[PATCH] drm/meson: Fix next_bridge reference leak in meson_encoder_dsi_probe()

[PATCH] drm/meson: Fix next_bridge reference leak in meson_encoder_dsi_probe()

[Wentao Liang]

The reference on the next bridge returned by
of_drm_find_and_get_bridge() is never released when
drm_simple_encoder_init() or drm_bridge_attach() fails. Drop it on
both error paths before returning.

Fixes: bfb8f5d0a9e7 ("drm/meson: encoder_dsi: get/put the next bridge")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/meson/meson_encoder_dsi.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/meson/meson_encoder_dsi.c b/drivers/gpu/drm/meson/meson_encoder_dsi.c
index eba246791c68..5f2eeeaf93b8 100644
--- a/drivers/gpu/drm/meson/meson_encoder_dsi.c
+++ b/drivers/gpu/drm/meson/meson_encoder_dsi.c
@@ -135,17 +135,21 @@ int meson_encoder_dsi_probe(struct meson_drm *priv)
 	/* Encoder */
 	ret = drm_simple_encoder_init(priv->drm, &meson_encoder_dsi->encoder,
 				      DRM_MODE_ENCODER_DSI);
-	if (ret)
+	if (ret) {
+		drm_bridge_put(meson_encoder_dsi->bridge.next_bridge);
 		return dev_err_probe(priv->dev, ret,
 				     "Failed to init DSI encoder\n");
+	}
 
 	meson_encoder_dsi->encoder.possible_crtcs = BIT(0);
 
 	/* Attach DSI Encoder Bridge to Encoder */
 	ret = drm_bridge_attach(&meson_encoder_dsi->encoder, &meson_encoder_dsi->bridge, NULL, 0);
-	if (ret)
+	if (ret) {
+		drm_bridge_put(meson_encoder_dsi->bridge.next_bridge);
 		return dev_err_probe(priv->dev, ret,
 				     "Failed to attach bridge\n");
+	}
 
 	/*
 	 * We should have now in place:
-- 
2.34.1


_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

Re: [PATCH] drm/meson: Fix next_bridge reference leak in meson_encoder_dsi_probe()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/meson: incorrect fix creates latent double-put of next_bridge
--

commit 3ff757ce4681fc8ee49157913542af343fd3e021
Author: Wentao Liang <vulab@iscas.ac.cn>

drm/meson: Fix next_bridge reference leak in meson_encoder_dsi_probe()

The commit attempts to fix a reference leak on the next bridge by manually
calling drm_bridge_put() on error paths when drm_simple_encoder_init()
or drm_bridge_attach() fails.

> diff --git a/drivers/gpu/drm/meson/meson_encoder_dsi.c b/drivers/gpu/drm/meson/meson_encoder_dsi.c
> index 3e422b612f74b..4367145d37753 100644
> --- a/drivers/gpu/drm/meson/meson_encoder_dsi.c
> +++ b/drivers/gpu/drm/meson/meson_encoder_dsi.c
> @@ -135,17 +135,21 @@ int meson_encoder_dsi_probe(struct meson_drm *priv)
>  	/* Encoder */
>  	ret = drm_simple_encoder_init(priv->drm, &meson_encoder_dsi->encoder,
>  				      DRM_MODE_ENCODER_DSI);
> -	if (ret)
> +	if (ret) {
> +		drm_bridge_put(meson_encoder_dsi->bridge.next_bridge);

[Severity: Medium]
Does this manual put incorrectly circumvent the bridge lifecycle API instead
of properly removing the main bridge?

The correct way to manage this reference is via the main bridge's lifecycle,
as __drm_bridge_free() automatically drops the next_bridge reference when the
main bridge is freed. Because the patch neglects to call drm_bridge_remove()
for the main bridge (which is why next_bridge was leaking in the first place),
the main bridge is left leaking in the global bridge_list.

If the main bridge leak is ever properly fixed in the future (e.g., by adding
drm_bridge_remove() or using devm_drm_bridge_add()), the manual
drm_bridge_put() introduced here will result in a double-put and
use-after-free.

>  		return dev_err_probe(priv->dev, ret,
>  				     "Failed to init DSI encoder\n");
> +	}
>  
>  	meson_encoder_dsi->encoder.possible_crtcs = BIT(0);
>  
>  	/* Attach DSI Encoder Bridge to Encoder */
>  	ret = drm_bridge_attach(&meson_encoder_dsi->encoder, &meson_encoder_dsi->bridge, NULL, 0);
> -	if (ret)
> +	if (ret) {
> +		drm_bridge_put(meson_encoder_dsi->bridge.next_bridge);

[Severity: Medium]
Can this second manual cleanup also act as a latent double-put trap?

This applies the same incorrect manual cleanup on the second error path.

>  		return dev_err_probe(priv->dev, ret,
>  				     "Failed to attach bridge\n");
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916174543.2089062-1-vulab@iscas.ac.cn?part=1

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic