From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2D78C3AC0E7; Fri, 9 Oct 2026 14:25:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791555944; cv=none; b=K42WHlnGgaANaxl8HrJZBu4+EziSfBfNptTuCuH0i49ePTqlYaN1FY4xTgEOVsmVnwEMB/SwdV1gY2kP2/wx1ExWeqcan/HVgrZ0qtB06aFPbNpGI0mXvzFKGhvCcGKVJ8S0zRvTBJAxssVXBVobONefkshw6TjLfmdz7gd+LtA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791555944; c=relaxed/simple; bh=iWJsUQWhaPsmr4WLye7fTL465kOJuAKZt+kmqSROsZ0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oNxqxB8wse6zMjB9/tKbqGaTrGf0mGPN35oRv0cj4168DjMbjxVAv2j8m7WCEmN/lXX3uZnj/ykwhuck3qLQL97U7BJfXZwAYkDGl7VEHnpob3ozN2wEtOphUgeYfXGibl5QK8Ph33wYfwREF4iiRmYZXynDYD5Esg6X9tQo5VM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2v1JqMPE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="2v1JqMPE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8B58C1F00893; Fri, 9 Oct 2026 14:25:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1791555943; bh=Dyq0BJ5jCSXB9jc+Tt8YVlW8SyX7RDON+uQONZPpge8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=2v1JqMPEJWDL0BK1dmNzUElJsXekYuUIz2H1Kni673j70NO+z4AdOxAS+LaUUvAwa Ba2tf5w7LpCz3oIoPRPf5pV/y3rfL/qS0Ga/xOhjQBNQYI4FScFEe34+GNCqx83f1x UPDQca4YMNSdcYFD0bqyv17y6VYUz/nfuHdyZk4I= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Guangshuo Li , Chun-Kuang Hu Subject: [PATCH 6.18 143/403] drm/mediatek: Fix ovl adaptor platform device leak Date: Fri, 9 Oct 2026 16:08:24 +0200 Message-ID: <20261009140955.417822878@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261009140952.119038291@linuxfoundation.org> References: <20261009140952.119038291@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Guangshuo Li commit 048739be3e9cacae5301b68245668002fe6f0ce5 upstream. mtk_drm_probe() creates an OVL adaptor platform device with platform_device_register_data() when the display pipeline requires the OVL adaptor. If a later initialization step fails, the probe error path releases the DRM resources without unregistering the already registered OVL adaptor device. The normal remove path likewise leaves the device registered after the DRM driver is unbound. Keep track of whether the OVL adaptor was successfully registered and unregister it on probe failure. Also recover the platform device from the stored DDP component device and unregister it during normal removal. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260921131156.403652-1-lgs201920130244@gmail.com/ Signed-off-by: Chun-Kuang Hu Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c @@ -1070,7 +1070,7 @@ static int mtk_drm_probe(struct platform struct mtk_mmsys_driver_data *mtk_drm_data; struct device_node *node; struct component_match *match = NULL; - struct platform_device *ovl_adaptor; + struct platform_device *ovl_adaptor = NULL; int ret; int i; @@ -1218,6 +1218,8 @@ static int mtk_drm_probe(struct platform err_pm: pm_runtime_disable(dev); err_node: + if (ovl_adaptor) + platform_device_unregister(ovl_adaptor); of_node_put(private->mutex_node); for (i = 0; i < DDP_COMPONENT_DRM_ID_MAX; i++) of_node_put(private->comp_node[i]); @@ -1227,9 +1229,15 @@ err_node: static void mtk_drm_remove(struct platform_device *pdev) { struct mtk_drm_private *private = platform_get_drvdata(pdev); + struct device *ovl_adaptor_dev; int i; + ovl_adaptor_dev = + private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev; + component_master_del(&pdev->dev, &mtk_drm_ops); + if (ovl_adaptor_dev) + platform_device_unregister(to_platform_device(ovl_adaptor_dev)); pm_runtime_disable(&pdev->dev); of_node_put(private->mutex_node); for (i = 0; i < DDP_COMPONENT_DRM_ID_MAX; i++)