Re: [PATCH v3 1/2] drm/panel: Enable DSC for Visionox VTDR6130 panel

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Dangling pointer `dsi->dsc` causes a Use-After-Free if the panel is unbound or fails to probe.
- [Low] Typo in Kconfig keyword (`selecy` instead of `select`) causes Kconfig syntax errors and unmet dependencies.
--

commit e86a9d725d9bec9f842cd9809e7110af265ae958
Author: Jun Nie <jun.nie@linaro.org>
Subject: drm/panel: Enable DSC for Visionox VTDR6130 panel

This commit enables display compression (DSC v1.2) for the 1080x2400 Visionox
VTDR6130 AMOLED DSI panel. It configures the DSC parameters during probe and
sends the PPS payload when turning on the display.

> diff --git a/drivers/gpu/drm/panel/Kconfig b/drivers/gpu/drm/panel/Kconfig
> index c0cc2bb4a3eb7..d4e6535f35957 100644
> --- a/drivers/gpu/drm/panel/Kconfig
> +++ b/drivers/gpu/drm/panel/Kconfig
> @@ -1352,6 +1352,8 @@ config DRM_PANEL_VISIONOX_VTDR6130
>  	depends on OF
>  	depends on DRM_MIPI_DSI
>  	depends on BACKLIGHT_CLASS_DEVICE
> +	select DRM_DISPLAY_DSC_HELPER
> +	selecy DRM_DISPLAY_HELPER

[Severity: Low]
This isn't a bug, but is there a typo here with "selecy" instead of "select"?
This will cause a Kconfig syntax error and leave dependencies unmet.

[ ... ]

> diff --git a/drivers/gpu/drm/panel/panel-visionox-vtdr6130.c b/drivers/gpu/drm/panel/panel-visionox-vtdr6130.c
> index 97a79411e1ecd..0cdcdbbc766da 100644
> --- a/drivers/gpu/drm/panel/panel-visionox-vtdr6130.c
> +++ b/drivers/gpu/drm/panel/panel-visionox-vtdr6130.c

[ ... ]

> @@ -269,6 +277,16 @@ static int visionox_vtdr6130_probe(struct mipi_dsi_device *dsi)
>  	ctx->dsi = dsi;
>  	mipi_dsi_set_drvdata(dsi, ctx);
>  
> +	ctx->dsc.dsc_version_major = 0x1;
> +	ctx->dsc.dsc_version_minor = 0x2;
> +	ctx->dsc.slice_height = 40;
> +	ctx->dsc.slice_width = 540;
> +	ctx->dsc.slice_count = 2;
> +	ctx->dsc.bits_per_component = 8;
> +	ctx->dsc.bits_per_pixel = 8 << 4;
> +	ctx->dsc.block_pred_enable = true;
> +
> +	dsi->dsc = &ctx->dsc;

[Severity: High]
Does this code leave a dangling pointer if the probe function fails later or 
if the driver is unbound?

In visionox_vtdr6130_probe(), dsi->dsc is assigned to &ctx->dsc, where ctx
is allocated using devm_drm_panel_alloc(). If devm_drm_panel_add() or
devm_mipi_dsi_attach() fail later in the probe function, or if the panel
driver is unbound via sysfs, devres will automatically free ctx.

However, since the mipi_dsi_device outlives the panel driver binding, dsi->dsc
is never cleared and becomes a dangling pointer. If the DSI subsystem or host
driver attempts to use it, it could result in a use-after-free.

Should dsi->dsc be explicitly cleared in the probe error paths and in a
driver remove callback?

>  	dsi->lanes = 4;
>  	dsi->format = MIPI_DSI_FMT_RGB888;
>  	dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_NO_EOT_PACKET |

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702-topic-sm8x50-vtdr6130-dsc-v3-0-db881a3fc026@linaro.org?part=1