Re: [PATCH] drm/panel: novatek-nt36536: Fix panel double-remove on attach failure

[Neil Armstrong]

Hi,

On Fri, 24 Jul 2026 05:17:46 +0100, David Carlier wrote:
> The DSI attach error path calls drm_panel_remove() by hand even though
> the panel was registered with devm_drm_panel_add(), which already
> arranges for drm_panel_remove() to run on driver detach. When
> mipi_dsi_attach() fails the panel is therefore removed twice: once
> directly and once again while devres unwinds.
> 
> drm_panel_add() takes a reference and drm_panel_remove() drops one, so
> the extra removal releases the last reference early and frees the panel
> container. The put registered by devm_drm_panel_alloc() then operates on
> freed memory, resulting in a use-after-free and a reference-count
> underflow when a DSI host rejects the requested configuration during
> probe.
> 
> [...]

Thanks, Applied to https://gitlab.freedesktop.org/drm/misc/kernel.git (drm-misc-next)

[1/1] drm/panel: novatek-nt36536: Fix panel double-remove on attach failure
      https://gitlab.freedesktop.org/drm/misc/kernel/-/commit/4085da1e6ad90ca7a227d8528de2c77042fabf8a

-- 
Neil