Re: [PATCH v4 2/5] drm/bridge: aux: Add drm_aux_bridge_register_from_node()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing of_node_get() when setting the device node from `np` in `drm_aux_bridge_register_from_node()` leads to a reference count underflow, as cleanup and release paths unconditionally drop the reference.
--

--- Patch [2]: [PATCH v4 2/5] drm/bridge: aux: Add drm_aux_bridge_register_from_node() ---
commit d7b1eb76e37cb91bfdbe4b86349165417e109776
Author: Chaoyi Chen <chaoyi.chen@rock-chips.com>

drm/bridge: aux: Add drm_aux_bridge_register_from_node()

This commit introduces drm_aux_bridge_register_from_node() to allow
specifying the of_node corresponding to the bridge when registering
an auxiliary bridge device.

> diff --git a/drivers/gpu/drm/bridge/aux-bridge.c b/drivers/gpu/drm/bridge/aux-bridge.c
> index 169939d233102..2b48612d6d1ba 100644
> --- a/drivers/gpu/drm/bridge/aux-bridge.c
> +++ b/drivers/gpu/drm/bridge/aux-bridge.c
[ ... ]
> @@ -63,7 +64,10 @@ int drm_aux_bridge_register(struct device *parent)
>  	adev->dev.parent = parent;
>  	adev->dev.release = drm_aux_bridge_release;
>  
> -	device_set_of_node_from_dev(&adev->dev, parent);
> +	if (np)
> +		device_set_node(&adev->dev, of_fwnode_handle(np));

[Severity: High]
When np is provided, device_set_node() is used. Unlike 
device_set_of_node_from_dev(), device_set_node() does not appear to
increment the reference count of the target node.

> +	else
> +		device_set_of_node_from_dev(&adev->dev, parent);
>  
>  	ret = auxiliary_device_init(adev);
>  	if (ret) {

Could this lead to a reference count underflow for the provided np?

The error path here unconditionally calls of_node_put(adev->dev.of_node).
Additionally, the drm_aux_bridge_release() callback also unconditionally
drops a reference to the device's of_node when the device is destroyed.

Since device_set_node() doesn't take an initial reference on np, will
these put operations result in a use-after-free for the device tree node?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727064408.101-1-kernel@airkyi.com?part=2

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy