[PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

[PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

[Haojie Li]

platform_device_register_data() can fail and return an ERR_PTR, but the
return value is used without checking, leading to an invalid pointer
being stored in ddp_comp[].dev and passed to component_match_add() and
mtk_ddp_comp_init(), which could result in a kernel crash.

Add an IS_ERR() check to jump to the error handling path on failure.

Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195")
Cc: stable@vger.kernel.org
Signed-off-by: Haojie Li <lihaojie@kylinos.cn>
---
 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index c86a3f54f35b..667d7fdbfbac 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -1112,6 +1112,10 @@ static int mtk_drm_probe(struct platform_device *pdev)
 							    PLATFORM_DEVID_AUTO,
 							    (void *)private->mmsys_dev,
 							    sizeof(*private->mmsys_dev));
+		if (IS_ERR(ovl_adaptor)) {
+			ret = PTR_ERR(ovl_adaptor);
+			goto err_node;
+		}
 		private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev = &ovl_adaptor->dev;
 		mtk_ddp_comp_init(dev, NULL, &private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR],
 				  DDP_COMPONENT_DRM_OVL_ADAPTOR);
-- 
2.25.1

Re: [PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:

Pre-existing issues:
- [High] The dynamically registered `ovl_adaptor` platform device is leaked on probe error paths and during device removal, causing duplicate device accumulation.
- [High] `platform_device_register_data()` is misused to create a shallow, byte-for-byte clone of a `struct device` object.
- [High] `mtk_drm_bind()` mistakenly drops the `private->mutex_node` reference on `-EPROBE_DEFER`, causing an unbalanced put and potential use-after-free.
- [High] In `mtk_drm_of_ddp_path_build_one()`, if `mtk_drm_of_get_ddp_ep_cid()` fails early, it causes a double-put of the current device node in the loop.
- [Medium] In `mtk_drm_of_ddp_path_build_one()`, if the initial call to `mtk_drm_of_get_ddp_ep_cid()` fails but sets `next`, the acquired device node reference is leaked.
--

--- Patch [1]: [PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device ---
commit 6317e1a251b60c3bf25295a5bff30bc7683eb97b
Author: Haojie Li <lihaojie@kylinos.cn>

drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

This commit adds an IS_ERR() check after platform_device_register_data() in
mtk_drm_probe() to prevent a potential kernel crash due to an invalid pointer
dereference on error.

> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index c86a3f54f35bc..667d7fdbfbac6 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -1112,6 +1112,10 @@ static int mtk_drm_probe(struct platform_device *pdev)
>  							    PLATFORM_DEVID_AUTO,
>  							    (void *)private->mmsys_dev,
>  							    sizeof(*private->mmsys_dev));

[Severity: High]
This isn't a bug introduced by this patch, but is it safe to pass
(void *)private->mmsys_dev and sizeof(*private->mmsys_dev) as the platform
data?

platform_device_register_data() kmemdups the provided memory into the new
device's platform_data. 

Copying the entire struct device object (including its kobject, mutexes,
and list heads) byte-for-byte might lead to subsystem operations running on
cloned and broken locks or kobjects when used by the OVL adaptor driver.

> +		if (IS_ERR(ovl_adaptor)) {
> +			ret = PTR_ERR(ovl_adaptor);
> +			goto err_node;
> +		}

[Severity: High]
This is a pre-existing issue, but is the dynamically registered ovl_adaptor
platform device leaked on probe error paths and during device removal?

If probe fails later (for example, returning -EPROBE_DEFER) and jumps to
err_node, or when mtk_drm_remove() is called, it doesn't look like
platform_device_unregister() is ever called.

This could leave orphaned devices accumulating on the platform bus.

>  		private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev = &ovl_adaptor->dev;
>  		mtk_ddp_comp_init(dev, NULL, &private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR],
>  				  DDP_COMPONENT_DRM_OVL_ADAPTOR);

[ ... ]

> static int mtk_drm_bind(struct device *dev)
> {
>       ...
>		of_node_put(private->mutex_node);
>		return -EPROBE_DEFER;
>       ...
> }

[Severity: High]
This is a pre-existing issue, but does mtk_drm_bind() mistakenly drop the
private->mutex_node reference on -EPROBE_DEFER?

If it drops the reference here when the disp-mutex device is delayed, and the
driver is later unbound, mtk_drm_remove() will call of_node_put() again on
the same node pointer.

Could this cause an unbalanced put and potential use-after-free?

[ ... ]

> static int mtk_drm_of_ddp_path_build_one(...)
> {
>       ...
> 	ret = mtk_drm_of_get_ddp_ep_cid(vdo, 0, cpath, &next, &temp_path[idx]);
> 	if (ret) {
> 		if (next && temp_path[idx] == DDP_COMPONENT_DRM_OVL_ADAPTOR) {
> 			...
> 		} else {
> 			if (next)
> 				dev_err(dev, "Invalid component %pOF\n", next);
> 			else
> 				dev_err(dev, "Cannot find first endpoint for path %d\n", cpath);
>
> 			return ret;
> 		}
> 	}

[Severity: Medium]
This is a pre-existing issue, but does this initial error path leak the
acquired device node reference?

If mtk_drm_of_get_ddp_ep_cid() fails but still sets next, the code logs an
error and returns ret directly.

It doesn't appear to call of_node_put(next) before returning, which would
leave the reference dangling.

[ ... ]

> 	do {
> 		prev = next;
> 		ret = mtk_drm_of_get_ddp_ep_cid(next, 1, cpath, &next, &temp_path[idx]);
> 		of_node_put(prev);
> 		if (ret) {
> 			of_node_put(next);
> 			break;
> 		}

[Severity: High]
This is a pre-existing issue, but can this error path trigger a double-put of
the device node?

If mtk_drm_of_get_ddp_ep_cid() fails early (for example, returning -ENOENT)
without updating the next pointer, next will still point to prev.

The loop calls of_node_put(prev), and since ret is non-zero, it also
calls of_node_put(next). This would decrement the refcount of the same node
twice.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260819065642.136222-1-lihaojie@kylinos.cn?part=1