Re: [PATCH v5 4/4] drm/panel: simple: Use managed helpers in panel-simple

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/panel: UAF/race in panel-simple due to devres teardown inversion
--

commit 16997c0bba9fd7e98551173f3a8332211618f894
Author: Osama Abdelkader <osama.abdelkader@gmail.com>

drm/panel: simple: Use managed helpers in panel-simple

This commit replaces the manual drm_panel_add and drm_panel_remove
calls in panel-simple with devm_drm_panel_add, removing the explicit
drm_panel_remove call from the remove path.

> diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
> index c95964ba25a95..02d21dde57663 100644
> --- a/drivers/gpu/drm/panel/panel-simple.c
> +++ b/drivers/gpu/drm/panel/panel-simple.c
> @@ -737,7 +737,9 @@ static struct panel_simple *panel_simple_probe(struct device *dev)
>  		goto disable_pm_runtime;
>  	}
>  
> -	drm_panel_add(&panel->base);
> +	err = devm_drm_panel_add(dev, &panel->base);
> +	if (err)
> +		goto disable_pm_runtime;
>  
>  	return panel;
>  

[ ... ]

> @@ -785,7 +787,6 @@ static void panel_simple_remove(struct device *dev)
>  {
>  	struct panel_simple *panel = dev_get_drvdata(dev);
>  
> -	drm_panel_remove(&panel->base);
>  	panel_simple_shutdown(dev);
>  
>  	pm_runtime_dont_use_autosuspend(dev);
>  	pm_runtime_disable(dev);
>  	if (panel->ddc)
>  		put_device(&panel->ddc->dev);

[Severity: High]
Does this devres conversion introduce a teardown sequence inversion that leads
to a use-after-free window?

By switching to devm_drm_panel_add in panel_simple_probe, the panel's
removal from the global DRM panel list is deferred until after the
panel_simple_remove callback completes and devres cleanup runs.

However, panel_simple_remove manually shuts down the panel, disables
PM runtime, and drops the DDC adapter reference (via put_device) while the
panel is still registered and discoverable.

If a concurrent display driver probes during this window, can it find the
panel via of_drm_find_panel and call drm_panel_get_modes? This would
dereference the already-released panel->ddc adapter and call PM runtime
functions on a disabled device.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260915145935.60397-1-osama.abdelkader@gmail.com?part=4