Re: [PATCH v6 09/13] drm/bridge: it6505: hold endpoint OF node reference while parsing it

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Uninitialized stack variable `link_frequencies` is used if `of_property_read_variable_u64_array()` reads 0 elements.
--

--- Patch [9]: [PATCH v6 09/13] drm/bridge: it6505: hold endpoint OF node reference while parsing it ---
commit 635833fd1fe628586cc12b54a91fac7c8f243c4c
Author: Daniel Golle <daniel@makrotopia.org>

drm/bridge: it6505: hold endpoint OF node reference while parsing it

This commit delays dropping the reference to endpoint nodes in it6505_parse_dt()
until after their properties have been parsed. This prevents a race condition
where the node could be freed while its properties are still being read when
CONFIG_OF_DYNAMIC is enabled.

> diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
> --- a/drivers/gpu/drm/bridge/ite-it6505.c
> +++ b/drivers/gpu/drm/bridge/ite-it6505.c
[ ... ]
> @@ -3379,13 +3378,13 @@ static void it6505_parse_dt(struct it6505 *it6505)
[ ... ]
>  	ep = of_graph_get_endpoint_by_regs(np, 0, 0);
> -	of_node_put(ep);
>  
>  	if (ep) {
>  		len = of_property_read_variable_u64_array(ep,

[Severity: High]
This is a pre-existing issue, but can this lead to using uninitialized stack
memory?

If the link-frequencies property exists in the device tree but is empty,
of_property_read_variable_u64_array() (called with sz_min set to 0) will
return 0 and leave the link_frequencies stack variable unmodified.

Since the subsequent check if (len >= 0) evaluates to true, won't the code
proceed to pass the uninitialized link_frequencies variable to do_div()
and use it to calculate the maximum DPI pixel clock?

> @@ -3405,6 +3404,7 @@ static void it6505_parse_dt(struct it6505 *it6505)
>  			dev_err(dev, "error link frequencies, use default");
>  			*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
>  		}
> +		of_node_put(ep);
>  	} else {
>  		dev_err(dev, "error endpoint, use default");
>  		*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1784947240.git.daniel@makrotopia.org?part=9