Re: [PATCH v4 2/3] drivers: gpu: drm: panel: Add BOE NT51021 driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm: panel: novatek-nt51021: UAF and crash due to premature devm_drm_panel_add()
--

commit 32c00aa725aa38b42eafcacc07a8f05495f7ed3d
Author: Nickolay Goppen <setotau@mainlining.org>

    drivers: gpu: drm: panel: Add BOE NT51021 driver
    
    Add driver for BOE NT51021-based 8-inch and 10-inch DSI video mode
    panels used in Xiaomi Mi Pad 4, Mi Pad 4 Plus (xiaomi-clover)
    and Amazon Fire HD 10 (2017) (amazon-suez) tablets.

> diff --git a/drivers/gpu/drm/panel/panel-novatek-nt51021.c b/drivers/gpu/drm/panel/panel-novatek-nt51021.c
> new file mode 100644
> index 0000000000000..94e7d6aaf0cb9
> --- /dev/null
> +++ b/drivers/gpu/drm/panel/panel-novatek-nt51021.c

[ ... ]

> +static int nt51021_novatek_probe(struct mipi_dsi_device *dsi)
> +{
> +	struct device *dev = &dsi->dev;

[ ... ]

> +	ctx->panel.prepare_prev_first = true;
> +
> +	ret = drm_panel_of_backlight(&ctx->panel);
> +	if (ret)
> +		return dev_err_probe(dev, ret, "Failed to get backlight\n");
> +
> +	ret = devm_drm_panel_add(dev, &ctx->panel);
> +	if (ret)
> +		return ret;
> +
> +	return devm_mipi_dsi_attach(dev, dsi);

[Severity: High]
Can this sequence lead to a use-after-free or kernel crash?

By calling devm_drm_panel_add() before devm_mipi_dsi_attach(), the panel is
published globally before DSI attachment completes.

If a DRM consumer discovers the panel via of_drm_find_panel() during this
window, it takes a reference on the panel. If devm_mipi_dsi_attach() then
fails, the probe function returns an error and devres cleans up the allocated
GPIO and regulator resources. However, the panel memory remains allocated
because of the consumer's reference.

When the consumer later calls drm_panel_prepare(), the panel driver will
dereference the freed GPIO and regulator pointers, causing a use-after-free.

Additionally, if a consumer calls drm_panel_prepare() before mipi_dsi_attach()
completes, it will trigger DSI commands on an unattached device, crashing the
DSI host.

Should devm_mipi_dsi_attach() be called before devm_drm_panel_add() to prevent
this race window?

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917-qcom-novatek-nt51021-panels-v4-0-30afbc35d70c@mainlining.org?part=2