Re: [PATCH v3 4/6] drm/panel: Use devm_mipi_dsi_attach in Himax and Ilitek panels

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `drm_panel_remove()` in the error path of `ili9881c_dsi_probe()` when `devm_mipi_dsi_attach()` fails, leaving a dangling pointer in the global panel list and causing a Use-After-Free.
--

--- Patch [4]: [PATCH v3 4/6] drm/panel: Use devm_mipi_dsi_attach in Himax and Ilitek panels ---
commit 3a10b5f724df17d382396b95194d7b29446eceae
Author: Osama Abdelkader <osama.abdelkader@gmail.com>

drm/panel: Use devm_mipi_dsi_attach in Himax and Ilitek panels

Use the managed MIPI DSI attach helper in Himax and Ilitek panel drivers
and drop the corresponding manual detach calls from remove paths.

> diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
> index 3abdd0870e831..ca7037a4242c7 100644
> --- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
> +++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
> @@ -2597,14 +2597,12 @@ static int ili9881c_dsi_probe(struct mipi_dsi_device *dsi)
>  	dsi->format = MIPI_DSI_FMT_RGB888;
>  	dsi->lanes = ctx->desc->lanes;
>  
> -	return mipi_dsi_attach(dsi);
> +	return devm_mipi_dsi_attach(&dsi->dev, dsi);
>  }

[Severity: High]
This is a pre-existing issue, but if devm_mipi_dsi_attach() fails here,
does it leave a dangling pointer in the global panel list?

Since ili9881c_dsi_probe() directly returns the result of the attach attempt
without calling drm_panel_remove() on failure, and the panel context
was allocated with devm_drm_panel_alloc(), the devres cleanup will free
the memory while it remains linked in panel_list.

Could this cause a use-after-free when the list is next traversed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260812130429.16850-1-osama.abdelkader@gmail.com?part=4