpoint is accessed and explicitly freed: microchip_xisc_probe() { ... list_for_each_entry(subdev_entity, &isc->subdev_entities, list) { struct fwnode_handle *fwnode =3D of_fwnode_handle(subdev_entity->epn); ... of_node_put(subdev_entity->epn); ... } Could this lead to a use-after-free when registering the async remote, and a double-free when of_node_put() is called? Should the assignment in xisc_parse_dt() use of_node_get(epn)? A similar omission also appears to be present in the SAMA5D2 driver variant in isc_parse_dt(). --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260603-microchip-= isc-fixes-v6-0-8c3d7474a768@microchip.com?part=3D6