[PATCH v2] drm/mediatek: fix of_node leak in mtk_drm_probe loop

[PATCH v2] drm/mediatek: fix of_node leak in mtk_drm_probe loop

[WenTao Liang]

In the for_each_child_of_node loop, private->comp_node[comp_id] and
private->mutex_node are assigned via of_node_get without first releasing
any previously stored reference for the same index. When the same comp_id
or mmsys_id matches multiple nodes, earlier node references are
overwritten and permanently leaked.

Suggested-by: Greg KH <gregkh@linuxfoundation.org>
Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support")
Cc: stable@vger.kernel.org
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
Changes in v2:
- Fix patch format based on reviewer feedback
---
 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index c86a3f54f35b..58860f7071a9 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -1138,6 +1138,7 @@ static int mtk_drm_probe(struct platform_device *pdev)
 
 			id = of_alias_get_id(node, "mutex");
 			if (id < 0 || id == private->data->mmsys_id) {
+				of_node_put(private->mutex_node);
 				private->mutex_node = of_node_get(node);
 				dev_dbg(dev, "get mutex for mmsys %d", private->data->mmsys_id);
 			}
@@ -1154,6 +1155,7 @@ static int mtk_drm_probe(struct platform_device *pdev)
 		if (!mtk_drm_find_mmsys_comp(private, comp_id))
 			continue;
 
+		of_node_put(private->comp_node[comp_id]);
 		private->comp_node[comp_id] = of_node_get(node);
 
 		/*
-- 
2.39.5 (Apple Git-154)

Re: [PATCH v2] drm/mediatek: fix of_node leak in mtk_drm_probe loop

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Dropping `private->mutex_node` on bind deferral causes Use-After-Free on retry and double-free in remove.
--

commit f75632ba90679309b109146f80c6f864e8f03801
Author: WenTao Liang <vulab@iscas.ac.cn>
drm/mediatek: fix of_node leak in mtk_drm_probe loop

This commit prevents leaking of_node references in the mtk_drm_probe
loop by properly dropping previously stored references before overwriting
them for the same index.

> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index c86a3f54f35bc..58860f7071a9e 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c

[ ... ]

[Severity: High]
This is a pre-existing issue, but while reviewing the lifecycle of
private->mutex_node managed in this patch, I noticed a potential problem in
mtk_drm_bind() in drivers/gpu/drm/mediatek/mtk_drm_drv.c:

	pdev = of_find_device_by_node(private->mutex_node);
	if (!pdev) {
		dev_err(dev, "Waiting for disp-mutex device %pOF\n",
			private->mutex_node);
		of_node_put(private->mutex_node);
		return -EPROBE_DEFER;
	}

Since private->mutex_node is a persistent reference acquired in
mtk_drm_probe(), does dropping it on this -EPROBE_DEFER error path lead
to a use-after-free when the component framework retries the bind operation
and accesses it again?

Furthermore, since mtk_drm_remove() unconditionally cleans up this reference,
would this early drop also result in a double-free during teardown?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260628141751.47090-1-vulab@iscas.ac.cn?part=1