Re: [PATCH v3 1/6] drm/panel: Use devm_mipi_dsi_attach in BOE panels

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing drm_panel_remove() on devm_mipi_dsi_attach() error path in boe_bf060y8m_aj0_probe() causes a dangling pointer and use-after-free.
--

--- Patch [1]: [PATCH v3 1/6] drm/panel: Use devm_mipi_dsi_attach in BOE panels ---
commit 1f4d2947471e6cb49ce506f1077843c672e21899
Author: Osama Abdelkader <[email protected]>

drm/panel: Use devm_mipi_dsi_attach in BOE panels

Use the managed MIPI DSI attach helper in BOE panel drivers and drop the
corresponding manual detach calls from remove paths.

> diff --git a/drivers/gpu/drm/panel/panel-boe-bf060y8m-aj0.c b/drivers/gpu/drm/panel/panel-boe-bf060y8m-aj0.c
> index 84c21c62a43e4..6a74523a66141 100644
> --- a/drivers/gpu/drm/panel/panel-boe-bf060y8m-aj0.c
> +++ b/drivers/gpu/drm/panel/panel-boe-bf060y8m-aj0.c
> @@ -359,7 +359,7 @@ static int boe_bf060y8m_aj0_probe(struct mipi_dsi_device *dsi)
>  
>  	drm_panel_add(&boe->panel);
>  
> -	ret = mipi_dsi_attach(dsi);
> +	ret = devm_mipi_dsi_attach(&dsi->dev, dsi);
>  	if (ret < 0) {
>  		dev_err(dev, "Failed to attach to DSI host: %d\n", ret);
>  		return ret;

[Severity: High]
This is a pre-existing issue, but should drm_panel_remove(&boe->panel) be
called on this error path?

In boe_bf060y8m_aj0_probe(), drm_panel_add() inserts the panel into the
global panel_list. If devm_mipi_dsi_attach() fails, the function returns an
error without calling drm_panel_remove().

During probe failure, the devres cleanup drops the panel's refcount but it
remains in the global panel_list since the refcount doesn't reach zero. If
another driver later looks up this panel (e.g., via of_drm_find_panel())
and invokes its operations, it will dereference freed devres-managed resources
like boe->reset_gpio, causing a use-after-free.

Other BOE panel drivers updated in this patch seem to correctly handle this
cleanup.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1