[PATCH] drm/mediatek: fix ovl adaptor platform device leak

[PATCH] drm/mediatek: fix ovl adaptor platform device leak

[Guangshuo Li]

mtk_drm_probe() creates an OVL adaptor platform device with
platform_device_register_data() when the display pipeline requires the
OVL adaptor.

If a later initialization step fails, the probe error path releases
the DRM resources without unregistering the already registered OVL
adaptor device. The normal remove path likewise leaves the device
registered after the DRM driver is unbound.

Keep track of whether the OVL adaptor was successfully registered and
unregister it on probe failure. Also recover the platform device from
the stored DDP component device and unregister it during normal
removal.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index c86a3f54f35b..d176e6496aa7 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -1060,7 +1060,7 @@ static int mtk_drm_probe(struct platform_device *pdev)
 	struct mtk_mmsys_driver_data *mtk_drm_data;
 	struct device_node *node;
 	struct component_match *match = NULL;
-	struct platform_device *ovl_adaptor;
+	struct platform_device *ovl_adaptor = NULL;
 	int ret;
 	int i;
 
@@ -1205,6 +1205,8 @@ static int mtk_drm_probe(struct platform_device *pdev)
 err_pm:
 	pm_runtime_disable(dev);
 err_node:
+	if (ovl_adaptor)
+		platform_device_unregister(ovl_adaptor);
 	of_node_put(private->mutex_node);
 	for (i = 0; i < DDP_COMPONENT_DRM_ID_MAX; i++)
 		of_node_put(private->comp_node[i]);
@@ -1214,9 +1216,15 @@ static int mtk_drm_probe(struct platform_device *pdev)
 static void mtk_drm_remove(struct platform_device *pdev)
 {
 	struct mtk_drm_private *private = platform_get_drvdata(pdev);
+	struct device *ovl_adaptor_dev;
 	int i;
 
+	ovl_adaptor_dev =
+		private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev;
+
 	component_master_del(&pdev->dev, &mtk_drm_ops);
+	if (ovl_adaptor_dev)
+		platform_device_unregister(to_platform_device(ovl_adaptor_dev));
 	pm_runtime_disable(&pdev->dev);
 	of_node_put(private->mutex_node);
 	for (i = 0; i < DDP_COMPONENT_DRM_ID_MAX; i++)
-- 
2.43.0

Re: [PATCH] drm/mediatek: fix ovl adaptor platform device leak

[Chun-Kuang Hu]

Hi, Guangshuo:

Guangshuo Li <lgs201920130244@gmail.com> 於 2026年9月21日週一 下午1:12寫道：
>
> mtk_drm_probe() creates an OVL adaptor platform device with
> platform_device_register_data() when the display pipeline requires the
> OVL adaptor.
>
> If a later initialization step fails, the probe error path releases
> the DRM resources without unregistering the already registered OVL
> adaptor device. The normal remove path likewise leaves the device
> registered after the DRM driver is unbound.
>
> Keep track of whether the OVL adaptor was successfully registered and
> unregister it on probe failure. Also recover the platform device from
> the stored DDP component device and unregister it during normal
> removal.
>
> The issue was identified by a static analysis tool I developed and
> confirmed by manual review.

Applied to mediatek-drm-fixes [1], thanks.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux.git/log/?h=mediatek-drm-fixes

Regards,
Chun-Kuang.

>
> Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/gpu/drm/mediatek/mtk_drm_drv.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index c86a3f54f35b..d176e6496aa7 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -1060,7 +1060,7 @@ static int mtk_drm_probe(struct platform_device *pdev)
>         struct mtk_mmsys_driver_data *mtk_drm_data;
>         struct device_node *node;
>         struct component_match *match = NULL;
> -       struct platform_device *ovl_adaptor;
> +       struct platform_device *ovl_adaptor = NULL;
>         int ret;
>         int i;
>
> @@ -1205,6 +1205,8 @@ static int mtk_drm_probe(struct platform_device *pdev)
>  err_pm:
>         pm_runtime_disable(dev);
>  err_node:
> +       if (ovl_adaptor)
> +               platform_device_unregister(ovl_adaptor);
>         of_node_put(private->mutex_node);
>         for (i = 0; i < DDP_COMPONENT_DRM_ID_MAX; i++)
>                 of_node_put(private->comp_node[i]);
> @@ -1214,9 +1216,15 @@ static int mtk_drm_probe(struct platform_device *pdev)
>  static void mtk_drm_remove(struct platform_device *pdev)
>  {
>         struct mtk_drm_private *private = platform_get_drvdata(pdev);
> +       struct device *ovl_adaptor_dev;
>         int i;
>
> +       ovl_adaptor_dev =
> +               private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev;
> +
>         component_master_del(&pdev->dev, &mtk_drm_ops);
> +       if (ovl_adaptor_dev)
> +               platform_device_unregister(to_platform_device(ovl_adaptor_dev));
>         pm_runtime_disable(&pdev->dev);
>         of_node_put(private->mutex_node);
>         for (i = 0; i < DDP_COMPONENT_DRM_ID_MAX; i++)
> --
> 2.43.0
>