Re: [PATCH v2 3/11] drm: pl111: Use devm_of_reserved_mem_device_init()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

Pre-existing issues:
- [High] Pre-existing use-after-free and memory corruption risks due to tying resource lifetimes (`priv` structure and reserved memory) to `devres` (driver unbind) while the `drm_device` can outlive the unbind.
- [High] The `drm_panel_bridge` allocated via `drm_panel_bridge_add_typed()` in `pl111_modeset_init()` is leaked if `drm_dev_register()` fails.
- [High] When `INTEGRATOR_CLCD_CM` is matched, `pl111_versatile_init()` overwrites `np` without dropping the original reference. If the second match fails, probe incorrectly fails.
--

commit 76a1e18802677a9e3db4c051729d253910d2a13c
Author: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>

drm: pl111: Use devm_of_reserved_mem_device_init()

This patch converts the driver to use devm_of_reserved_mem_device_init,
allowing the reserved memory region to be released automatically on
probe failure or device removal. It removes the explicit cleanup calls.

> diff --git a/drivers/gpu/drm/pl111/pl111_drv.c b/drivers/gpu/drm/pl111/pl111_drv.c
> index 8ec659b3c08eb..a07b17261961c 100644
> --- a/drivers/gpu/drm/pl111/pl111_drv.c
> +++ b/drivers/gpu/drm/pl111/pl111_drv.c
> @@ -255,7 +255,7 @@ static int pl111_amba_probe(struct amba_device *amba_dev,
>  	drm->dev_private = priv;
>  	priv->variant = variant;
>  
> -	ret = of_reserved_mem_device_init(dev);
> +	ret = devm_of_reserved_mem_device_init(dev);

[Severity: High]
This is a pre-existing issue, but does tying resource lifetimes to devres
here expose a use-after-free risk?

The priv structure is allocated via devm_kzalloc() and the reserved
memory is now managed via devres, tying their lifetimes to the driver
unbind lifecycle. However, the drm_device is allocated without devres via
drm_dev_alloc() and tied to a refcount.

If a local user holds an open DRM file descriptor (like /dev/dri/card0)
and the driver is unbound via sysfs, devres will free priv and the reserved
memory while the DRM device persists. Because pl111_amba_remove() calls
drm_dev_unregister() instead of drm_dev_unplug(), the device is not
marked as unplugged and subsequent ioctls are not blocked.

An ioctl like DRM_IOCTL_PRIME_FD_TO_HANDLE will call
pl111_gem_import_sg_table(), which accesses dev->dev_private (priv),
potentially causing a use-after-free. Should the driver be migrated to
drm_dev_unplug() and devm_drm_dev_alloc() to prevent this?

[ ... ]

> @@ -314,7 +314,6 @@ static int pl111_amba_probe(struct amba_device *amba_dev,
>  
>  dev_put:
>  	drm_dev_put(drm);
> -	of_reserved_mem_device_release(dev);
>  
>  	return ret;
>  }

[Severity: High]
This is a pre-existing issue, but does this error path leak the panel
bridge?

During probe, a bridge is created by calling drm_panel_bridge_add_typed()
inside pl111_modeset_init(), which adds the bridge to the global DRM bridge
list with a reference count of 2.

If drm_dev_register() subsequently fails, the probe function jumps to
the dev_put label. The error path calls drm_dev_put(drm) but fails to
call drm_panel_bridge_remove(priv->bridge). When the panel device is
eventually unbound, its devres cleanup drops one reference on the bridge,
but the bridge is never removed from the global list, leaving a dangling
pointer. Does this need an explicit drm_panel_bridge_remove() call here?

Also, while reviewing the probe path, I noticed a potential node reference
issue in pl111_versatile_init() called earlier in this function:

drivers/gpu/drm/pl111/pl111_versatile.c:pl111_versatile_init() {
    ...
    np = of_find_matching_node_and_match(NULL, versatile_clcd_of_match,
                                         &clcd_id);
    ...
    if (clcd_id == INTEGRATOR_CLCD_CM) {
        np = of_find_matching_node_and_match(NULL, impd1_clcd_of_match,
                                             &clcd_id);
}

[Severity: High]
This is a pre-existing issue, but does overwriting np without dropping the
original reference cause a memory leak?

For the INTEGRATOR_CLCD_CM type, a second call to
of_find_matching_node_and_match() is made, and its result overwrites np
without calling of_node_put() on the original node. If the IM-PD1 syscon
is not found, the second call returns NULL. The probe then calls
syscon_node_to_regmap(NULL), which fails and returns an error, preventing
the driver from probing successfully on valid standard Integrator AP
hardware. Should of_node_put() be called before reassigning np?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902201640.2024648-1-mukesh.ojha@oss.qualcomm.com?part=3