Re: [PATCH v4 1/5] drm/msm/dsi: support DSC configurations with slice_per_pkt > 1

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Failure to clear `msm_host->dsc` and `dsc_slice_per_pkt` when a panel without DSC is attached leads to a potential use-after-free.
--

commit 4b3fdd757a84f263ad4c869c8ef48cdc07ee2b22
Author: Jun Nie <jun.nie@linaro.org>

drm/msm/dsi: support DSC configurations with slice_per_pkt > 1

This commit adds support for sending multiple DSC slices in a single packet
for the MSM DSI driver. It introduces a dsc_slice_per_pkt member into struct
drm_dsc_config and updates the relevant timing calculations.

> diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
> index 565d425f88b86..10589389650fc 100644
> --- a/drivers/gpu/drm/msm/dsi/dsi_host.c
> +++ b/drivers/gpu/drm/msm/dsi/dsi_host.c

[ ... ]

> @@ -1718,8 +1708,11 @@ static int dsi_host_attach(struct mipi_dsi_host *host,
>  	msm_host->lanes = dsi->lanes;
>  	msm_host->format = dsi->format;
>  	msm_host->mode_flags = dsi->mode_flags;
> -	if (dsi->dsc)
> +	if (dsi->dsc) {
>  		msm_host->dsc = dsi->dsc;
> +		/* for backwards compatibility, assume 1 if not set */
> +		msm_host->dsc_slice_per_pkt = dsi->dsc->dsc_slice_per_pkt ?: 1;
> +	}

[Severity: High]
This is a pre-existing issue, but does failing to clear msm_host->dsc and
dsc_slice_per_pkt when a panel without DSC is attached lead to a potential
use-after-free?

When a panel driver is unbound, the DRM pipeline is torn down, and the panel's
memory (including the embedded drm_dsc_config structure) is freed.

However, the msm_dsi_host structure persists in memory because it belongs
to the DSI host controller driver. If a new panel without DSC is subsequently
bound, dsi->dsc will be NULL, causing dsi_host_attach() to skip the assignment
and leave msm_host->dsc pointing to the freed memory.

When the display is later enabled, dsi_timing_setup() executes
if (msm_host->dsc) and performs a use-after-free write
(dsc->pic_width = mode->hdisplay;).

Since this patch extends this pattern to the newly added dsc_slice_per_pkt
field, should there be an else branch to clear these fields when dsi->dsc
is NULL?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-sm8650-7-1-bonded-dsi-v4-0-a4dd5e0850f1@linaro.org?part=1