tdo_tl070wsh30_panel_add() calls drm_panel_add() to link the panel
into the global panel_list before tdo_tl070wsh30_panel_probe() calls
mipi_dsi_attach(). The panel object itself is allocated with
devm_drm_panel_alloc(), which only arranges for an automatic
drm_panel_put() (via devm_add_action_or_reset()) when the DSI device
is torn down; unlike devm_drm_panel_add(), it does not call
drm_panel_remove() for you.

If mipi_dsi_attach() fails, probe() returns the error directly:

	return mipi_dsi_attach(dsi);

Once probe() returns an error, the driver core releases devres
resources for the device, which drops the allocation's own
reference. But drm_panel_add() had already taken its own reference
and linked panel->list into the global panel_list, and nothing
undoes that. The panel is left registered in panel_list pointing at
a device that failed to bind, where it can still be found and
dereferenced by later lookups/iterations such as
of_drm_find_panel() or find_panel_by_fwnode().

Call drm_panel_remove() when mipi_dsi_attach() fails, mirroring what
tdo_tl070wsh30_panel_remove() already does on the normal teardown
path, and matching the pattern used by other MIPI-DSI panel drivers
that pair a manual drm_panel_add() with mipi_dsi_attach().

Fixes: cf40c6600592 ("drm: panel: add TDO tl070wsh30 panel driver")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
 drivers/gpu/drm/panel/panel-tdo-tl070wsh30.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panel/panel-tdo-tl070wsh30.c b/drivers/gpu/drm/panel/panel-tdo-tl070wsh30.c
index fa961abdd2d7..32f2dd2bcee7 100644
--- a/drivers/gpu/drm/panel/panel-tdo-tl070wsh30.c
+++ b/drivers/gpu/drm/panel/panel-tdo-tl070wsh30.c
@@ -179,7 +179,11 @@ static int tdo_tl070wsh30_panel_probe(struct mipi_dsi_device *dsi)
 	if (err < 0)
 		return err;
 
-	return mipi_dsi_attach(dsi);
+	err = mipi_dsi_attach(dsi);
+	if (err < 0)
+		drm_panel_remove(&tdo_tl070wsh30->base);
+
+	return err;
 }
 
 static void tdo_tl070wsh30_panel_remove(struct mipi_dsi_device *dsi)
-- 
2.55.0

On 9/19/26 21:15, Muhammad Bilal wrote:
> tdo_tl070wsh30_panel_add() calls drm_panel_add() to link the panel
> into the global panel_list before tdo_tl070wsh30_panel_probe() calls
> mipi_dsi_attach(). The panel object itself is allocated with
> devm_drm_panel_alloc(), which only arranges for an automatic
> drm_panel_put() (via devm_add_action_or_reset()) when the DSI device
> is torn down; unlike devm_drm_panel_add(), it does not call
> drm_panel_remove() for you.
> 
> If mipi_dsi_attach() fails, probe() returns the error directly:
> 
> 	return mipi_dsi_attach(dsi);
> 
> Once probe() returns an error, the driver core releases devres
> resources for the device, which drops the allocation's own
> reference. But drm_panel_add() had already taken its own reference
> and linked panel->list into the global panel_list, and nothing
> undoes that. The panel is left registered in panel_list pointing at
> a device that failed to bind, where it can still be found and
> dereferenced by later lookups/iterations such as
> of_drm_find_panel() or find_panel_by_fwnode().
> 
> Call drm_panel_remove() when mipi_dsi_attach() fails, mirroring what
> tdo_tl070wsh30_panel_remove() already does on the normal teardown
> path, and matching the pattern used by other MIPI-DSI panel drivers
> that pair a manual drm_panel_add() with mipi_dsi_attach().
> 
> Fixes: cf40c6600592 ("drm: panel: add TDO tl070wsh30 panel driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
>   drivers/gpu/drm/panel/panel-tdo-tl070wsh30.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/panel/panel-tdo-tl070wsh30.c b/drivers/gpu/drm/panel/panel-tdo-tl070wsh30.c
> index fa961abdd2d7..32f2dd2bcee7 100644
> --- a/drivers/gpu/drm/panel/panel-tdo-tl070wsh30.c
> +++ b/drivers/gpu/drm/panel/panel-tdo-tl070wsh30.c
> @@ -179,7 +179,11 @@ static int tdo_tl070wsh30_panel_probe(struct mipi_dsi_device *dsi)
>   	if (err < 0)
>   		return err;
>   
> -	return mipi_dsi_attach(dsi);
> +	err = mipi_dsi_attach(dsi);
> +	if (err < 0)
> +		drm_panel_remove(&tdo_tl070wsh30->base);
> +
> +	return err;

Switch to devm_mipi_dsi_attach() instead.

Neil


>   }
>   
>   static void tdo_tl070wsh30_panel_remove(struct mipi_dsi_device *dsi)

Hi Neil,

Thanks, I've switched this to devm_mipi_dsi_attach() in v2.[1]

[1] https://lore.kernel.org/all/20260924195512.336690-1-meatuni001@gmail.com/

Regards,
Muhammad