Re: [PATCH v3 4/4] drm/panel: find_panel_by_fwnode() return a counted reference

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] TOCTOU race condition in `drm_panel_add_follower` leading to Use-After-Free of `panel->dev`.
--

--- Patch [4]: [PATCH v3 4/4] drm/panel: find_panel_by_fwnode() return a counted reference ---
commit 2c073e53f181794d94244eff0882b1f1a661d995
Author: Albert Esteve <aesteve@redhat.com>

drm/panel: find_panel_by_fwnode() return a counted reference

This patch updates find_panel_by_fwnode() to return a reference-counted
drm_panel pointer, preventing the panel's container memory from being
released prematurely. It also updates drm_panel_remove_follower() to
balance the reference with drm_panel_put().

> diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c
> index 72cf86253c0cd..a00ae98ed0956 100644
> --- a/drivers/gpu/drm/drm_panel.c
> +++ b/drivers/gpu/drm/drm_panel.c
[ ... ]
> @@ -554,6 +560,7 @@ static struct drm_panel *find_panel_by_fwnode(const struct fwnode_handle *fwnode
>  
>  	list_for_each_entry(panel, &panel_list, list) {
>  		if (dev_fwnode(panel->dev) == fwnode) {
> +			drm_panel_get(panel);
>  			mutex_unlock(&panel_lock);

[Severity: High]
This is a pre-existing issue, but does releasing the panel_lock here leave
a TOCTOU race window where panel->dev can be freed before it's used by the
caller?

If the panel's device is unregistered concurrently (e.g., via sysfs unbind
of its parent), the following sequence seems possible:

CPU1 in find_panel_by_fwnode():
    drm_panel_get(panel);
    mutex_unlock(&panel_lock);
    return panel;

CPU2 concurrently unregisters the device:
    drm_panel_remove() runs, removing the panel from panel_list.
    The device's reference count drops to zero and the struct device behind
    panel->dev is freed.

CPU1 in drm_panel_add_follower():
    get_device(panel->dev);

Since panel->dev now points to a freed device, could this cause a
use-after-free?

>  			return panel;
>  		}
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717-drm_refcount_wiring-v3-0-023900c32e01@redhat.com?part=4