Re: [PATCH v3 08/40] drm/kmb: Convert to atomic_create_state

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but calling kfree() on an interior pointer allocated by drmm_kzalloc() causes heap corruption and a double free during DRM device teardown.
--

commit 8cb00e04f7c7c0f7305c33451c9eebfc86df5dd2
Author: Maxime Ripard <mripard@kernel.org>

drm/kmb: Convert to atomic_create_state

The plane only initializes a pristine state in its reset hook
using drm_atomic_helper_plane_reset(), which is equivalent to what
atomic_create_state expects. Convert to it.

[ ... ]

> diff --git a/drivers/gpu/drm/kmb/kmb_plane.c b/drivers/gpu/drm/kmb/kmb_plane.c
> index a0001edb1e21a..1742c2c6dfd89 100644
> --- a/drivers/gpu/drm/kmb/kmb_plane.c
> +++ b/drivers/gpu/drm/kmb/kmb_plane.c
> @@ -561,7 +561,7 @@ static const struct drm_plane_funcs kmb_plane_funcs = {
>  	.update_plane = drm_atomic_helper_update_plane,
>  	.disable_plane = drm_atomic_helper_disable_plane,
>  	.destroy = kmb_plane_destroy,

[Severity: High]
This isn't a bug introduced by this patch, but calling kfree() on an
interior pointer allocated by drmm_kzalloc() causes heap corruption and a
double free during DRM device teardown.

Looking at kmb_plane_init(), the plane is allocated using the DRM-managed
allocator:

drivers/gpu/drm/kmb/kmb_plane.c:kmb_plane_init() {
        ...
        plane = drmm_kzalloc(drm, sizeof(*plane), GFP_KERNEL);
        ...
}

However, in kmb_plane_destroy(), an unmanaged kfree() is erroneously called:

drivers/gpu/drm/kmb/kmb_plane.c:kmb_plane_destroy() {
        ...
        kfree(kmb_plane);
        ...
}

Since this is reachable during normal device teardown or initialization
failure, will this trigger a kernel panic due to an invalid free followed
by a double free when the DRM managed resource is cleaned up by
drm_dev_put()?

> -	.reset = drm_atomic_helper_plane_reset,
> +	.atomic_create_state = drm_atomic_helper_plane_create_state,
>  	.atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state,
>  	.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-drm-no-more-plane-reset-v3-0-1877c7aa57b3@kernel.org?part=8