From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E1A7C36E497 for ; Tue, 7 Jul 2026 15:03:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783436616; cv=none; b=btwKgPU+VSvX2jbmhLNeUTc+O12mGkylp0SfWOCY7Tr1BKkW1rq1Z+QsYXPwFG7HBG1YoY6Wwr4/D+U2OLwp5cHoK3GcyO6nl8Q07KHp+haD0wIMVddY0yVEHYkabKoSuR0Hr6ndHFSattohBEzrXHDG2lZo6mA+NVEfqLEm4AQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783436616; c=relaxed/simple; bh=WIvJ/zjcMo6mUW9sI3RPnc0QUrY+/Xv0ltvp3NGiIxo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=PV8KydhWLMabLQebTcdj84VbKqjuCKO3cZ3nJVxm6ubBQeXwRA8f8GR7V0RVFFVql1J3xSBtT87n1h8vH77Ntx9WeLghmdrjz069OMCjnuifNldK4P5TEeZ8WgQnubvU0RfsMBET+SxYIqHlza/A1GrtcGoTqooaB1ZDXUo8pKg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Bwvco/+D; arc=none smtp.client-ip=209.85.210.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Bwvco/+D" Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-847a483e344so968730b3a.0 for ; Tue, 07 Jul 2026 08:03:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783436614; x=1784041414; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=7Yuz6fHmdCtAYz8Y8qNJQTbNofhSYgvmngc/Kl/kwUc=; b=Bwvco/+DxxmC+3h8w55uzrDiGcY2VeklYoVuJMFbvSPQa3nSbAwpWGRAJWVZPQAGhQ BCJILZ2LM8K7PAs9/TeVNj/F2+JgGuo85nnYtrATTFhL5Fk1mNhE2YVvU3CiInOvrT6k /a/nkO6sF1Y3Fc9/E2/Gi6cRSdlnsnTHiw83KyLu7eibMQ/aQNgLMvn48HbmdCZwDSfy M/SEyBXsW4yn0tBX64pE+fNRi9HvOZgaNAUyN/3YyXpwOJyTMf8LHj6cn1Gf4aBAKjwn cO4XTddiAic8bUP6brh6GjepZWexBUJjnpYru7XHtXcIhDUCIZZOtMHCVgEC1H8HvnvL xgzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783436614; x=1784041414; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=7Yuz6fHmdCtAYz8Y8qNJQTbNofhSYgvmngc/Kl/kwUc=; b=SzBfIRxRb9PHW8Pm5t7tDEES65s6UjLpeXLl8W94qsUsM8mXbAYiailmbH75CBmG/f hOAG0hE9EnWoCBg7/kMVhkfFASU7lUB1ebPouGzeyCUlFcZJxEIdR2BsVHYvzEYP6P9N M0YRu6wkX/jptbSb8RB9j2oc7WHw2pv2aWDOHorERQGzyF5UB8wGP1VgtxeRvWu0IBbs pcn5gZ+/fgT94K0nVjUXw/1fjRNYJPT1MML1MCge4vtY1g8Naa1cFHOdr94lR99tLaED 6QgvLU9innFYL6bQM6lEwrs3YAHxz1ArjBHMNvT3M9Hr5Xh1Vc99hnUWoiiTjfrJBOT1 U83g== X-Forwarded-Encrypted: i=1; AHgh+RpFio09SeutWsmeqp30iNEMCSV7fX2g5sHxV54srUE5+jVcUM9f5mio4UKuRUXjRaTMBfsMpa+TZvrFLd0=@vger.kernel.org X-Gm-Message-State: AOJu0YxDo41xDaAGa/dWRF8kx7UCnZI0Pn9R3pdXv5k55Aw1IXRJDNY4 mZfd8XXlv3uXt1pCziaY1j5RZ5Mj1y4NVHAkE3KdeJbSl8NjbfQ+xo9I X-Gm-Gg: AfdE7ckb0KsMCg5Q9Lk2LWvUxfa6vV3rd7NKBiWHHb4vUU7pVx2jpfYW4VHlZJR+tdB BzxNlh6fhkLoNwkEhp2FKL/dr4l2D9VLVv+gVd99nl8Hxb7OtKMd0Pxp8YoMNdIClCtIzxepRp/ F03KWTa35sR2riDN/XdTdGReNmCM8cCz3uPWlN6mCF7X2I0XIfY9JBy3Bw2ZhK92XVB8ZF4t2gE VVO3vC2rF8PVqn3LXk5kK2dH7pCqgjjoN22fjANSpEAuJO1X/vOmj9Hnt+CDNAEoULP6MPktOyC UFgFwLCl7dEpD+Gcn5PJotXwL6vGkuaI9cty9zaJ30MoHSBM7IrAam1Ji5xxHrrkwzZR+EBq69M boFwVfrIpUBWLRlpGfNtBuIqihWMSuYLm/zoFsBwwINhUSgZBdZ+xK2urJQl873jGnLprgY2GJw IsvPRu/Or2rhutQp/zXKn4tQ6gOKN4aF4ym1jBFVax/Sz3 X-Received: by 2002:a05:6a00:844:b0:847:e2e4:a36b with SMTP id d2e1a72fcca58-8482f4ba9fcmr2733557b3a.19.1783436613808; Tue, 07 Jul 2026 08:03:33 -0700 (PDT) Received: from Alvin.tail8ccd9a.ts.net ([49.216.173.166]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-847f6dd3bd3sm5604773b3a.58.2026.07.07.08.03.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2026 08:03:33 -0700 (PDT) From: Hao-Qun Huang To: Luca Ceresoli , Thierry Reding , Jonathan Hunter , Sowjanya Komatineni Cc: Mauro Carvalho Chehab , Hans Verkuil , Greg Kroah-Hartman , Dmitry Osipenko , linux-media@vger.kernel.org, linux-tegra@vger.kernel.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Hao-Qun Huang Subject: [PATCH] staging: media: tegra-video: fix of_node_put() on VIP parse errors Date: Tue, 7 Jul 2026 23:03:26 +0800 Message-ID: <20260707150326.554689-1-alvinhuang0603@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit tegra_vip_channel_of_parse() initializes np from dev->of_node without taking a reference, but its error paths drop one through the err_node_put label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree. The only reference the function takes on np is the success-path of_node_get() stored in vip->chan.of_node, and that one is already released by the tegra_vip_init() error path and by tegra_vip_exit(). Return errors directly instead of jumping to the bogus cleanup label. Fixes: e740d199cf0f ("staging: media: tegra-video: add support for Tegra20 parallel input") Assisted-by: Claude:claude-fable-5 Signed-off-by: Hao-Qun Huang --- diff --git a/drivers/staging/media/tegra-video/vip.c b/drivers/staging/media/tegra-video/vip.c index 9ff1f1750a15..5fba11e31e1d 100644 --- a/drivers/staging/media/tegra-video/vip.c +++ b/drivers/staging/media/tegra-video/vip.c @@ -126,7 +126,7 @@ static int tegra_vip_channel_of_parse(struct tegra_vip *vip) if (!ep) { err = -EINVAL; dev_err_probe(dev, err, "%pOF: error getting endpoint node\n", np); - goto err_node_put; + return err; } fwh = of_fwnode_handle(ep); @@ -134,14 +134,14 @@ static int tegra_vip_channel_of_parse(struct tegra_vip *vip) of_node_put(ep); if (err) { dev_err_probe(dev, err, "%pOF: failed to parse v4l2 endpoint\n", np); - goto err_node_put; + return err; } num_pads = of_graph_get_endpoint_count(np); if (num_pads != TEGRA_VIP_PADS_NUM) { err = -EINVAL; dev_err_probe(dev, err, "%pOF: need 2 pads, got %d\n", np, num_pads); - goto err_node_put; + return err; } vip->chan.of_node = of_node_get(np); @@ -149,10 +149,6 @@ static int tegra_vip_channel_of_parse(struct tegra_vip *vip) vip->chan.pads[TEGRA_VIP_PAD_SOURCE].flags = MEDIA_PAD_FL_SOURCE; return 0; - -err_node_put: - of_node_put(np); - return err; } static int tegra_vip_channel_init(struct tegra_vip *vip)