Re: [PATCH] drm/rcar-du: dsi: Implement DSI command TX using AXI memory access

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [High] High Speed (HS) AXI command payload is silently truncated to 128 bytes.
- [High] Use-After-Free of the AXI DMA buffer during device removal due to teardown order inversion.
- [High] Large TX payloads combined with an RX or ACK request are forced into register mode and truncated.
- [Medium] Memory leak of the DMA coherent buffer on probe error paths.
--

--- Patch [1]: [PATCH] drm/rcar-du: dsi: Implement DSI command TX using AXI memory access ---
commit b5f3f6a7ebb3a67c9d4682699f04e9f66eb46473
Author: Marek Vasut <marek.vasut+renesas@mailbox.org>

drm/rcar-du: dsi: Implement DSI command TX using AXI memory access
    
This commit implements support for DSI command TX using AXI memory access
mode. It extends the packet transfer length up to 128 Bytes long in LP and
1024 Bytes long in HS by allocating a DMAble 4k page for large transfers.

> diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c
> index 6e46d6d99f3c0..c25218ca4320a 100644
> --- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c
> +++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c
> @@ -977,6 +981,7 @@ static ssize_t rcar_mipi_dsi_host_tx_transfer(struct mipi_dsi_host *host,
>  					      bool is_rx_xfer)
>  {
>  	const bool is_tx_long = mipi_dsi_packet_format_is_long(msg->type);
> +	const bool is_tx_axi = !is_rx_xfer && is_tx_long && (msg->tx_len > 16);

[Severity: High]
If a caller requests a transfer with a payload larger than 16 bytes and also
expects a response or requests an ACK (MIPI_DSI_MSG_REQ_ACK), is_tx_axi
evaluates to false. Will this cause the hardware to be misconfigured?

The packet header is instructed to transmit the full msg->tx_len, but since
it falls back to register mode, the payload is truncated to 16 bytes in the
TXCMPPD* registers. Does this lead to sending stale data or hardware
timeouts?

>  	struct rcar_mipi_dsi *dsi = host_to_rcar_mipi_dsi(host);
>  	struct mipi_dsi_packet packet;

[ ... ]

> @@ -1011,7 +1021,10 @@ static ssize_t rcar_mipi_dsi_host_tx_transfer(struct mipi_dsi_host *host,
>  			    TXCMPHDR_DATA1(packet.header[2]) |
>  			    TXCMPHDR_DATA0(packet.header[1]));
>  
> -	if (is_tx_long) {
> +	if (is_tx_axi) {
> +		memcpy(dsi->cmd_axi_cpu, packet.payload,
> +		       min(msg->tx_len, 128));

[Severity: High]
Does this silently truncate High Speed (HS) AXI command payloads to 128
bytes? 

The validation in rcar_mipi_dsi_host_transfer() explicitly allows up to 1024
bytes in HS mode, but this memcpy() caps the copy at 128 bytes regardless of
the actual requested transfer size.

> +	} else if (is_tx_long) {
>  		memcpy(payload, packet.payload,
>  		       min(msg->tx_len, sizeof(payload)));

[ ... ]

> @@ -1276,6 +1295,13 @@ static int rcar_mipi_dsi_probe(struct platform_device *pdev)
>  	dsi->dev = &pdev->dev;
>  	dsi->info = of_device_get_match_data(&pdev->dev);
>  
> +	dsi->cmd_axi_cpu = dma_alloc_coherent(&pdev->dev, SZ_4K, &dsi->cmd_axi_dma,
> +					      GFP_KERNEL | GFP_DMA32);
> +	if (!dsi->cmd_axi_cpu) {
> +		return dev_err_probe(&pdev->dev, -ENOMEM,
> +				     "Failed to allocate DSI AXI Access command buffer\n");
> +	}
> +
>  	ret = rcar_mipi_dsi_parse_dt(dsi);
>  	if (ret < 0)
>  		return ret;

[Severity: Medium]
Does this leak the DMA coherent buffer on probe error paths? 
    
If an error occurs during rcar_mipi_dsi_probe() after dma_alloc_coherent()
succeeds (such as in rcar_mipi_dsi_parse_dt() or clock setup), the function
returns directly without calling dma_free_coherent().

[ ... ]

> @@ -1309,6 +1335,8 @@ static void rcar_mipi_dsi_remove(struct platform_device *pdev)
>  {
>  	struct rcar_mipi_dsi *dsi = platform_get_drvdata(pdev);
>  
> +	dma_free_coherent(&pdev->dev, SZ_4K, dsi->cmd_axi_cpu, dsi->cmd_axi_dma);
> +
>  	mipi_dsi_host_unregister(&dsi->host);
>  }

[Severity: High]
Could this create a use-after-free of the AXI DMA buffer during device
removal? 

The DMA buffer is freed before mipi_dsi_host_unregister() is called.
Unregistering the host detaches child DSI panels, triggering their remove
callbacks. If a panel driver sends DSI commands (like entering sleep mode)
during unbind, it will attempt to memcpy() into the already-freed
dsi->cmd_axi_cpu buffer.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260809195831.842907-1-marek.vasut+renesas@mailbox.org?part=1