Re: [PATCH] drm/bridge: imx8mp-hdmi-pvi: Fix next_bridge reference leak

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/bridge: imx8mp-hdmi-pvi: double-put of next_bridge on unbind
--

commit 86a7e8c2747f218e207c0b6519ab1f7729f32712
Author: Wentao Liang <vulab@iscas.ac.cn>

drm/bridge: imx8mp-hdmi-pvi: Fix next_bridge reference leak

This commit adds a call to drm_bridge_put() in the driver unbind path to
release the reference to the next bridge in the pipeline.

> diff --git a/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c b/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c
> index a31d4fc76f35b..c71319bb68f4b 100644
> --- a/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c
> +++ b/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c
> @@ -179,6 +179,7 @@ static void imx8mp_hdmi_pvi_remove(struct platform_device *pdev)
>  	struct imx8mp_hdmi_pvi *pvi = platform_get_drvdata(pdev);
>  
>  	drm_bridge_remove(&pvi->bridge);
> +	drm_bridge_put(pvi->bridge.next_bridge);

[Severity: High]
Does this introduce a double-put of the next_bridge object?

When the device is unbound, devres triggers the cleanup for pvi->bridge
which was allocated with devm_drm_bridge_alloc(). When its refcount drops
to zero, the DRM core calls __drm_bridge_free(), which automatically
releases next_bridge:

drivers/gpu/drm/drm_bridge.c:__drm_bridge_free() {
    ...
    drm_bridge_put(bridge->next_bridge);
    ...
}

By adding a manual drm_bridge_put() here without clearing the pointer,
won't __drm_bridge_free() drop the reference a second time and potentially
cause a use-after-free?

>  
>  	pm_runtime_disable(&pdev->dev);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916101146.2015255-1-vulab@iscas.ac.cn?part=1