[PATCH] drm/mediatek: Keep the mutex node reference across deferred binds

[PATCH] drm/mediatek: Keep the mutex node reference across deferred binds

[Yige Jiang]

mtk_drm_probe() acquires private->mutex_node and releases that reference
on probe failure or in mtk_drm_remove(). The component bind callback does
not acquire another reference, so it must not put the node when the mutex
platform device is not available.

If this bind failure propagates through component_master_add_with_match(),
the probe error path puts the same reference again. A bind attempted after
probe has returned can also leave the stored node without its reference
for a later bind or remove.

Remove the bind-time put and leave the node reference with its probe/remove
owner.

Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Cc: stable@vger.kernel.org
Signed-off-by: Yige Jiang <yigejiang86@gmail.com>
---
AI assistance was used for analysis and patch preparation.

Based on next-20261104 (8b7179210b22).
Compile-tested: arm64, GCC 14.2.0, W=1, drivers/gpu/drm/mediatek/mtk_drm_drv.o;
baseline and patched objects built with no warnings.
Static source review; no hardware, boot, or KASAN test was performed.

 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index dc8e3e917dd771b950167d04c1ab87c14dbabf72..64c912ba95899128bfb1a41765579d9d70979a27 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -630,7 +630,6 @@ static int mtk_drm_bind(struct device *dev)
 	if (!pdev) {
 		dev_err(dev, "Waiting for disp-mutex device %pOF\n",
 			private->mutex_node);
-		of_node_put(private->mutex_node);
 		return -EPROBE_DEFER;
 	}

base-commit: 8b7179210b22f8e48a82c5ceacb9d56a9c4cfec4

Re: [PATCH] drm/mediatek: Keep the mutex node reference across deferred binds

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] drm/mediatek: device node reference leak in mtk_drm_probe()
  [1]
--

commit ca36688b98d58f438e7795c4737e318297cc995d
Author: Yige Jiang <yigejiang86@gmail.com>

drm/mediatek: Keep the mutex node reference across deferred binds

This commit removes the of_node_put(private->mutex_node) call from the
-EPROBE_DEFER error path in mtk_drm_bind() so the reference acquired in
mtk_drm_probe() is retained until probe failure or mtk_drm_remove().

> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index dc8e3e917dd77..64c912ba95899 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -630,7 +630,6 @@ static int mtk_drm_bind(struct device *dev)
>  	if (!pdev) {
>  		dev_err(dev, "Waiting for disp-mutex device %pOF\n",
>  			private->mutex_node);
> -		of_node_put(private->mutex_node);
>  		return -EPROBE_DEFER;
>  	}

[Severity: Medium]
This problem wasn't introduced by this patch, but can mtk_drm_probe() leak
a device_node reference in private->mutex_node [1]?

drivers/gpu/drm/mediatek/mtk_drm_drv.c:mtk_drm_probe() {
	...
	for_each_child_of_node(phandle->parent, node) {
		...
		if (comp_type == MTK_DISP_MUTEX) {
			int id;

			id = of_alias_get_id(node, "mutex");
			if (id < 0 || id == private->data->mmsys_id) {
				private->mutex_node = of_node_get(node);
				dev_dbg(dev, "get mutex for mmsys %d", private->data->mmsys_id);
			}
			continue;
		}
	...
}

If the loop matches more than one MTK_DISP_MUTEX child node (for instance,
when multiple mutex nodes have no "mutex" alias), private->mutex_node is
overwritten without calling of_node_put() on the previously acquired node,
leaking its reference.

[1] https://sashiko.dev/#/bug/linux-6030c65d-4659-4fa7-8aa2-9eff923ac68e

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/confirmed-20261105-38-2e09963f1b23@gmail.com?part=1

Re: [PATCH] drm/mediatek: Keep the mutex node reference across deferred binds

[CK Hu (胡俊光)]

On Fri, 2026-11-06 at 17:20 +0800, Yige Jiang wrote:
> External email : Please do not click links or open attachments until you have verified the sender or the content.
> 
> 
> mtk_drm_probe() acquires private->mutex_node and releases that reference
> on probe failure or in mtk_drm_remove(). The component bind callback does
> not acquire another reference, so it must not put the node when the mutex
> platform device is not available.
> 
> If this bind failure propagates through component_master_add_with_match(),
> the probe error path puts the same reference again. A bind attempted after
> probe has returned can also leave the stored node without its reference
> for a later bind or remove.
> 
> Remove the bind-time put and leave the node reference with its probe/remove
> owner.

Reviewed-by: CK Hu <ck.hu@mediatek.com>

> 
> Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yige Jiang <yigejiang86@gmail.com>
> ---