[PATCH] drm/bridge: imx8mp-hdmi-pvi: Fix next_bridge reference leak

[PATCH] drm/bridge: imx8mp-hdmi-pvi: Fix next_bridge reference leak

[Wentao Liang]

imx8mp_hdmi_pvi_probe() takes a reference to the next bridge in the
pipeline with of_drm_find_and_get_bridge() and stores it in
pvi->bridge.next_bridge, but the reference is never released, leaking
the bridge on driver unbind.  Drop the reference in
imx8mp_hdmi_pvi_remove() once the bridge has been unregistered.

Fixes: 7654c807f207 ("drm/bridge: imx8mp-hdmi-pvi: convert to of_drm_find_and_get_bridge()")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c b/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c
index 15fbb1be07cd..80e33d810a69 100644
--- a/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c
+++ b/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c
@@ -179,6 +179,7 @@ static void imx8mp_hdmi_pvi_remove(struct platform_device *pdev)
 	struct imx8mp_hdmi_pvi *pvi = platform_get_drvdata(pdev);
 
 	drm_bridge_remove(&pvi->bridge);
+	drm_bridge_put(pvi->bridge.next_bridge);
 
 	pm_runtime_disable(&pdev->dev);
 }
-- 
2.34.1

Re: [PATCH] drm/bridge: imx8mp-hdmi-pvi: Fix next_bridge reference leak

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/bridge: imx8mp-hdmi-pvi: double-put of next_bridge on unbind
--

commit 86a7e8c2747f218e207c0b6519ab1f7729f32712
Author: Wentao Liang <vulab@iscas.ac.cn>

drm/bridge: imx8mp-hdmi-pvi: Fix next_bridge reference leak

This commit adds a call to drm_bridge_put() in the driver unbind path to
release the reference to the next bridge in the pipeline.

> diff --git a/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c b/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c
> index a31d4fc76f35b..c71319bb68f4b 100644
> --- a/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c
> +++ b/drivers/gpu/drm/bridge/imx/imx8mp-hdmi-pvi.c
> @@ -179,6 +179,7 @@ static void imx8mp_hdmi_pvi_remove(struct platform_device *pdev)
>  	struct imx8mp_hdmi_pvi *pvi = platform_get_drvdata(pdev);
>  
>  	drm_bridge_remove(&pvi->bridge);
> +	drm_bridge_put(pvi->bridge.next_bridge);

[Severity: High]
Does this introduce a double-put of the next_bridge object?

When the device is unbound, devres triggers the cleanup for pvi->bridge
which was allocated with devm_drm_bridge_alloc(). When its refcount drops
to zero, the DRM core calls __drm_bridge_free(), which automatically
releases next_bridge:

drivers/gpu/drm/drm_bridge.c:__drm_bridge_free() {
    ...
    drm_bridge_put(bridge->next_bridge);
    ...
}

By adding a manual drm_bridge_put() here without clearing the pointer,
won't __drm_bridge_free() drop the reference a second time and potentially
cause a use-after-free?

>  
>  	pm_runtime_disable(&pdev->dev);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916101146.2015255-1-vulab@iscas.ac.cn?part=1