Re: [PATCH 01/75] drm/panel: Add atomic_create_state support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm: missing drm_connector_cleanup() on atomic_create_state error path
--

commit 0b1142b139421992608178b6e00be629b73837b5
Author: Maxime Ripard <mripard@kernel.org>

drm/panel: Add atomic_create_state support

The panel bridge attach hook calls the connector's reset function to
initialize the connector state when the device is already registered.
Now that connectors are being migrated from the reset hook to
atomic_create_state, prefer it over reset and fall back to the reset
hook if atomic_create_state is not implemented.

> diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c
> index c00529bfb706b..c9f49e18890ad 100644
> --- a/drivers/gpu/drm/drm_panel.c
> +++ b/drivers/gpu/drm/drm_panel.c
> @@ -104,8 +104,18 @@ static int panel_bridge_attach(struct drm_bridge *bridge,
>  	drm_connector_attach_encoder(connector, encoder);
>  
>  	if (bridge->dev->registered) {
> -		if (connector->funcs->reset)
> +		if (connector->funcs->atomic_create_state) {
> +			struct drm_connector_state *conn_state;
> +
> +			conn_state = connector->funcs->atomic_create_state(connector);
> +			if (IS_ERR(conn_state))
> +				return PTR_ERR(conn_state);

[Severity: High]
Does this early return leak the initialized connector resources?

Earlier in panel_bridge_attach(), drm_connector_init() is called:

	ret = drm_connector_init(bridge->dev, connector,
				 &panel_bridge_connector_funcs,
				 panel->connector_type);

This successfully initializes the connector, allocates its IDA and name string,
and adds it to the DRM device's global connector_list.

When atomic_create_state() fails and we return PTR_ERR(conn_state) early,
drm_connector_cleanup() is bypassed. Because the bridge attach failed, the
caller (drm_bridge_attach()) aborts the setup and will not call the bridge's
detach hook where drm_connector_cleanup() is typically invoked.

As a result, the connector remains in dev->mode_config.connector_list while
its enclosing struct drm_panel memory is tied to the panel driver's lifecycle.
If the panel driver unbinds and frees its memory, the DRM core might traverse
a freed list node during drm_mode_config_cleanup() or subsequent connector
iterations, potentially leading to a use-after-free crash. Additionally, the
IDA and name string allocated by drm_connector_init() are leaked.

> +
> +			connector->state = conn_state;
> +		} else if (connector->funcs->reset) {
>  			connector->funcs->reset(connector);
> +		}
> +
>  		drm_connector_register(connector);
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014-drm-no-more-connector-reset-v1-0-586c9c026823@kernel.org?part=1