From nobody Fri Sep 25 11:10:22 2026 Received: from mail-pz2-f12.google.com (mail-pz2-f12.google.com [74.125.228.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDF082E1EFC for ; Sun, 13 Sep 2026 13:19:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.12 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789305544; cv=none; b=H5DW0M/PYWdtujgao4COPXpxAsCadQYcJ4FVj47I4xb5zcUCmHCRz5CTnt+R+a+J15pzRptHuN3VyDeAuWDWufT+sKLKV8h4ycdyqVUTM++iMYtz3CLvQwCiksEfPRWrxvmtk2AgliMZ+gh2nu9Pdc0SFUKET3JrRKLJufpiaS8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789305544; c=relaxed/simple; bh=MNEB3uM9fk17gH3lCK0TQ0HdXUzZavXN7I2Fq7ejFto=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=OKfORKH4+kTf7ewDYG/hOrOMtn+bmkqKEKR0+H5AAZPAaZ0Ihc7ZDRQwl2vd/vJs16H/kyvul71pKQVBgfhYGpXuCb6IibbR1+CwryjBf5NcmIEOhtKxpYedOXU1tGkG7Ds/GGXIBxqIjmExzGIBsRQiWQHpHnBeBOItGgUZFBQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TDhwE2Dw; arc=none smtp.client-ip=74.125.228.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TDhwE2Dw" Received: by mail-pz2-f12.google.com with SMTP id 41be03b00d2f7-cc4c3304784so1183714a12.3 for ; Sun, 13 Sep 2026 06:19:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789305541; x=1789910341; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=BzrAlMcZ8zBRfbQWU5o3RvRaRsPXz8ZJNVxN53VL4HY=; b=TDhwE2Dw/ai1Crpx2VWu1BelXZ4CKT1kqlcorok3bs7xwYdIM/uwT6wiR8NIsaOsYX kSw6pEYIv1YU3kdoOnMuUXf+Ppx07DrFXsRlAkt4wIkh44TJle94rG68P1ZOFZXLYTNg +emi43Emd31AfBRQskLy46fyZr/UkVsloPqebPgVqAONXpWxNsvikupaH6tAnHXW4/0b CNVP61h3hq/WFQMZQrMpKjkWyhGJRDHisWwdu6h6ND5sGA7sMj7o52ravNHoGQnJwmKw GC8QZKYPBxUmBLoyRARt2mnJl1QZ0k9/2l5xqonAdHTYfyFcG+DlAHI+XJ5Sfs8pxxdy we+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1789305541; x=1789910341; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=BzrAlMcZ8zBRfbQWU5o3RvRaRsPXz8ZJNVxN53VL4HY=; b=TuKAq5tQogyWNSkoW5TNf58OXaw1I6Eb4859eu0uftjbHWgM/1NMuZ3yZGMeQN1wt0 Y+t8gFNzDys1XfrXRhMbMgTQPXDWHN2aMDiL/vlGfKNbAqbL5M7V2XtBjutXNHvor4Ug vhQdYXckiMW/2f8gjEWa467zNvD9wSt/LarF7mcj9m43rYVcNM4VcvVF1ilYBX3Qg3RZ 3qNGhaDDy86K/AOs7sciC85qQ115RmK5kl+PwnBEfczs7IxucgDzl9Vm35DPUPUI4cL0 djbSA6M5lKd/E4SyRpXvRvDYx6nh0lUlPZwOqOqNqcZdVRAevRm/Auj4X6dpL3XYP5/C rKXA== X-Forwarded-Encrypted: i=1; AKwUvBxnHxeM6QDD12TOdqrUemL/b5yqHdsHa6AwnEnxuwIgHrbmbF5HSyFSuqNXLt7pycJJmFnWxccH/xUOAOY=@vger.kernel.org X-Gm-Message-State: AFuF++kwv7E69dXl3tYkba7S9wRo4f5lrFxLjjFORaWrkhBKdauu45yQ JlPr4lq5kYUzkZKKH9qcUyP29Pnpsd+54WdC/S36G4IXl5LP4lBQH6FU+GqJ6cgr9Ns= X-Gm-Gg: AYBFou2jKlXs4H3wG/mTEGRnx+rnEzp2VPqCZeUK+pjvB4zXDkDF2VnDvJiJnsWjRtw VoSpKJr6fv683DdcPD6Wb2hDJCkVQ/Waf8g0qZuX6sDSES7T8wCSidgcMDx4zpSDfKHW98MavhH hl5x9u5Sbn78nzfvoxsrLmC8RNrV3O1kE0Fo0/Rf0lsSUUvAamLN1bbtmzlfzMduRxZCynOHbvd YuXjNWd6G1PhXnZ9jHpxHWft8G51K3qdbinZVb4Xzd8W9cGw6ExfwxaGOAS2XBBE0Kss1lEvxGe 38Cw1lSCci+fsT0qxjQEDQSItQ8c3ki23WmKiylZ1qVqYXhXEYDckLkv5uyDUKH7AjJG5J1wxGF HXPih74tMM21Wnv0lRwLgJCclDubAjJiCHlSQlYwIZ9vILaZcblKFHnk1V3FEv/kBioYIx1HhIk DJcnkCNr9DoiMCuh8ipncgWQTrG61kNRarS3M1V2g05Yi8SaxQknMJK+Nt64XSvE5zeA== X-Received: by 2002:a17:90a:d64e:b0:395:4de4:92be with SMTP id 98e67ed59e1d1-39d9c1db130mr26350180a91.13.1789305540739; Sun, 13 Sep 2026 06:19:00 -0700 (PDT) Received: from lgs.. ([2001:250:5800:1002::de93]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39d95095946sm15749780a91.5.2026.09.13.06.18.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 13 Sep 2026 06:19:00 -0700 (PDT) From: Guangshuo Li To: Neil Armstrong , Jessica Zhang , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Sam Ravnborg , AngeloGioacchino Del Regno , Marijn Suijten , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li , stable@vger.kernel.org Subject: [PATCH] drm/panel: novatek-nt35950: fix potential use-after-free on attach failure Date: Sun, 13 Sep 2026 21:18:49 +0800 Message-ID: <20260913131849.1561742-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nt35950_probe() registers the panel before attaching it to the DSI hosts. If mipi_dsi_attach() fails, the probe error path returns without removing the panel from the DRM panel registry. The panel is allocated with devm_drm_panel_alloc(), so its storage is released after probe returns an error. Leaving the panel registered therefore leaves the global panel list pointing at freed memory, which can result in a potential use-after-free when the stale entry is later accessed. There is an additional cleanup issue for dual-DSI panels. If attaching DSI0 succeeds but attaching DSI1 fails, the error path unregisters the secondary DSI device without detaching the already attached DSI0. The failure sequence is: drm_panel_add() | v attach DSI0 | | success v attach DSI1 | | failure v probe cleanup | +-- DSI0 remains attached | +-- panel remains registered | v probe returns error | v devm panel storage is released | v panel registry contains a dangling pointer Detach any DSI hosts that were successfully attached before the failure and remove the panel from the DRM panel registry before returning the probe error. This issue was found by manual code inspection. Fixes: 623a3531e9cf ("drm/panel: Add driver for Novatek NT35950 DSI DriverI= C panels") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/gpu/drm/panel/panel-novatek-nt35950.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35950.c b/drivers/gpu/dr= m/panel/panel-novatek-nt35950.c index 94aa6489d99f..8edd0aa363ce 100644 --- a/drivers/gpu/drm/panel/panel-novatek-nt35950.c +++ b/drivers/gpu/drm/panel/panel-novatek-nt35950.c @@ -514,12 +514,19 @@ static int nt35950_probe(struct mipi_dsi_device *dsi) =20 ret =3D mipi_dsi_attach(nt->dsi[i]); if (ret < 0) { - /* If we fail to attach to either host, we're done */ + dev_err_probe(dev, ret, + "Cannot attach to DSI%d host.\n", i); + + /* Detach from all previously attached DSI hosts */ + while (i--) + mipi_dsi_detach(nt->dsi[i]); + if (num_dsis =3D=3D 2) mipi_dsi_device_unregister(nt->dsi[1]); =20 - return dev_err_probe(dev, ret, - "Cannot attach to DSI%d host.\n", i); + drm_panel_remove(&nt->panel); + + return ret; } } =20 --=20 2.43.0