Re: [PATCH] drm/rockchip: analogix_dp: bound endpoint name formatting

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Potential Use-After-Free when accessing `endpoint.local_node` after its reference count has been dropped.
--

commit fc6c7cf47483df3837bf09097a92c40c4a5aed65
Author: Yudi Yang <2000jedi@gmail.com>

drm/rockchip: analogix_dp: bound endpoint name formatting

This commit modifies rockchip_dp_drm_encoder_enable() to use snprintf()
instead of sprintf() when formatting a device tree path into a stack
buffer. This prevents potential buffer overflows from sufficiently long
device tree paths.

> diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> index 587e60232ec7c..efd5a98e80bd2 100644
> --- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> +++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> @@ -241,10 +241,11 @@ static void rockchip_dp_drm_encoder_enable(struct drm_encoder *encoder,
>  				of_graph_get_remote_port(endpoint.local_node);

[Severity: High]
This isn't a bug introduced by this patch, but does this code use
endpoint.local_node after its reference count has been dropped?

In rockchip_dp_drm_encoder_enable(), drm_of_encoder_active_endpoint() is
called, which internally calls of_graph_parse_endpoint(). This sets
endpoint->local_node without acquiring a reference and then explicitly
drops its reference by calling of_node_put(ep) before returning.

This leaves endpoint.local_node as a dangling pointer, which is then
passed to of_graph_get_remote_port() here (and earlier to
of_graph_get_remote_port_parent()). 

Could this result in a Use-After-Free if the device tree node is dynamically
freed?

>  
>  			of_property_read_u32(remote_port, "reg", &port_id);
> -			sprintf(name, "%s vp%d", remote_port_parent->full_name, port_id);
> +			snprintf(name, sizeof(name), "%s vp%d",
> +				 remote_port_parent->full_name, port_id);
>  		} else {
> -			sprintf(name, "%s %s",
> -				remote_port_parent->full_name, endpoint.id ? "vopl" : "vopb");
> +			snprintf(name, sizeof(name), "%s %s",
> +				 remote_port_parent->full_name, endpoint.id ? "vopl" : "vopb");
>  		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901195511.2761251-1-2000jedi@gmail.com?part=1