[PATCH 0/2] drm/mediatek: Fix child node refcount handling and use scoped macro

[PATCH 0/2] drm/mediatek: Fix child node refcount handling and use scoped macro

[Javier Carrasco]

This series fixes a wrong handling of the child node within the
for_each_child_of_node() by adding the missing call to of_node_put() to
make it compatible with stable kernels that don't provide the scoped
variant of the macro, which is more secure and was introduced early this
year.

Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
---
Javier Carrasco (2):
      drm/mediatek: Fix child node refcount handling in early exit
      drm/mediatek: Switch to for_each_child_of_node_scoped()

 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
---
base-commit: d61a00525464bfc5fe92c6ad713350988e492b88
change-id: 20241011-mtk_drm_drv_memleak-5e8b8e45ed1c

Best regards,
-- 
Javier Carrasco <javier.carrasco.cruz@gmail.com>

[PATCH 1/2] drm/mediatek: Fix child node refcount handling in early exit

[Javier Carrasco]

Early exits (goto, break, return) from for_each_child_of_node() required
an explicit call to of_node_put(), which was not introduced with the
break if cnt == MAX_CRTC.

Add the missing of_node_put() before the break.

Cc: stable@vger.kernel.org
Fixes: d761b9450e31 ("drm/mediatek: Add cnt checking for coverity issue")

Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
---
 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index a4594f8873d5..0878df832859 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -406,8 +406,10 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev)
 		if (temp_drm_priv->mtk_drm_bound)
 			cnt++;
 
-		if (cnt == MAX_CRTC)
+		if (cnt == MAX_CRTC) {
+			of_node_put(node);
 			break;
+		}
 	}
 
 	if (drm_priv->data->mmsys_dev_num == cnt) {

-- 
2.43.0

[PATCH 2/2] drm/mediatek: Switch to for_each_child_of_node_scoped()

[Javier Carrasco]

Introduce the scoped variant of the loop to automatically release the
child node when it goes out of scope, which is more robust than the
non-scoped variant, and accounts for new early exits that could be added
in the future.

Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
---
 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index 0878df832859..9ab656b10a49 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -372,12 +372,11 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev)
 	struct mtk_drm_private *temp_drm_priv;
 	struct device_node *phandle = dev->parent->of_node;
 	const struct of_device_id *of_id;
-	struct device_node *node;
 	struct device *drm_dev;
 	unsigned int cnt = 0;
 	int i, j;
 
-	for_each_child_of_node(phandle->parent, node) {
+	for_each_child_of_node_scoped(phandle->parent, node) {
 		struct platform_device *pdev;
 
 		of_id = of_match_node(mtk_drm_of_ids, node);
@@ -406,10 +405,8 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev)
 		if (temp_drm_priv->mtk_drm_bound)
 			cnt++;
 
-		if (cnt == MAX_CRTC) {
-			of_node_put(node);
+		if (cnt == MAX_CRTC)
 			break;
-		}
 	}
 
 	if (drm_priv->data->mmsys_dev_num == cnt) {

-- 
2.43.0

Re: [PATCH 1/2] drm/mediatek: Fix child node refcount handling in early exit

[CK Hu (胡俊光)]

Hi, Javier:

On Fri, 2024-10-11 at 21:21 +0200, Javier Carrasco wrote:
>  	 
> External email : Please do not click links or open attachments until you have verified the sender or the content.
>  Early exits (goto, break, return) from for_each_child_of_node() required
> an explicit call to of_node_put(), which was not introduced with the
> break if cnt == MAX_CRTC.
> 
> Add the missing of_node_put() before the break.

Reviewed-by: CK Hu <ck.hu@mediatek.com>

> 
> Cc: stable@vger.kernel.org
> Fixes: d761b9450e31 ("drm/mediatek: Add cnt checking for coverity issue")
> 
> Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
> ---
>  drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index a4594f8873d5..0878df832859 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -406,8 +406,10 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev)
>  if (temp_drm_priv->mtk_drm_bound)
>  cnt++;
>  
> -if (cnt == MAX_CRTC)
> +if (cnt == MAX_CRTC) {
> +of_node_put(node);
>  break;
> +}
>  }
>  
>  if (drm_priv->data->mmsys_dev_num == cnt) {
> 
> -- 
> 2.43.0
> 

Re: [PATCH 2/2] drm/mediatek: Switch to for_each_child_of_node_scoped()

[CK Hu (胡俊光)]

Hi, Javier:

On Fri, 2024-10-11 at 21:21 +0200, Javier Carrasco wrote:
>  	 
> External email : Please do not click links or open attachments until you have verified the sender or the content.
>  Introduce the scoped variant of the loop to automatically release the
> child node when it goes out of scope, which is more robust than the
> non-scoped variant, and accounts for new early exits that could be added
> in the future.

Reviewed-by: CK Hu <ck.hu@mediatek.com>

> 
> Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
> ---
>  drivers/gpu/drm/mediatek/mtk_drm_drv.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index 0878df832859..9ab656b10a49 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -372,12 +372,11 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev)
>  struct mtk_drm_private *temp_drm_priv;
>  struct device_node *phandle = dev->parent->of_node;
>  const struct of_device_id *of_id;
> -struct device_node *node;
>  struct device *drm_dev;
>  unsigned int cnt = 0;
>  int i, j;
>  
> -for_each_child_of_node(phandle->parent, node) {
> +for_each_child_of_node_scoped(phandle->parent, node) {
>  struct platform_device *pdev;
>  
>  of_id = of_match_node(mtk_drm_of_ids, node);
> @@ -406,10 +405,8 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev)
>  if (temp_drm_priv->mtk_drm_bound)
>  cnt++;
>  
> -if (cnt == MAX_CRTC) {
> -of_node_put(node);
> +if (cnt == MAX_CRTC)
>  break;
> -}
>  }
>  
>  if (drm_priv->data->mmsys_dev_num == cnt) {
> 
> -- 
> 2.43.0
> 

Re: [PATCH 1/2] drm/mediatek: Fix child node refcount handling in early exit

[Chen-Yu Tsai]

On Sat, Oct 12, 2024 at 3:22 AM Javier Carrasco
<javier.carrasco.cruz@gmail.com> wrote:
>
> Early exits (goto, break, return) from for_each_child_of_node() required
> an explicit call to of_node_put(), which was not introduced with the
> break if cnt == MAX_CRTC.
>
> Add the missing of_node_put() before the break.
>
> Cc: stable@vger.kernel.org
> Fixes: d761b9450e31 ("drm/mediatek: Add cnt checking for coverity issue")
>
> Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>

Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>

Re: [PATCH 2/2] drm/mediatek: Switch to for_each_child_of_node_scoped()

[Chen-Yu Tsai]

On Sat, Oct 12, 2024 at 3:22 AM Javier Carrasco
<javier.carrasco.cruz@gmail.com> wrote:
>
> Introduce the scoped variant of the loop to automatically release the
> child node when it goes out of scope, which is more robust than the
> non-scoped variant, and accounts for new early exits that could be added
> in the future.
>
> Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>

Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>

Re: [PATCH 2/2] drm/mediatek: Switch to for_each_child_of_node_scoped()

[AngeloGioacchino Del Regno]

Il 11/10/24 21:21, Javier Carrasco ha scritto:
> Introduce the scoped variant of the loop to automatically release the
> child node when it goes out of scope, which is more robust than the
> non-scoped variant, and accounts for new early exits that could be added
> in the future.
> 
> Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>

Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>

Re: [PATCH 1/2] drm/mediatek: Fix child node refcount handling in early exit

[AngeloGioacchino Del Regno]

Il 11/10/24 21:21, Javier Carrasco ha scritto:
> Early exits (goto, break, return) from for_each_child_of_node() required
> an explicit call to of_node_put(), which was not introduced with the
> break if cnt == MAX_CRTC.
> 
> Add the missing of_node_put() before the break.
> 
> Cc: stable@vger.kernel.org
> Fixes: d761b9450e31 ("drm/mediatek: Add cnt checking for coverity issue")
> 
> Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>


Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>

Re: [PATCH 0/2] drm/mediatek: Fix child node refcount handling and use scoped macro

[Chun-Kuang Hu]

Hi, Javier:

Javier Carrasco <javier.carrasco.cruz@gmail.com> 於 2024年10月12日 週六 上午3:22寫道：
>
> This series fixes a wrong handling of the child node within the
> for_each_child_of_node() by adding the missing call to of_node_put() to
> make it compatible with stable kernels that don't provide the scoped
> variant of the macro, which is more secure and was introduced early this
> year.

For this series, applied to mediatek-drm-next [1], thanks.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux.git/log/?h=mediatek-drm-next

Regards,
Chun-Kuang.

>
> Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
> ---
> Javier Carrasco (2):
>       drm/mediatek: Fix child node refcount handling in early exit
>       drm/mediatek: Switch to for_each_child_of_node_scoped()
>
>  drivers/gpu/drm/mediatek/mtk_drm_drv.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> ---
> base-commit: d61a00525464bfc5fe92c6ad713350988e492b88
> change-id: 20241011-mtk_drm_drv_memleak-5e8b8e45ed1c
>
> Best regards,
> --
> Javier Carrasco <javier.carrasco.cruz@gmail.com>
>