Re: [PATCH v5 12/14] media: iris: Add platform data for glymur

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Stack use-after-return / dangling pointer due to storing a local variable's address in device driver data.
--

commit 93f713f9565a33672387c6d251540a853b65cebf
Author: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>

media: iris: Add platform data for glymur
    
On glymur platform, the iris core shares most properties with the iris core
on the SM8550 platform, but integrates two codec cores instead of one. Add
glymur specific platform data, reusing SM8550 definitions wherever applicable.

> diff --git a/drivers/media/platform/qcom/iris/iris_platform_glymur.c b/drivers/media/platform/qcom/iris/iris_platform_glymur.c
> new file mode 100644
> index 0000000000000..f16155b7dc997
> --- /dev/null
> +++ b/drivers/media/platform/qcom/iris/iris_platform_glymur.c

[ ... ]

> +int iris_glymur_init_cb_devs(struct iris_core *core)
> +{
> +	u64 dma_mask = core->iris_platform_data->dma_mask;
> +	const u32 fw_fid = IOMMU_FID_IRIS_FIRMWARE;
> +	struct device *dev;
> +
> +	dev = create_iris_vpu_bus_device(core->dev, "iris-firmware", dma_mask, &fw_fid);

Does this leave a dangling pointer in the device driver data?

Looking at create_iris_vpu_bus_device(), it calls dev_set_drvdata() to store
the address of fw_fid in the newly registered device.

Since fw_fid is a local variable on the stack, its lifetime ends when
iris_glymur_init_cb_devs() returns. Any later dereference of this pointer
from the device's driver data will read invalid stack memory.

Could fw_fid be declared as static, or its lifetime otherwise tied to the
device?

> +	if (IS_ERR(dev))
> +		return PTR_ERR(dev);
> +
> +	if (device_iommu_mapped(dev))
> +		core->fw_dev = dev;
> +	else
> +		device_unregister(dev);
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260509-glymur-v5-0-7fbb340c5dbd@oss.qualcomm.com?part=12