Re: [PATCH v2] drm/mediatek: fix of_node leak in mtk_drm_probe loop

["CK Hu (胡俊光)" <ck.hu@mediatek.com>]

On Sun, 2026-06-28 at 22:17 +0800, WenTao Liang wrote:
> External email : Please do not click links or open attachments until you have verified the sender or the content.
> 
> 
> In the for_each_child_of_node loop, private->comp_node[comp_id] and
> private->mutex_node are assigned via of_node_get without first releasing
> any previously stored reference for the same index. When the same comp_id
> or mmsys_id matches multiple nodes, earlier node references are
> overwritten and permanently leaked.
> 
> Suggested-by: Greg KH <gregkh@linuxfoundation.org>
> Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support")
> Cc: stable@vger.kernel.org
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
> Changes in v2:
> - Fix patch format based on reviewer feedback
> ---
>  drivers/gpu/drm/mediatek/mtk_drm_drv.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index c86a3f54f35b..58860f7071a9 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -1138,6 +1138,7 @@ static int mtk_drm_probe(struct platform_device *pdev)
> 
>                         id = of_alias_get_id(node, "mutex");
>                         if (id < 0 || id == private->data->mmsys_id) {
> +                               of_node_put(private->mutex_node);

This driver has an assumption that one mutex_node in one mmsys pipeline.
If more than one, there should be some error happen.
It's not necessary to keep going.
Simply print error message and return error code.

>                                 private->mutex_node = of_node_get(node);
>                                 dev_dbg(dev, "get mutex for mmsys %d", private->data->mmsys_id);
>                         }
> @@ -1154,6 +1155,7 @@ static int mtk_drm_probe(struct platform_device *pdev)
>                 if (!mtk_drm_find_mmsys_comp(private, comp_id))
>                         continue;
> 
> +               of_node_put(private->comp_node[comp_id]);

This driver has an assumption that every comp_id only exist once in device tree.
If more than one, there should be some error happen.
It's not necessary to keep going.
Simply print error message and return error code.

Regards,
CK

>                 private->comp_node[comp_id] = of_node_get(node);
> 
>                 /*
> --
> 2.39.5 (Apple Git-154)
>