From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: drm/logicvc: Avoid use-after-free with devm_kzalloc()
Date: Thu, 04 Jun 2026 14:34:10 +1000 [thread overview]
Message-ID: <review-overall-20260601-logicvc-uaf-v1-1-8c9ca5b3429c@bootlin.com> (raw)
In-Reply-To: <20260601-logicvc-uaf-v1-1-8c9ca5b3429c@bootlin.com>
Overall Series Review
Subject: drm/logicvc: Avoid use-after-free with devm_kzalloc()
Author: Romain Gantois <romain.gantois@bootlin.com>
Patches: 2
Reviewed: 2026-06-04T14:34:10.308240
---
This is a single well-motivated patch converting the logicvc driver from `devm_kzalloc`-based allocation to DRM-managed (`drmm_*`) allocation for planes, CRTCs, encoders, and connectors. The core problem is real and well-understood: `devm`-managed structs can be freed before the DRM core is done with them (device unbind frees `devm` resources, but userspace may still hold DRM file handles), leading to use-after-free. The author confirms this was observed via KASAN on v6.6.
The approach is correct and follows the standard pattern that many other DRM drivers have adopted. The API usage is verified correct against the kernel headers. Error handling simplification is appropriate since `drmm_*` resources are automatically cleaned up on DRM device release.
**Verdict: Patch looks good.** A couple of minor style nits below, nothing blocking.
---
---
Generated by Claude Code Patch Reviewer
prev parent reply other threads:[~2026-06-04 4:34 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-01 6:52 [PATCH] drm/logicvc: Avoid use-after-free with devm_kzalloc() Romain Gantois
2026-06-01 7:11 ` Maxime Ripard
2026-06-04 4:34 ` Claude review: " Claude Code Review Bot
2026-06-04 4:34 ` Claude Code Review Bot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=review-overall-20260601-logicvc-uaf-v1-1-8c9ca5b3429c@bootlin.com \
--to=claude-review@example.com \
--cc=dri-devel-reviews@example.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox