Re: [PATCH v3 02/11] drm/mxsfb/lcdif: simplify ep pointer management using __free

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] devm_kzalloc allocated drm_encoder causes Use-After-Free on device unbind
--

--- Patch [2]: [PATCH v3 02/11] drm/mxsfb/lcdif: simplify ep pointer management using __free ---
commit f0c5403b21d20b71e67b52fb4f76773fe1e9a4f5
Author: Luca Ceresoli <luca.ceresoli@bootlin.com>

drm/mxsfb/lcdif: simplify ep pointer management using __free

This patch simplifies endpoint device_node pointer management in lcdif_drv.c
by utilizing the __free(device_node) cleanup action to eliminate manual
of_node_put() calls on early return paths.

> diff --git a/drivers/gpu/drm/mxsfb/lcdif_drv.c b/drivers/gpu/drm/mxsfb/lcdif_drv.c
> index 7719629487da5..8da8a265c05c8 100644
> --- a/drivers/gpu/drm/mxsfb/lcdif_drv.c
> +++ b/drivers/gpu/drm/mxsfb/lcdif_drv.c
[ ... ]
> @@ -65,23 +65,19 @@ static int lcdif_attach_bridge(struct lcdif_drm_private *lcdif)
[ ... ]
>  		bridge = devm_drm_of_get_bridge(dev, dev->of_node, 0, of_ep.id);
> -		if (IS_ERR(bridge)) {
> -			of_node_put(ep);
> +		if (IS_ERR(bridge))
>  			return dev_err_probe(dev, PTR_ERR(bridge),
>  					     "Failed to get bridge for endpoint%u\n",
>  					     of_ep.id);
> -		}
>  
>  		encoder = devm_kzalloc(dev, sizeof(*encoder), GFP_KERNEL);

[Severity: High]
This isn't a bug introduced by this patch, but could this devm_kzalloc()
cause a use-after-free on device unbind?

If a user opens the DRM device file, keeping the drm_device reference count
greater than 0, and the platform driver is concurrently unbound, the driver's
remove callback will return and the driver core will execute devm cleanup.

This cleanup frees the encoder. However, because the DRM device is still alive
due to the open file descriptor, the freed encoder remains linked in the
drm->mode_config lists.

When the user later closes the file and the DRM device refcount drops to 0,
will drm_mode_config_cleanup() iterate over the lists and access this freed
memory? Should this instead use a DRM-managed allocator to properly tie the
encoder's lifetime to the DRM device rather than the platform device?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260402-drm-lcdif-dbanc-v3-0-27cd247a0847@bootlin.com?part=2