Re: [PATCH 13/15] drm/meson: remove dependency on DRM simple helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Devm lifecycle mismatch with DRM device leads to a Use-After-Free of the encoder structure if userspace holds the DRM file descriptor open after the device unbinds.
--

--- Patch [13]: [PATCH 13/15] drm/meson: remove dependency on DRM simple helpers ---
commit 2b596eefd506c3e256e80a53bf84b95edfa9824a
Author: Diogo Silva <diogompaissilva@gmail.com>

drm/meson: remove dependency on DRM simple helpers

The simple KMS helpers are deprecated because they only add an intermediate
layer between drivers and atomic modesetting. Open-code
drm_simple_encoder_init() by calling drm_encoder_init() directly and
providing driver-local drm_encoder_funcs.

> diff --git a/drivers/gpu/drm/meson/meson_encoder_cvbs.c b/drivers/gpu/drm/meson/meson_encoder_cvbs.c
> index 22cacb1660c4f..cdb84d2283f83 100644
> --- a/drivers/gpu/drm/meson/meson_encoder_cvbs.c
> +++ b/drivers/gpu/drm/meson/meson_encoder_cvbs.c
[ ... ]
> @@ -257,8 +261,9 @@ int meson_encoder_cvbs_probe(struct meson_drm *priv)
>  	meson_encoder_cvbs->priv = priv;
>  
>  	/* Encoder */
> -	ret = drm_simple_encoder_init(priv->drm, &meson_encoder_cvbs->encoder,
> -				      DRM_MODE_ENCODER_TVDAC);
> +	ret = drm_encoder_init(priv->drm, &meson_encoder_cvbs->encoder,
> +			       &meson_encoder_cvbs_funcs,
> +			       DRM_MODE_ENCODER_TVDAC, NULL);

[Severity: High]
This is a pre-existing issue, but does this create a use-after-free risk
during device unbind?

In meson_encoder_cvbs_probe(), the encoder is embedded within
meson_encoder_cvbs, which is allocated via devm_drm_bridge_alloc() and tied
to the device lifetime. However, by using drm_encoder_init(), the encoder
is registered with the DRM device's lifecycle.

If a driver unbind occurs (e.g., via sysfs) while userspace holds an open
DRM file descriptor, devres will execute and free the bridge memory along
with the embedded encoder. Later, when the file descriptor is closed,
drm_mode_config_cleanup() iterates over the encoder_list and attempts to
call the encoder's destroy function on the already freed memory.

Could we use drmm_encoder_init() instead to safely tie the encoder's
lifetime to the DRM device?

This same devm vs DRM lifecycle mismatch is also present in
meson_encoder_dsi_probe() in drivers/gpu/drm/meson/meson_encoder_dsi.c and
meson_encoder_hdmi_probe() in drivers/gpu/drm/meson/meson_encoder_hdmi.c.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260719-drm_simple_encoder_init-v1-0-a78c509e3062@gmail.com?part=13