* Re: [PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
2026-08-19 6:56 [PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device Haojie Li
@ 2026-08-19 7:07 ` sashiko-bot
0 siblings, 0 replies; 2+ messages in thread
From: sashiko-bot @ 2026-08-19 7:07 UTC (permalink / raw)
To: Haojie Li; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
Pre-existing issues:
- [High] The dynamically registered `ovl_adaptor` platform device is leaked on probe error paths and during device removal, causing duplicate device accumulation.
- [High] `platform_device_register_data()` is misused to create a shallow, byte-for-byte clone of a `struct device` object.
- [High] `mtk_drm_bind()` mistakenly drops the `private->mutex_node` reference on `-EPROBE_DEFER`, causing an unbalanced put and potential use-after-free.
- [High] In `mtk_drm_of_ddp_path_build_one()`, if `mtk_drm_of_get_ddp_ep_cid()` fails early, it causes a double-put of the current device node in the loop.
- [Medium] In `mtk_drm_of_ddp_path_build_one()`, if the initial call to `mtk_drm_of_get_ddp_ep_cid()` fails but sets `next`, the acquired device node reference is leaked.
--
--- Patch [1]: [PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device ---
commit 6317e1a251b60c3bf25295a5bff30bc7683eb97b
Author: Haojie Li <lihaojie@kylinos.cn>
drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
This commit adds an IS_ERR() check after platform_device_register_data() in
mtk_drm_probe() to prevent a potential kernel crash due to an invalid pointer
dereference on error.
> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index c86a3f54f35bc..667d7fdbfbac6 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -1112,6 +1112,10 @@ static int mtk_drm_probe(struct platform_device *pdev)
> PLATFORM_DEVID_AUTO,
> (void *)private->mmsys_dev,
> sizeof(*private->mmsys_dev));
[Severity: High]
This isn't a bug introduced by this patch, but is it safe to pass
(void *)private->mmsys_dev and sizeof(*private->mmsys_dev) as the platform
data?
platform_device_register_data() kmemdups the provided memory into the new
device's platform_data.
Copying the entire struct device object (including its kobject, mutexes,
and list heads) byte-for-byte might lead to subsystem operations running on
cloned and broken locks or kobjects when used by the OVL adaptor driver.
> + if (IS_ERR(ovl_adaptor)) {
> + ret = PTR_ERR(ovl_adaptor);
> + goto err_node;
> + }
[Severity: High]
This is a pre-existing issue, but is the dynamically registered ovl_adaptor
platform device leaked on probe error paths and during device removal?
If probe fails later (for example, returning -EPROBE_DEFER) and jumps to
err_node, or when mtk_drm_remove() is called, it doesn't look like
platform_device_unregister() is ever called.
This could leave orphaned devices accumulating on the platform bus.
> private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev = &ovl_adaptor->dev;
> mtk_ddp_comp_init(dev, NULL, &private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR],
> DDP_COMPONENT_DRM_OVL_ADAPTOR);
[ ... ]
> static int mtk_drm_bind(struct device *dev)
> {
> ...
> of_node_put(private->mutex_node);
> return -EPROBE_DEFER;
> ...
> }
[Severity: High]
This is a pre-existing issue, but does mtk_drm_bind() mistakenly drop the
private->mutex_node reference on -EPROBE_DEFER?
If it drops the reference here when the disp-mutex device is delayed, and the
driver is later unbound, mtk_drm_remove() will call of_node_put() again on
the same node pointer.
Could this cause an unbalanced put and potential use-after-free?
[ ... ]
> static int mtk_drm_of_ddp_path_build_one(...)
> {
> ...
> ret = mtk_drm_of_get_ddp_ep_cid(vdo, 0, cpath, &next, &temp_path[idx]);
> if (ret) {
> if (next && temp_path[idx] == DDP_COMPONENT_DRM_OVL_ADAPTOR) {
> ...
> } else {
> if (next)
> dev_err(dev, "Invalid component %pOF\n", next);
> else
> dev_err(dev, "Cannot find first endpoint for path %d\n", cpath);
>
> return ret;
> }
> }
[Severity: Medium]
This is a pre-existing issue, but does this initial error path leak the
acquired device node reference?
If mtk_drm_of_get_ddp_ep_cid() fails but still sets next, the code logs an
error and returns ret directly.
It doesn't appear to call of_node_put(next) before returning, which would
leave the reference dangling.
[ ... ]
> do {
> prev = next;
> ret = mtk_drm_of_get_ddp_ep_cid(next, 1, cpath, &next, &temp_path[idx]);
> of_node_put(prev);
> if (ret) {
> of_node_put(next);
> break;
> }
[Severity: High]
This is a pre-existing issue, but can this error path trigger a double-put of
the device node?
If mtk_drm_of_get_ddp_ep_cid() fails early (for example, returning -ENOENT)
without updating the next pointer, next will still point to prev.
The loop calls of_node_put(prev), and since ret is non-zero, it also
calls of_node_put(next). This would decrement the refcount of the same node
twice.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260819065642.136222-1-lihaojie@kylinos.cn?part=1
^ permalink raw reply [flat|nested] 2+ messages in thread