On Fri, 17 Jul 2026 16:02:04 +0200, Albert Esteve <[email protected]> wrote: > The global panel_list holds raw pointers to drm_panel objects. > Nothing prevents a panel from being freed while it is still linked > in the list: if a driver's probe calls drm_panel_add() and then > fails at a later step, panel->list remains in panel_list. Any > subsequent call to of_drm_find_panel() that iterates the list will > dereference freed memory. > > [...]
Reviewed-by: Luca Ceresoli <[email protected]> -- Luca Ceresoli, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
