Re: [PATCH 7/7] fbdev: sa1100fb: Remove redundant dev_err()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `.suppress_bind_attrs = true` leads to catastrophic use-after-free on sysfs unbind.
--

--- Patch [7]: [PATCH 7/7] fbdev: sa1100fb: Remove redundant dev_err() ---
commit 811a165c0a2521029ab935181ae6d9d247a19898
Author: Pan Chuang <panchuang@vivo.com>

fbdev: sa1100fb: Remove redundant dev_err()

This commit simplifies the probe function by removing a redundant error
message after devm_request_irq(). The devm variant already logs detailed
error messages internally on failure.

> diff --git a/drivers/video/fbdev/sa1100fb.c b/drivers/video/fbdev/sa1100fb.c
> index 0d362d2bf0e38..fea0172c45b5b 100644
> --- a/drivers/video/fbdev/sa1100fb.c
> +++ b/drivers/video/fbdev/sa1100fb.c
> @@ -1167,10 +1167,8 @@ static int sa1100fb_probe(struct platform_device *pdev)
>  
>  	ret = devm_request_irq(&pdev->dev, irq, sa1100fb_handle_irq, 0,
>  			       "LCD", fbi);
> -	if (ret) {
> -		dev_err(&pdev->dev, "request_irq failed: %d\n", ret);
> +	if (ret)
>  		return ret;
> -	}

[Severity: High]
This isn't a bug introduced by this patch, but since we are modifying
sa1100fb_probe(), should we also address a potential use-after-free during
driver unbind?

Looking at the driver definition, it registers resources that require explicit
unregistration, but does not provide a remove callback and does not suppress
sysfs unbind:

drivers/video/fbdev/sa1100fb.c:sa1100fb_driver {
	.probe		= sa1100fb_probe,
	.suspend	= sa1100fb_suspend,
	.resume		= sa1100fb_resume,
	.driver		= {
		.name	= "sa11x0-fb",
	},
};

If a user unbinds the driver via sysfs, the driver core will call
devres_release_all() and free the devm allocated fbi structure.

However, because register_framebuffer() and cpufreq_register_notifier()
are called during probe without ever being unregistered, the fbdev and cpufreq
subsystems will hold dangling pointers to the freed fbi structure.

Any subsequent access to the framebuffer or CPU frequency transitions
could dereference this freed memory.

Would it make sense to set suppress_bind_attrs = true in the driver struct
to prevent sysfs unbind from succeeding, or alternatively implement a proper
remove callback to unregister these resources?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722075803.570532-1-panchuang@vivo.com?part=7