Re: [PATCH v8 10/10] drm/rockchip: analogix_dp: Add support for RK3576

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] The `rk3576_edp` chip data table omits `.edp_mode` GRF register field initialization, which may prevent the combo PHY from being properly configured.

Pre-existing issues:
- [Critical] A `sprintf` call formats a potentially long device node path into a fixed 32-byte stack buffer `name`, causing a stack overflow vulnerability.
--

commit d5d21d53d47c2f7f634710afc76442e39aeaf0f8
Author: Damon Ding <damon.ding@rock-chips.com>

drm/rockchip: analogix_dp: Add support for RK3576

This commit adds dedicated chip data and a device tree matching entry to
bring up basic eDP functionality for the RK3576 platform. It notes that
the hardware blocks fully match the proven RK3588 design.

> diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> index d2af5eb29dbb5..d4c5dd61e95bb 100644
> --- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> +++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> @@ -522,6 +522,14 @@ static const struct rockchip_dp_chip_data rk3288_dp[] = {
>  	{ /* sentinel */ }
>  };
>  
> +static const struct rockchip_dp_chip_data rk3576_edp[] = {
> +	{
> +		.chip_type = RK3576_EDP,
> +		.reg = 0x27dc0000,

[Severity: High]
Does this missing .edp_mode initialization prevent the combo PHY from
being properly configured?

The commit message states that the RK3576 hardware blocks fully match
the RK3588 design. However, the RK3588 implementation uses .edp_mode to
configure the combo PHY via GRF when powering on the DP controller.

Because .edp_mode is left uninitialized here, when rockchip_dp_poweron()
calls rockchip_grf_field_write(), it will silently return 0 since .valid
is false, skipping the GRF configuration entirely.

[ ... ]

This isn't a bug introduced by this patch, but while reviewing this file
I noticed a pre-existing issue in rockchip_dp_drm_encoder_enable():

drivers/gpu/drm/rockchip/analogix_dp-rockchip.c:rockchip_dp_drm_encoder_enable() {
    char name[32];
    ...
    if (remote_port_parent) {
        if (of_get_child_by_name(remote_port_parent, "ports")) {
            ...
            sprintf(name, "%s vp%d", remote_port_parent->full_name, port_id);
    ...
}

[Severity: Critical]
Since remote_port_parent->full_name points to the device tree node's full
name (which can exceed 32 characters), can this unbounded string write
overflow the 32-byte name buffer on the stack?

Additionally, it appears the name variable is never actually used for
anything after being formatted, meaning this vulnerability exists purely
in dead logic.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260525125331.140059-1-damon.ding@rock-chips.com?part=10