diff mbox series

drm/bridge: properly refcount DT nodes in aux bridge drivers

Message ID 20231216235910.911958-1-dmitry.baryshkov@linaro.org (mailing list archive)
State New, archived
Headers show
Series drm/bridge: properly refcount DT nodes in aux bridge drivers | expand

Commit Message

Dmitry Baryshkov Dec. 16, 2023, 11:59 p.m. UTC
The aux-bridge and aux-hpd-bridge drivers didn't call of_node_get() on
the device nodes further used for dev->of_node and platform data. When
bridge devices are released, the reference counts are decreased,
resulting in refcount underflow / use-after-free warnings. Get
corresponding refcounts during AUX bridge allocation.

Reported-by: Luca Weiss <luca.weiss@fairphone.com>
Fixes: 2a04739139b2 ("drm/bridge: add transparent bridge helper")
Fixes: 26f4bac3d884 ("drm/bridge: aux-hpd: Replace of_device.h with explicit include")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
---
 drivers/gpu/drm/bridge/aux-bridge.c     | 2 +-
 drivers/gpu/drm/bridge/aux-hpd-bridge.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

Comments

Neil Armstrong Dec. 18, 2023, 8:21 a.m. UTC | #1
On 17/12/2023 00:59, Dmitry Baryshkov wrote:
> The aux-bridge and aux-hpd-bridge drivers didn't call of_node_get() on
> the device nodes further used for dev->of_node and platform data. When
> bridge devices are released, the reference counts are decreased,
> resulting in refcount underflow / use-after-free warnings. Get
> corresponding refcounts during AUX bridge allocation.
> 
> Reported-by: Luca Weiss <luca.weiss@fairphone.com>
> Fixes: 2a04739139b2 ("drm/bridge: add transparent bridge helper")
> Fixes: 26f4bac3d884 ("drm/bridge: aux-hpd: Replace of_device.h with explicit include")
> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> ---
>   drivers/gpu/drm/bridge/aux-bridge.c     | 2 +-
>   drivers/gpu/drm/bridge/aux-hpd-bridge.c | 4 ++--
>   2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/bridge/aux-bridge.c b/drivers/gpu/drm/bridge/aux-bridge.c
> index 49d7c2ab1ecc..54d721db0ea6 100644
> --- a/drivers/gpu/drm/bridge/aux-bridge.c
> +++ b/drivers/gpu/drm/bridge/aux-bridge.c
> @@ -57,7 +57,7 @@ int drm_aux_bridge_register(struct device *parent)
>   	adev->id = ret;
>   	adev->name = "aux_bridge";
>   	adev->dev.parent = parent;
> -	adev->dev.of_node = parent->of_node;
> +	adev->dev.of_node = of_node_get(parent->of_node);
>   	adev->dev.release = drm_aux_bridge_release;
>   
>   	ret = auxiliary_device_init(adev);
> diff --git a/drivers/gpu/drm/bridge/aux-hpd-bridge.c b/drivers/gpu/drm/bridge/aux-hpd-bridge.c
> index 1999a053d59b..bb55f697a181 100644
> --- a/drivers/gpu/drm/bridge/aux-hpd-bridge.c
> +++ b/drivers/gpu/drm/bridge/aux-hpd-bridge.c
> @@ -68,9 +68,9 @@ struct device *drm_dp_hpd_bridge_register(struct device *parent,
>   	adev->id = ret;
>   	adev->name = "dp_hpd_bridge";
>   	adev->dev.parent = parent;
> -	adev->dev.of_node = parent->of_node;
> +	adev->dev.of_node = of_node_get(parent->of_node);
>   	adev->dev.release = drm_aux_hpd_bridge_release;
> -	adev->dev.platform_data = np;
> +	adev->dev.platform_data = of_node_get(np);
>   
>   	ret = auxiliary_device_init(adev);
>   	if (ret) {

Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
diff mbox series

Patch

diff --git a/drivers/gpu/drm/bridge/aux-bridge.c b/drivers/gpu/drm/bridge/aux-bridge.c
index 49d7c2ab1ecc..54d721db0ea6 100644
--- a/drivers/gpu/drm/bridge/aux-bridge.c
+++ b/drivers/gpu/drm/bridge/aux-bridge.c
@@ -57,7 +57,7 @@  int drm_aux_bridge_register(struct device *parent)
 	adev->id = ret;
 	adev->name = "aux_bridge";
 	adev->dev.parent = parent;
-	adev->dev.of_node = parent->of_node;
+	adev->dev.of_node = of_node_get(parent->of_node);
 	adev->dev.release = drm_aux_bridge_release;
 
 	ret = auxiliary_device_init(adev);
diff --git a/drivers/gpu/drm/bridge/aux-hpd-bridge.c b/drivers/gpu/drm/bridge/aux-hpd-bridge.c
index 1999a053d59b..bb55f697a181 100644
--- a/drivers/gpu/drm/bridge/aux-hpd-bridge.c
+++ b/drivers/gpu/drm/bridge/aux-hpd-bridge.c
@@ -68,9 +68,9 @@  struct device *drm_dp_hpd_bridge_register(struct device *parent,
 	adev->id = ret;
 	adev->name = "dp_hpd_bridge";
 	adev->dev.parent = parent;
-	adev->dev.of_node = parent->of_node;
+	adev->dev.of_node = of_node_get(parent->of_node);
 	adev->dev.release = drm_aux_hpd_bridge_release;
-	adev->dev.platform_data = np;
+	adev->dev.platform_data = of_node_get(np);
 
 	ret = auxiliary_device_init(adev);
 	if (ret) {