| Message ID | 20231216235910.911958-1-dmitry.baryshkov@linaro.org (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | drm/bridge: properly refcount DT nodes in aux bridge drivers | expand |
On 17/12/2023 00:59, Dmitry Baryshkov wrote: > The aux-bridge and aux-hpd-bridge drivers didn't call of_node_get() on > the device nodes further used for dev->of_node and platform data. When > bridge devices are released, the reference counts are decreased, > resulting in refcount underflow / use-after-free warnings. Get > corresponding refcounts during AUX bridge allocation. > > Reported-by: Luca Weiss <luca.weiss@fairphone.com> > Fixes: 2a04739139b2 ("drm/bridge: add transparent bridge helper") > Fixes: 26f4bac3d884 ("drm/bridge: aux-hpd: Replace of_device.h with explicit include") > Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> > --- > drivers/gpu/drm/bridge/aux-bridge.c | 2 +- > drivers/gpu/drm/bridge/aux-hpd-bridge.c | 4 ++-- > 2 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/bridge/aux-bridge.c b/drivers/gpu/drm/bridge/aux-bridge.c > index 49d7c2ab1ecc..54d721db0ea6 100644 > --- a/drivers/gpu/drm/bridge/aux-bridge.c > +++ b/drivers/gpu/drm/bridge/aux-bridge.c > @@ -57,7 +57,7 @@ int drm_aux_bridge_register(struct device *parent) > adev->id = ret; > adev->name = "aux_bridge"; > adev->dev.parent = parent; > - adev->dev.of_node = parent->of_node; > + adev->dev.of_node = of_node_get(parent->of_node); > adev->dev.release = drm_aux_bridge_release; > > ret = auxiliary_device_init(adev); > diff --git a/drivers/gpu/drm/bridge/aux-hpd-bridge.c b/drivers/gpu/drm/bridge/aux-hpd-bridge.c > index 1999a053d59b..bb55f697a181 100644 > --- a/drivers/gpu/drm/bridge/aux-hpd-bridge.c > +++ b/drivers/gpu/drm/bridge/aux-hpd-bridge.c > @@ -68,9 +68,9 @@ struct device *drm_dp_hpd_bridge_register(struct device *parent, > adev->id = ret; > adev->name = "dp_hpd_bridge"; > adev->dev.parent = parent; > - adev->dev.of_node = parent->of_node; > + adev->dev.of_node = of_node_get(parent->of_node); > adev->dev.release = drm_aux_hpd_bridge_release; > - adev->dev.platform_data = np; > + adev->dev.platform_data = of_node_get(np); > > ret = auxiliary_device_init(adev); > if (ret) { Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
diff --git a/drivers/gpu/drm/bridge/aux-bridge.c b/drivers/gpu/drm/bridge/aux-bridge.c index 49d7c2ab1ecc..54d721db0ea6 100644 --- a/drivers/gpu/drm/bridge/aux-bridge.c +++ b/drivers/gpu/drm/bridge/aux-bridge.c @@ -57,7 +57,7 @@ int drm_aux_bridge_register(struct device *parent) adev->id = ret; adev->name = "aux_bridge"; adev->dev.parent = parent; - adev->dev.of_node = parent->of_node; + adev->dev.of_node = of_node_get(parent->of_node); adev->dev.release = drm_aux_bridge_release; ret = auxiliary_device_init(adev); diff --git a/drivers/gpu/drm/bridge/aux-hpd-bridge.c b/drivers/gpu/drm/bridge/aux-hpd-bridge.c index 1999a053d59b..bb55f697a181 100644 --- a/drivers/gpu/drm/bridge/aux-hpd-bridge.c +++ b/drivers/gpu/drm/bridge/aux-hpd-bridge.c @@ -68,9 +68,9 @@ struct device *drm_dp_hpd_bridge_register(struct device *parent, adev->id = ret; adev->name = "dp_hpd_bridge"; adev->dev.parent = parent; - adev->dev.of_node = parent->of_node; + adev->dev.of_node = of_node_get(parent->of_node); adev->dev.release = drm_aux_hpd_bridge_release; - adev->dev.platform_data = np; + adev->dev.platform_data = of_node_get(np); ret = auxiliary_device_init(adev); if (ret) {
The aux-bridge and aux-hpd-bridge drivers didn't call of_node_get() on the device nodes further used for dev->of_node and platform data. When bridge devices are released, the reference counts are decreased, resulting in refcount underflow / use-after-free warnings. Get corresponding refcounts during AUX bridge allocation. Reported-by: Luca Weiss <luca.weiss@fairphone.com> Fixes: 2a04739139b2 ("drm/bridge: add transparent bridge helper") Fixes: 26f4bac3d884 ("drm/bridge: aux-hpd: Replace of_device.h with explicit include") Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> --- drivers/gpu/drm/bridge/aux-bridge.c | 2 +- drivers/gpu/drm/bridge/aux-hpd-bridge.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)