Re: [PATCH] drm/meson: fix device_node leak in meson_encoder_dsi_probe()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing drm_bridge_remove() on error paths after drm_bridge_add() leaves the bridge permanently leaked and attached to the global bridge_list.
--

commit 314776e79a61e3245fd41353a7a8e22de95afc63
Author: Miles Krause <mileskrause5200@gmail.com>

drm/meson: fix device_node leak in meson_encoder_dsi_probe()

This commit fixes a device_node leak in meson_encoder_dsi_probe() by
dropping the reference to the remote node after acquiring the bridge.

> diff --git a/drivers/gpu/drm/meson/meson_encoder_dsi.c b/drivers/gpu/drm/meson/meson_encoder_dsi.c
> --- a/drivers/gpu/drm/meson/meson_encoder_dsi.c
> +++ b/drivers/gpu/drm/meson/meson_encoder_dsi.c
> @@ -120,6 +120,7 @@ int meson_encoder_dsi_probe(struct meson_drm *priv)
>  	}
>  
>  	meson_encoder_dsi->bridge.next_bridge = of_drm_find_and_get_bridge(remote);
> +	of_node_put(remote);
>  	if (!meson_encoder_dsi->bridge.next_bridge)
>  		return dev_err_probe(priv->dev, -EPROBE_DEFER,
>  				     "Failed to find DSI transceiver bridge\n");

[Severity: High]
This is a pre-existing issue, but since you are fixing leaks in this probe
function, could we also address a bridge leak further down in
meson_encoder_dsi_probe()?

When drm_bridge_add() is called, it adds the bridge to the global bridge_list
and increments its refcount. If a subsequent initialization step fails, such
as drm_simple_encoder_init() returning an error:

    drm_bridge_add(&meson_encoder_dsi->bridge);

    meson_encoder_dsi->priv = priv;

    ret = drm_simple_encoder_init(priv->drm, &meson_encoder_dsi->encoder,
                                  DRM_MODE_ENCODER_DSI);
    if (ret)
        return dev_err_probe(priv->dev, ret,
                             "Failed to init DSI encoder\n");

Does this error path return directly without calling drm_bridge_remove()?

Because the devres cleanup for devm_drm_bridge_alloc only drops the refcount
by 1, the bridge remains attached to the list and memory is never freed. If
the module is unloaded, traversing the list later could oops because the
bridge function pointers will point to freed module text.

This same missing drm_bridge_remove() pattern also exists on the error paths
after drm_bridge_add() in meson_encoder_hdmi_probe() in meson_encoder_hdmi.c
and meson_encoder_cvbs_probe() in meson_encoder_cvbs.c.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260906-meson-dsi-of-node-leak-v1-1-9d183560279d@gmail.com?part=1

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic