Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] TOCTOU race condition in `drm_panel_add_follower` leading to Use-After-Free of `panel->dev`. -- --- Patch [4]: [PATCH v3 4/4] drm/panel: find_panel_by_fwnode() return a counted reference --- commit 2c073e53f181794d94244eff0882b1f1a661d995 Author: Albert Esteve <[email protected]> drm/panel: find_panel_by_fwnode() return a counted reference This patch updates find_panel_by_fwnode() to return a reference-counted drm_panel pointer, preventing the panel's container memory from being released prematurely. It also updates drm_panel_remove_follower() to balance the reference with drm_panel_put(). > diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c > index 72cf86253c0cd..a00ae98ed0956 100644 > --- a/drivers/gpu/drm/drm_panel.c > +++ b/drivers/gpu/drm/drm_panel.c [ ... ] > @@ -554,6 +560,7 @@ static struct drm_panel *find_panel_by_fwnode(const > struct fwnode_handle *fwnode > > list_for_each_entry(panel, &panel_list, list) { > if (dev_fwnode(panel->dev) == fwnode) { > + drm_panel_get(panel); > mutex_unlock(&panel_lock); [Severity: High] This is a pre-existing issue, but does releasing the panel_lock here leave a TOCTOU race window where panel->dev can be freed before it's used by the caller? If the panel's device is unregistered concurrently (e.g., via sysfs unbind of its parent), the following sequence seems possible: CPU1 in find_panel_by_fwnode(): drm_panel_get(panel); mutex_unlock(&panel_lock); return panel; CPU2 concurrently unregisters the device: drm_panel_remove() runs, removing the panel from panel_list. The device's reference count drops to zero and the struct device behind panel->dev is freed. CPU1 in drm_panel_add_follower(): get_device(panel->dev); Since panel->dev now points to a freed device, could this cause a use-after-free? > return panel; > } > } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
