* [PATCH] fix: drm/hisilicon: kirin_drm_crtc_init: premature of_node_put leaves crtc->port as dangling pointer
@ 2026-06-26 13:19 ` WenTao Liang
0 siblings, 0 replies; 4+ messages in thread
From: WenTao Liang @ 2026-06-26 13:19 UTC (permalink / raw)
To: xinliang.liu, maarten.lankhorst, mripard, tzimmermann, airlied,
simona
Cc: sumit.semwal, yongqin.liu, jstultz, dri-devel, linux-kernel,
WenTao Liang, stable
of_get_child_by_name acquires a reference on the port node, but
of_node_put is called before crtc->port is assigned. This releases the
reference while crtc->port still holds the pointer for later use by
drm_of_find_possible_crtcs. Fix by moving of_node_put after crtc->port
assignment.
Cc: stable@vger.kernel.org
Fixes: 89a565dba1a0 ("drm: kirin: Move ade drm init to kirin drm drv")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c
index 8a11c2df5b88..cc453b29b22c 100644
--- a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c
+++ b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c
@@ -53,8 +53,8 @@ static int kirin_drm_crtc_init(struct drm_device *dev, struct drm_crtc *crtc,
DRM_ERROR("no port node found in %pOF\n", dev->dev->of_node);
return -EINVAL;
}
- of_node_put(port);
crtc->port = port;
+ of_node_put(port);
ret = drm_crtc_init_with_planes(dev, crtc, plane, NULL,
driver_data->crtc_funcs, NULL);
--
2.39.5 (Apple Git-154)
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] fix: drm/hisilicon: kirin_drm_crtc_init: premature of_node_put leaves crtc->port as dangling pointer
2026-06-26 13:19 ` WenTao Liang
(?)
@ 2026-06-26 13:30 ` sashiko-bot
-1 siblings, 0 replies; 4+ messages in thread
From: sashiko-bot @ 2026-06-26 13:30 UTC (permalink / raw)
To: WenTao Liang; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
New issues:
- [Medium] Ineffective fix and misunderstanding of C pointer lifetime in `kirin_drm_crtc_init`.
Pre-existing issues:
- [High] NULL pointer dereference when shared IRQ triggers before CRTC initialization completes.
- [High] Resource leaks and permanent driver breakage due to `devm_*` misuse in component `bind`.
--
commit 5e60641f8f98c64d6ba73a1036397dc68df8729a
Author: WenTao Liang <vulab@iscas.ac.cn>
fix: drm/hisilicon: kirin_drm_crtc_init: premature of_node_put leaves crtc->port as dangling pointer
This commit attempts to fix a dangling pointer by moving the of_node_put()
call after the crtc->port assignment in kirin_drm_crtc_init().
> diff --git a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c
> index 8a11c2df5b886..cc453b29b22c3 100644
> --- a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c
> +++ b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c
> @@ -53,8 +53,8 @@ static int kirin_drm_crtc_init(struct drm_device *dev, struct drm_crtc *crtc,
> DRM_ERROR("no port node found in %pOF\n", dev->dev->of_node);
> return -EINVAL;
> }
> - of_node_put(port);
> crtc->port = port;
> + of_node_put(port);
[Severity: Medium]
Does moving this of_node_put() actually change the pointer lifetime? Since
assigning crtc->port = port only copies the address without incrementing the
reference count, it seems the pointer is just as dangling as it was before.
>
> ret = drm_crtc_init_with_planes(dev, crtc, plane, NULL,
[Severity: High]
This is a pre-existing issue, but can ade_irq_handler() trigger a NULL
pointer dereference if a shared interrupt fires early?
In drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c:ade_hw_ctx_alloc(),
the IRQ is registered with IRQF_SHARED before the CRTC is initialized:
ret = devm_request_irq(dev, ctx->irq, ade_irq_handler,
IRQF_SHARED, dev->driver->name, ctx);
At this point, crtc->dev is still NULL until drm_crtc_init_with_planes() is
called later. If a shared interrupt fires or is left asserted by the
bootloader, ade_irq_handler() calls drm_crtc_handle_vblank(crtc), which
dereferences crtc->dev.
[Severity: High]
This is also a pre-existing issue, but does using dev-managed allocators
inside a component bind callback cause resource leaks on unbind?
In drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c:ade_hw_ctx_alloc(),
which is called from the component bind path (kirin_drm_bind), resources
are allocated using devm_platform_ioremap_resource() and other devm_* APIs.
When the component is unbound, the master device is not removed, so devm
does not release these resources. Rebinding will execute ade_hw_ctx_alloc()
again, leaking memory, duplicating the IRQ handler, and causing ioremap to
fail with -EBUSY.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260626131942.38072-1-vulab@iscas.ac.cn?part=1
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] fix: drm/hisilicon: kirin_drm_crtc_init: premature of_node_put leaves crtc->port as dangling pointer
2026-06-26 13:19 ` WenTao Liang
(?)
(?)
@ 2026-06-28 3:55 ` WenTao Liang
-1 siblings, 0 replies; 4+ messages in thread
From: WenTao Liang @ 2026-06-28 3:55 UTC (permalink / raw)
To: xinliang.liu, maarten.lankhorst, mripard, tzimmermann, airlied,
simona
Cc: sumit.semwal, yongqin.liu, jstultz, dri-devel, linux-kernel,
stable
> 2026年6月26日 21:19，WenTao Liang <vulab@iscas.ac.cn> 写道：
>
> of_get_child_by_name acquires a reference on the port node, but
> of_node_put is called before crtc->port is assigned. This releases the
> reference while crtc->port still holds the pointer for later use by
> drm_of_find_possible_crtcs. Fix by moving of_node_put after crtc->port
> assignment.
>
> Cc: stable@vger.kernel.org
> Fixes: 89a565dba1a0 ("drm: kirin: Move ade drm init to kirin drm drv")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
> drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c
> index 8a11c2df5b88..cc453b29b22c 100644
> --- a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c
> +++ b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_drv.c
> @@ -53,8 +53,8 @@ static int kirin_drm_crtc_init(struct drm_device *dev, struct drm_crtc *crtc,
> DRM_ERROR("no port node found in %pOF\n", dev->dev->of_node);
> return -EINVAL;
> }
> - of_node_put(port);
> crtc->port = port;
> + of_node_put(port);
>
> ret = drm_crtc_init_with_planes(dev, crtc, plane, NULL,
> driver_data->crtc_funcs, NULL);
> --
> 2.39.5 (Apple Git-154)
Please ignore this patch. I will resend a proper version after
learning the kernel submission process.
Apologies for the noise.
Best regards,
WenTao Liang
^ permalink raw reply [flat|nested] 4+ messages in thread