Re: [PATCH v3 3/6] drm/panel: Use devm_mipi_dsi_attach in Novatek and Raydium panels

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but there is a Use-After-Free in the driver unbind path due to an ignored error return value from devm_mipi_dsi_attach.
--

--- Patch [3]: [PATCH v3 3/6] drm/panel: Use devm_mipi_dsi_attach in Novatek and Raydium panels ---
commit 4038e87306192174f8d35deb13351bd8c956f7e3
Author: Osama Abdelkader <osama.abdelkader@gmail.com>

drm/panel: Use devm_mipi_dsi_attach in Novatek and Raydium panels

Use the managed MIPI DSI attach helper in Novatek and Raydium panel
drivers and drop the corresponding manual detach calls from remove paths.

> diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35510.c b/drivers/gpu/drm/panel/panel-novatek-nt35510.c
> index 3189d89c7ca00..e75b6ac3df5c3 100644
> --- a/drivers/gpu/drm/panel/panel-novatek-nt35510.c
> +++ b/drivers/gpu/drm/panel/panel-novatek-nt35510.c
> @@ -1175,7 +1175,7 @@ static int nt35510_probe(struct mipi_dsi_device *dsi)
>  
>  	drm_panel_add(&nt->panel);
>  
> -	ret = mipi_dsi_attach(dsi);
> +	ret = devm_mipi_dsi_attach(&dsi->dev, dsi);
>  	if (ret < 0)
>  		drm_panel_remove(&nt->panel);

[Severity: High]
This is a pre-existing issue, but if devm_mipi_dsi_attach() fails here,
drm_panel_remove() is called, but the nt35510_probe() function still
returns 0 (success) immediately after this. Because probe succeeds, devres
cleanup isn't triggered at probe time.

[ ... ]

> @@ -1186,8 +1186,6 @@ static void nt35510_remove(struct mipi_dsi_device *dsi)
>  {
>  	struct nt35510 *nt = mipi_dsi_get_drvdata(dsi);
>  	int ret;
> -
> -	mipi_dsi_detach(dsi);

[Severity: High]
This isn't a bug introduced by this patch, but when the driver is later unbound,
nt35510_remove() calls drm_panel_remove() a second time. This drops the
refcount to 0, freeing the panel memory prematurely. 

After nt35510_remove() completes, the devres cleanup handlers execute,
including drm_panel_put_void(), which will access the already freed panel
memory resulting in a use-after-free.

Should nt35510_probe() return the error code instead of 0 when
devm_mipi_dsi_attach() fails?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260812130429.16850-1-osama.abdelkader@gmail.com?part=3