[PATCH] drm/meson: fix device_node leak in meson_encoder_dsi_probe()

[PATCH] drm/meson: fix device_node leak in meson_encoder_dsi_probe()

[Miles Krause via B4 Relay]

From: Miles Krause <mileskrause5200@gmail.com>

meson_encoder_dsi_probe() looks up the DSI transceiver's device node
with of_graph_get_remote_node() and hands it to
of_drm_find_and_get_bridge(), but never drops the reference that the
lookup returned.

of_graph_get_remote_node() returns the node with its refcount
incremented, and of_drm_find_and_get_bridge() takes its own reference
on the bridge it finds, so 'remote' is leaked on every path once the
lookup succeeds: on the -EPROBE_DEFER return taken when no bridge is
found, and on a fully successful probe alike.

The two sibling encoders in this driver already handle this correctly.
meson_encoder_cvbs_probe() calls of_node_put(remote) immediately after
of_drm_find_and_get_bridge(), and meson_encoder_hdmi_probe() releases
the node both on its error path and after of_find_device_by_node().

Release the reference in the same place meson_encoder_cvbs_probe()
does, which covers both the error and the success path.

Fixes: 42dcf15f901c ("drm/meson: add DSI encoder")
Signed-off-by: Miles Krause <mileskrause5200@gmail.com>
---
 drivers/gpu/drm/meson/meson_encoder_dsi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/meson/meson_encoder_dsi.c b/drivers/gpu/drm/meson/meson_encoder_dsi.c
index 3e422b612f74..3fe604496294 100644
--- a/drivers/gpu/drm/meson/meson_encoder_dsi.c
+++ b/drivers/gpu/drm/meson/meson_encoder_dsi.c
@@ -120,6 +120,7 @@ int meson_encoder_dsi_probe(struct meson_drm *priv)
 	}
 
 	meson_encoder_dsi->bridge.next_bridge = of_drm_find_and_get_bridge(remote);
+	of_node_put(remote);
 	if (!meson_encoder_dsi->bridge.next_bridge)
 		return dev_err_probe(priv->dev, -EPROBE_DEFER,
 				     "Failed to find DSI transceiver bridge\n");

---
base-commit: 88405f0ad1d5c680afe3ea0ce9345fa9e1deaac8
change-id: 20260906-meson-dsi-of-node-leak-744899da5712

Best regards,
-- 
Miles Krause <mileskrause5200@gmail.com>



_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

Re: [PATCH] drm/meson: fix device_node leak in meson_encoder_dsi_probe()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing drm_bridge_remove() on error paths after drm_bridge_add() leaves the bridge permanently leaked and attached to the global bridge_list.
--

commit 314776e79a61e3245fd41353a7a8e22de95afc63
Author: Miles Krause <mileskrause5200@gmail.com>

drm/meson: fix device_node leak in meson_encoder_dsi_probe()

This commit fixes a device_node leak in meson_encoder_dsi_probe() by
dropping the reference to the remote node after acquiring the bridge.

> diff --git a/drivers/gpu/drm/meson/meson_encoder_dsi.c b/drivers/gpu/drm/meson/meson_encoder_dsi.c
> --- a/drivers/gpu/drm/meson/meson_encoder_dsi.c
> +++ b/drivers/gpu/drm/meson/meson_encoder_dsi.c
> @@ -120,6 +120,7 @@ int meson_encoder_dsi_probe(struct meson_drm *priv)
>  	}
>  
>  	meson_encoder_dsi->bridge.next_bridge = of_drm_find_and_get_bridge(remote);
> +	of_node_put(remote);
>  	if (!meson_encoder_dsi->bridge.next_bridge)
>  		return dev_err_probe(priv->dev, -EPROBE_DEFER,
>  				     "Failed to find DSI transceiver bridge\n");

[Severity: High]
This is a pre-existing issue, but since you are fixing leaks in this probe
function, could we also address a bridge leak further down in
meson_encoder_dsi_probe()?

When drm_bridge_add() is called, it adds the bridge to the global bridge_list
and increments its refcount. If a subsequent initialization step fails, such
as drm_simple_encoder_init() returning an error:

    drm_bridge_add(&meson_encoder_dsi->bridge);

    meson_encoder_dsi->priv = priv;

    ret = drm_simple_encoder_init(priv->drm, &meson_encoder_dsi->encoder,
                                  DRM_MODE_ENCODER_DSI);
    if (ret)
        return dev_err_probe(priv->dev, ret,
                             "Failed to init DSI encoder\n");

Does this error path return directly without calling drm_bridge_remove()?

Because the devres cleanup for devm_drm_bridge_alloc only drops the refcount
by 1, the bridge remains attached to the list and memory is never freed. If
the module is unloaded, traversing the list later could oops because the
bridge function pointers will point to freed module text.

This same missing drm_bridge_remove() pattern also exists on the error paths
after drm_bridge_add() in meson_encoder_hdmi_probe() in meson_encoder_hdmi.c
and meson_encoder_cvbs_probe() in meson_encoder_cvbs.c.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260906-meson-dsi-of-node-leak-v1-1-9d183560279d@gmail.com?part=1

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

Re: [PATCH] drm/meson: fix device_node leak in meson_encoder_dsi_probe()

[Neil Armstrong]

On 9/6/26 21:43, Miles Krause via B4 Relay wrote:
> From: Miles Krause <mileskrause5200@gmail.com>
> 
> meson_encoder_dsi_probe() looks up the DSI transceiver's device node
> with of_graph_get_remote_node() and hands it to
> of_drm_find_and_get_bridge(), but never drops the reference that the
> lookup returned.
> 
> of_graph_get_remote_node() returns the node with its refcount
> incremented, and of_drm_find_and_get_bridge() takes its own reference
> on the bridge it finds, so 'remote' is leaked on every path once the
> lookup succeeds: on the -EPROBE_DEFER return taken when no bridge is
> found, and on a fully successful probe alike.
> 
> The two sibling encoders in this driver already handle this correctly.
> meson_encoder_cvbs_probe() calls of_node_put(remote) immediately after
> of_drm_find_and_get_bridge(), and meson_encoder_hdmi_probe() releases
> the node both on its error path and after of_find_device_by_node().
> 
> Release the reference in the same place meson_encoder_cvbs_probe()
> does, which covers both the error and the success path.
> 
> Fixes: 42dcf15f901c ("drm/meson: add DSI encoder")
> Signed-off-by: Miles Krause <mileskrause5200@gmail.com>
> ---
>   drivers/gpu/drm/meson/meson_encoder_dsi.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/gpu/drm/meson/meson_encoder_dsi.c b/drivers/gpu/drm/meson/meson_encoder_dsi.c
> index 3e422b612f74..3fe604496294 100644
> --- a/drivers/gpu/drm/meson/meson_encoder_dsi.c
> +++ b/drivers/gpu/drm/meson/meson_encoder_dsi.c
> @@ -120,6 +120,7 @@ int meson_encoder_dsi_probe(struct meson_drm *priv)
>   	}
>   
>   	meson_encoder_dsi->bridge.next_bridge = of_drm_find_and_get_bridge(remote);
> +	of_node_put(remote);
>   	if (!meson_encoder_dsi->bridge.next_bridge)
>   		return dev_err_probe(priv->dev, -EPROBE_DEFER,
>   				     "Failed to find DSI transceiver bridge\n");
> 
> ---
> base-commit: 88405f0ad1d5c680afe3ea0ce9345fa9e1deaac8
> change-id: 20260906-meson-dsi-of-node-leak-744899da5712
> 
> Best regards,

Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>

Thanks,
Neil

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic