Thank you for your contribution! Sashiko AI review found 1 potential issue(s)
to consider:
Pre-existing issues:
- [High] Potential Use-After-Free when accessing `endpoint.local_node` after
its reference count has been dropped.
--
commit fc6c7cf47483df3837bf09097a92c40c4a5aed65
Author: Yudi Yang <[email protected]>
drm/rockchip: analogix_dp: bound endpoint name formatting
This commit modifies rockchip_dp_drm_encoder_enable() to use snprintf()
instead of sprintf() when formatting a device tree path into a stack
buffer. This prevents potential buffer overflows from sufficiently long
device tree paths.
> diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> index 587e60232ec7c..efd5a98e80bd2 100644
> --- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> +++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> @@ -241,10 +241,11 @@ static void rockchip_dp_drm_encoder_enable(struct
> drm_encoder *encoder,
> of_graph_get_remote_port(endpoint.local_node);
[Severity: High]
This isn't a bug introduced by this patch, but does this code use
endpoint.local_node after its reference count has been dropped?
In rockchip_dp_drm_encoder_enable(), drm_of_encoder_active_endpoint() is
called, which internally calls of_graph_parse_endpoint(). This sets
endpoint->local_node without acquiring a reference and then explicitly
drops its reference by calling of_node_put(ep) before returning.
This leaves endpoint.local_node as a dangling pointer, which is then
passed to of_graph_get_remote_port() here (and earlier to
of_graph_get_remote_port_parent()).
Could this result in a Use-After-Free if the device tree node is dynamically
freed?
>
> of_property_read_u32(remote_port, "reg", &port_id);
> - sprintf(name, "%s vp%d", remote_port_parent->full_name,
> port_id);
> + snprintf(name, sizeof(name), "%s vp%d",
> + remote_port_parent->full_name, port_id);
> } else {
> - sprintf(name, "%s %s",
> - remote_port_parent->full_name, endpoint.id ?
> "vopl" : "vopb");
> + snprintf(name, sizeof(name), "%s %s",
> + remote_port_parent->full_name, endpoint.id ?
> "vopl" : "vopb");
> }
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
