Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: - [High] Missing NULL check for the result of device_get_match_data() leads to a kernel oops. - [High] Undefined function call and missing DRM panel unregistration leading to Use-After-Free. --
commit c22f05cd630ecc7dace66102729e2ea4cdfd93fc Author: Igor Reznichenko <[email protected]> drm/panel: Add Ilitek ILI9488 controller driver This commit adds support for the Ilitek ILI9488 DSI controller. It introduces power sequencing and DSI initialization tailored for the FocusLCDs E35GH-I-MW800-CB panel. > diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9488.c > b/drivers/gpu/drm/panel/panel-ilitek-ili9488.c > new file mode 100644 > index 0000000000000..7302766034fc9 > --- /dev/null > +++ b/drivers/gpu/drm/panel/panel-ilitek-ili9488.c [ ... ] > +static int ili9488_dsi_probe(struct mipi_dsi_device *dsi) > +{ > + struct device *dev = &dsi->dev; > + struct ili9488 *ili; > + int i, ret; > + > + ili = devm_drm_panel_alloc(dev, struct ili9488, panel, &ili9488_funcs, > + DRM_MODE_CONNECTOR_DSI); > + if (IS_ERR(ili)) > + return PTR_ERR(ili); > + > + ili->desc = device_get_match_data(dev); > + ili->dsi = dsi; > + > + dsi->mode_flags = ili->desc->mode_flags; [Severity: High] Can this dereference a NULL pointer if the device is instantiated without matching firmware data? The function device_get_match_data() can return NULL, for example via sysfs or string-based matching. Verifying the return value before accessing ili->desc->mode_flags would prevent a potential NULL pointer dereference. [ ... ] > + ret = drm_panel_of_backlight(&ili->panel); > + if (ret) > + return dev_err_probe(dev, ret, "failed to get backlight\n"); > + > + ili->panel.prepare_prev_first = true; > + > + ret = devm_drm_panel_add(dev, &ili->panel); [Severity: High] Does the devm_drm_panel_add() function exist in the kernel, or will this cause a build failure? Additionally, if this call is replaced with drm_panel_add(), the driver lacks a corresponding .remove() callback or a devres action to unregister the panel with drm_panel_remove(). Since the panel structure is allocated with devm_drm_panel_alloc() and freed on driver unbind, failing to unregister the panel will leave it on the DRM core's global panel list, leading to a Use-After-Free when the list is later accessed. > + if (ret) > + return ret; > + > + ret = devm_mipi_dsi_attach(dev, dsi); > + if (ret < 0) > + return dev_err_probe(dev, ret, "failed to attach to DSI > host\n"); > + > + return 0; > +} -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
