[PATCH] drm/bridge: lt8912b: Fix next_bridge reference leak in lt8912_parse_dt()

[PATCH] drm/bridge: lt8912b: Fix next_bridge reference leak in lt8912_parse_dt()

[Wentao Liang]

lt8912_parse_dt() takes a reference to the next bridge in the
pipeline with of_drm_find_and_get_bridge() and stores it in
lt->bridge.next_bridge, but neither the error paths after the lookup
nor the driver teardown release it.  Drop the reference in the
err_free_host_node label and in lt8912_put_dt().

Fixes: 31cb3cd7e714 ("drm/bridge: lt8912b: convert to of_drm_find_and_get_bridge()")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/bridge/lontium-lt8912b.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
index 8a0b48efca58..fa6cdad3f517 100644
--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
+++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
@@ -743,6 +743,7 @@ static int lt8912_parse_dt(struct lt8912 *lt)
 	return 0;
 
 err_free_host_node:
+	drm_bridge_put(lt->bridge.next_bridge);
 	of_node_put(port_node);
 	of_node_put(lt->host_node);
 	return ret;
@@ -750,6 +751,7 @@ static int lt8912_parse_dt(struct lt8912 *lt)
 
 static int lt8912_put_dt(struct lt8912 *lt)
 {
+	drm_bridge_put(lt->bridge.next_bridge);
 	of_node_put(lt->host_node);
 	return 0;
 }
-- 
2.34.1

Re: [PATCH] drm/bridge: lt8912b: Fix next_bridge reference leak in lt8912_parse_dt()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/bridge: double-put of next_bridge on error and teardown
--

commit 836b7cdeed1872c95aba63f08e9bc717bdb9d7d6
Author: Wentao Liang <vulab@iscas.ac.cn>

drm/bridge: lt8912b: Fix next_bridge reference leak in lt8912_parse_dt()

This commit attempts to fix a reference leak by manually calling
drm_bridge_put() on the next bridge during error paths in lt8912_parse_dt()
and during driver teardown in lt8912_put_dt().

> diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
> index e347d04b7b2de..3bd920a43e936 100644
> --- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
> +++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
> @@ -748,6 +748,7 @@ static int lt8912_parse_dt(struct lt8912 *lt)
>  	return 0;
>  
>  err_free_host_node:
> +	drm_bridge_put(lt->bridge.next_bridge);

[Severity: High]
Does this manual put operation leave a dangling pointer that will trigger a
double-put?

The lt struct is allocated via devm_drm_bridge_alloc(), which registers
a devres cleanup action that eventually calls __drm_bridge_free(). That
cleanup natively handles dropping the chained bridge reference by calling
drm_bridge_put(bridge->next_bridge).

Since this pointer isn't cleared here, will devres cleanup attempt to put
this already-freed reference again if an error occurs after
of_drm_find_and_get_bridge() succeeds (for example, if
lt8912_get_regulators() fails)?

>  	of_node_put(port_node);
>  	of_node_put(lt->host_node);
>  	return ret;
> @@ -755,6 +756,7 @@ static int lt8912_parse_dt(struct lt8912 *lt)
>  
>  static int lt8912_put_dt(struct lt8912 *lt)
>  {
> +	drm_bridge_put(lt->bridge.next_bridge);

[Severity: High]
Similarly, will this cause a double-put during driver unbind?

When the driver is unbound, lt8912_put_dt() manually drops the reference
here. Then the devres cleanup automatically drops it again using the dangling
pointer, which could lead to a refcount underflow and use-after-free of the
next DRM bridge in the chain.

Could we either rely entirely on the devres cleanup, or use something like
a clear-and-put approach to avoid leaving a dangling pointer?

>  	of_node_put(lt->host_node);
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916101401.2017498-1-vulab@iscas.ac.cn?part=1