From nobody Fri Jul 24 22:17:22 2026 Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 11E242EEE97 for ; Fri, 24 Jul 2026 04:17:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784866673; cv=none; b=u6SB4srjCHvp5ce5mk36mJHdBcnpSQEFzK/xpAhxgbCQlJjAWrXjJAIoXPUE23XrPE66FIpPIAg+OINBtKW50TbDghLdM2DNpHq7+6A/4GaSCS7SV46kzDwHEtYM2Ja9UY/cA4PZl5n5JAySXuFbaGMU5qA4TM1p7zyB+7SlMvE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784866673; c=relaxed/simple; bh=Qz/opuiAAMI/RXEB9y/h3MuKvf0HX07UrPXMh0/pC4s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=D/ZhFwn97rvx6kIvEXVfgy9y7Q0WJq+SHONWlOvZuOHNJiyF4UQBTz1bUoUP9rOdExm1/JEasROSFXLLRrwKuE/l67lrxloqPnnFysDSimAnUQZrz6eB2En3NqKoYqwGqxa9yDuZX/V1NvlLGjjPgedufEHGn7bRS9N75Xt8lYM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XgPJ6ZIN; arc=none smtp.client-ip=209.85.128.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XgPJ6ZIN" Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-490cf322ed0so31185e9.1 for ; Thu, 23 Jul 2026 21:17:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784866670; x=1785471470; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=a0VuahsdN36ECKorNPoSkLonNsIPTCrvqxrDox7fYRY=; b=XgPJ6ZIN6b8dpdxVML3mJzIuRYKvmE9LnaHJHowoo5sJdwExlsPODQnF9KSBSEaopb p3eIwBrG5apujAJIlOSgORuwNweeCqEmpwaZelNxXm4OQUAEUyOsbzuv9U0j0QqtZPgv d7tkCEZoCBEpvXSZ4Z2Pt3UFgEBENVsk77VbO3t/e8zGPVLv6kYcV7XfoPbjhOdm3pWD emvwwOd2oYNpgEfTW4f+0oFGvrj/QSNgAZzupjcHSxgcx7SmA4jQVa9ruT+HN5lvz4lt xEBta7Og44kfqBgdKbCXFyNpvWXWoW1XxgA4x8dQLdxsBftyXY9VWiRnUVnSwLNRJbuJ kpHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784866670; x=1785471470; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=a0VuahsdN36ECKorNPoSkLonNsIPTCrvqxrDox7fYRY=; b=U5hLZaVSst7M+Yd7snAzD9zNg5ZIBlvDAu2+VeCEik/9x5QFAFkmml15F8SsmK/7SI trLWEDVWUx/JL9cqgv2iKJ68Z3yOivHQGxOsydJi/M0w/Yw/xhxgMEsJNj8DDHNt6Dhk 0JIHrHekv/RsYpE2nKiSzKYjGpxL3Q+b76nfSgk6ndqtcw31NowwpDGi0FxxHUdoDmaQ 2SdfiMRO+9JmmjVxv00YipgZ94WBLjBirffbuBaXQpWkelWVP/X+HJmrDeqbeL+4r9F5 uLx97OJGvw1YPgpHqZjMkZn03x8OGDFIaK0tpwnJuw2KtoPJZKmZhwor1GWCFV77/rE5 P8uA== X-Forwarded-Encrypted: i=1; AHgh+RrdqZ9kqsjfC53N4gJ6su/ZZrJqApvL/KYMyZHL3mxO/C+q57u1OAin+tCGQEus8Y4ncwjZx+0f39sKGc0=@vger.kernel.org X-Gm-Message-State: AOJu0YyJK2wfog6XFMO8bUGFeK9LTo12QfXQmWnaqkL3x0t8kbAXqXfp PHm2cbXk3kH8P9wnhIHKsoZkPz6ONj3CCJKNpSiWCCdIl6p25oQjjFvb X-Gm-Gg: AR+sD11slCDE1vYh+u+OUvW1D0CwhTG73HGGqXMuFM1b0BVgfnNwb6A4ME9P2C3gO64 mSYWdYXVq0xenhORCfjzaPZ9JQbulz2EVEidN/5lKLws1FVFRgS67nHMiOU1e2OX9Ar+AnEYD2i BmNFXOyQAl0Vam2OmIDxezwh9ZPcu/AP+GVGNa1yqyxU6giC6+4NqU/BO9Bzsl7gItdba3EhvRP JTsb2p3/Vi/naPJMRFJV/FAMS9Li5RdhSOo82D8bAiyqQyj0W43NuL/APuTIQxXDre+x3Bru91B VndrGloIs6RqBNEq6t4rjgBpIlAeHzCPMKGE0wZ6CBVgpER+vBV9vl7hwLlnj1qpTE+dHfKi4xN 5CWjcGUbW0ZkkR+XtftjRt5FDB+86VRDtB8eN8v0swKkaRXyMODWuZQwIaPLjxcd8Y4dMut9c0G h4YRYJG7ePOGlcMC2DfoGjSgQFl41P2mntuMs+3cI9lrWWcKQO4MYTz9ObP+eq6w== X-Received: by 2002:a05:600c:c05a:b0:495:49da:e15a with SMTP id 5b1f17b1804b1-49573d083c6mr65959185e9.30.1784866669838; Thu, 23 Jul 2026 21:17:49 -0700 (PDT) Received: from dohko.chello.ie (188-141-5-72.dynamic.upc.ie. [188.141.5.72]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4957af79365sm48162655e9.9.2026.07.23.21.17.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 21:17:49 -0700 (PDT) From: David Carlier To: neil.armstrong@linaro.org, mitltlatltl@gmail.com Cc: jesszhan0024@gmail.com, maarten.lankhorst@linux.intel.com, mripard@kernel.org, tzimmermann@suse.de, airlied@gmail.com, simona@ffwll.ch, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, David Carlier Subject: [PATCH] drm/panel: novatek-nt36536: Fix panel double-remove on attach failure Date: Fri, 24 Jul 2026 05:17:46 +0100 Message-ID: <20260724041746.12887-1-devnexen@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The DSI attach error path calls drm_panel_remove() by hand even though the panel was registered with devm_drm_panel_add(), which already arranges for drm_panel_remove() to run on driver detach. When mipi_dsi_attach() fails the panel is therefore removed twice: once directly and once again while devres unwinds. drm_panel_add() takes a reference and drm_panel_remove() drops one, so the extra removal releases the last reference early and frees the panel container. The put registered by devm_drm_panel_alloc() then operates on freed memory, resulting in a use-after-free and a reference-count underflow when a DSI host rejects the requested configuration during probe. Drop the manual drm_panel_remove() and let the managed cleanup handle it, matching the other dual-DSI panel drivers. Fixes: 75a5dbd1f4f7 ("drm/panel: Add Novatek NT36536 panel driver") Signed-off-by: David Carlier --- drivers/gpu/drm/panel/panel-novatek-nt36536.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/gpu/drm/panel/panel-novatek-nt36536.c b/drivers/gpu/dr= m/panel/panel-novatek-nt36536.c index 2a82b54880c3..8bd125650168 100644 --- a/drivers/gpu/drm/panel/panel-novatek-nt36536.c +++ b/drivers/gpu/drm/panel/panel-novatek-nt36536.c @@ -429,11 +429,9 @@ static int novatek_probe(struct mipi_dsi_device *dsi) ctx->dsi[i]->mode_flags =3D desc->mode_flags; ctx->dsi[i]->dsc =3D &ctx->dsc; ret =3D devm_mipi_dsi_attach(dev, ctx->dsi[i]); - if (ret < 0) { - drm_panel_remove(&ctx->panel); + if (ret < 0) return dev_err_probe(dev, ret, "Failed to attach to DSI host\n"); - } } =20 if (desc->has_dcs_backlight) { --=20 2.53.0