Re: [PATCH RFC v2 22/24] drm/bridge: samsung-dsim: implement .get_next_bridge

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/bridge: UAF in samsung_dsim_get_next_bridge() due to missing refcount increment
--

commit ff84bc6df44d9112a31ddd636aeba9815e9fc90e
Author: Luca Ceresoli <luca.ceresoli@bootlin.com>

drm/bridge: samsung-dsim: implement .get_next_bridge

This commit adds a get_next_callback function to expose the next bridge in the
samsung-dsim driver.

> diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c
> index b2de447dc6f43..de64d036b89bf 100644
> --- a/drivers/gpu/drm/bridge/samsung-dsim.c
> +++ b/drivers/gpu/drm/bridge/samsung-dsim.c
> @@ -1821,6 +1821,13 @@ static void samsung_dsim_mode_set(struct drm_bridge *bridge,
>  	drm_mode_copy(&dsi->mode, adjusted_mode);
>  }
>  
> +static struct drm_bridge *samsung_dsim_get_next_bridge(struct drm_bridge *bridge)
> +{
> +	struct samsung_dsim *dsi = bridge_to_dsi(bridge);
> +
> +	return dsi->bridge.next_bridge ?: ERR_PTR(-ENODEV);

[Severity: High]
Does samsung_dsim_get_next_bridge() in drivers/gpu/drm/bridge/samsung-dsim.c
need to increment the reference count of the returned bridge?

The DRM core API drm_bridge_funcs.get_next_bridge mandates that the returned
bridge pointer must have its reference count incremented (for example via
drm_bridge_get()), as the caller is expected to call drm_bridge_put() when
done.

By returning dsi->bridge.next_bridge directly without taking a new reference,
when callers (such as drm_hotplug_helper_pipeline_is_complete() introduced
later in this series) use drm_bridge_get_next() and automatically drop the
reference using __free(drm_bridge_put), they will drop the reference
originally owned by the samsung_dsim struct.

Later, when the driver tears down and tries to release its own reference via
drm_bridge_clear_and_put(), could this trigger a double-put or
use-after-free condition?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001-drm-bridge-hotplug-v2-0-8e34986dcb68@bootlin.com?part=22