[PATCH v1] drm/sysfb: ofdrm: fix PCI device reference leaks

[PATCH v1] drm/sysfb: ofdrm: fix PCI device reference leaks

[Yuho Choi]

display_get_pci_dev_of() gets a referenced PCI device via
pci_get_device(). Drop that reference when pci_enable_device() fails and
release it during the managed teardown path after pci_disable_device().

Without that, ofdrm leaks the pci_dev reference on both the error path
and the normal cleanup path.

Fixes: c8a17756c425 ("drm/ofdrm: Add ofdrm for Open Firmware framebuffers")
Co-developed-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Co-developed-by: Taegyu Kim <tmk5904@psu.edu>
Signed-off-by: Taegyu Kim <tmk5904@psu.edu>
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
 drivers/gpu/drm/sysfb/ofdrm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/sysfb/ofdrm.c b/drivers/gpu/drm/sysfb/ofdrm.c
index d38ba70f4e0d3..247cf13c80a05 100644
--- a/drivers/gpu/drm/sysfb/ofdrm.c
+++ b/drivers/gpu/drm/sysfb/ofdrm.c
@@ -350,6 +350,7 @@ static void ofdrm_pci_release(void *data)
 	struct pci_dev *pcidev = data;
 
 	pci_disable_device(pcidev);
+	pci_dev_put(pcidev);
 }
 
 static int ofdrm_device_init_pci(struct ofdrm_device *odev)
@@ -375,6 +376,7 @@ static int ofdrm_device_init_pci(struct ofdrm_device *odev)
 	if (ret) {
 		drm_err(dev, "pci_enable_device(%s) failed: %d\n",
 			dev_name(&pcidev->dev), ret);
+		pci_dev_put(pcidev);
 		return ret;
 	}
 	ret = devm_add_action_or_reset(&pdev->dev, ofdrm_pci_release, pcidev);
-- 
2.50.1 (Apple Git-155)

Re: [PATCH v1] drm/sysfb: ofdrm: fix PCI device reference leaks

[Thomas Zimmermann]

Hi,

thanks for the patch.

Am 20.04.26 um 02:25 schrieb Yuho Choi:
> display_get_pci_dev_of() gets a referenced PCI device via
> pci_get_device(). Drop that reference when pci_enable_device() fails and
> release it during the managed teardown path after pci_disable_device().
>
> Without that, ofdrm leaks the pci_dev reference on both the error path
> and the normal cleanup path.

Did you use an AI to find or fix this bug?

https://docs.kernel.org/process/coding-assistants.html

Best regards
Thomas

>
> Fixes: c8a17756c425 ("drm/ofdrm: Add ofdrm for Open Firmware framebuffers")
> Co-developed-by: Myeonghun Pak <mhun512@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Co-developed-by: Taegyu Kim <tmk5904@psu.edu>
> Signed-off-by: Taegyu Kim <tmk5904@psu.edu>
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
> ---
>   drivers/gpu/drm/sysfb/ofdrm.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/drivers/gpu/drm/sysfb/ofdrm.c b/drivers/gpu/drm/sysfb/ofdrm.c
> index d38ba70f4e0d3..247cf13c80a05 100644
> --- a/drivers/gpu/drm/sysfb/ofdrm.c
> +++ b/drivers/gpu/drm/sysfb/ofdrm.c
> @@ -350,6 +350,7 @@ static void ofdrm_pci_release(void *data)
>   	struct pci_dev *pcidev = data;
>   
>   	pci_disable_device(pcidev);
> +	pci_dev_put(pcidev);
>   }
>   
>   static int ofdrm_device_init_pci(struct ofdrm_device *odev)
> @@ -375,6 +376,7 @@ static int ofdrm_device_init_pci(struct ofdrm_device *odev)
>   	if (ret) {
>   		drm_err(dev, "pci_enable_device(%s) failed: %d\n",
>   			dev_name(&pcidev->dev), ret);
> +		pci_dev_put(pcidev);
>   		return ret;
>   	}
>   	ret = devm_add_action_or_reset(&pdev->dev, ofdrm_pci_release, pcidev);

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

Re: [PATCH v1] drm/sysfb: ofdrm: fix PCI device reference leaks

[최유호]

Dear Thomas,

This issue was identified during our ongoing static-analysis research
while reviewing
kernel code. Specifically, an experimental static analysis tool found
that we are currently
developing. The tool is not public yet, so I prefer not to disclose
further project details
at this stage. AI was used only for cross-review, not as the primary
means of finding or
fixing the bug. I manually reviewed the code and verified the issue
before sending
the patch.

Best regards,
Yuho Choi


On Mon, 20 Apr 2026 at 02:21, Thomas Zimmermann <tzimmermann@suse.de> wrote:
>
> Hi,
>
> thanks for the patch.
>
> Am 20.04.26 um 02:25 schrieb Yuho Choi:
> > display_get_pci_dev_of() gets a referenced PCI device via
> > pci_get_device(). Drop that reference when pci_enable_device() fails and
> > release it during the managed teardown path after pci_disable_device().
> >
> > Without that, ofdrm leaks the pci_dev reference on both the error path
> > and the normal cleanup path.
>
> Did you use an AI to find or fix this bug?
>
> https://docs.kernel.org/process/coding-assistants.html
>
> Best regards
> Thomas
>
> >
> > Fixes: c8a17756c425 ("drm/ofdrm: Add ofdrm for Open Firmware framebuffers")
> > Co-developed-by: Myeonghun Pak <mhun512@gmail.com>
> > Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> > Co-developed-by: Ijae Kim <ae878000@gmail.com>
> > Signed-off-by: Ijae Kim <ae878000@gmail.com>
> > Co-developed-by: Taegyu Kim <tmk5904@psu.edu>
> > Signed-off-by: Taegyu Kim <tmk5904@psu.edu>
> > Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
> > ---
> >   drivers/gpu/drm/sysfb/ofdrm.c | 2 ++
> >   1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/gpu/drm/sysfb/ofdrm.c b/drivers/gpu/drm/sysfb/ofdrm.c
> > index d38ba70f4e0d3..247cf13c80a05 100644
> > --- a/drivers/gpu/drm/sysfb/ofdrm.c
> > +++ b/drivers/gpu/drm/sysfb/ofdrm.c
> > @@ -350,6 +350,7 @@ static void ofdrm_pci_release(void *data)
> >       struct pci_dev *pcidev = data;
> >
> >       pci_disable_device(pcidev);
> > +     pci_dev_put(pcidev);
> >   }
> >
> >   static int ofdrm_device_init_pci(struct ofdrm_device *odev)
> > @@ -375,6 +376,7 @@ static int ofdrm_device_init_pci(struct ofdrm_device *odev)
> >       if (ret) {
> >               drm_err(dev, "pci_enable_device(%s) failed: %d\n",
> >                       dev_name(&pcidev->dev), ret);
> > +             pci_dev_put(pcidev);
> >               return ret;
> >       }
> >       ret = devm_add_action_or_reset(&pdev->dev, ofdrm_pci_release, pcidev);
>
> --
> --
> Thomas Zimmermann
> Graphics Driver Developer
> SUSE Software Solutions Germany GmbH
> Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
> GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
>
>

Re: [PATCH v1] drm/sysfb: ofdrm: fix PCI device reference leaks

[Thomas Zimmermann]

Hi

Am 20.04.26 um 22:55 schrieb 최유호:
> Dear Thomas,
>
> This issue was identified during our ongoing static-analysis research
> while reviewing
> kernel code. Specifically, an experimental static analysis tool found
> that we are currently
> developing. The tool is not public yet, so I prefer not to disclose
> further project details
> at this stage. AI was used only for cross-review, not as the primary
> means of finding or
> fixing the bug. I manually reviewed the code and verified the issue
> before sending
> the patch.

Thanks.

Best regards
Thomas

>
> Best regards,
> Yuho Choi
>
>
> On Mon, 20 Apr 2026 at 02:21, Thomas Zimmermann <tzimmermann@suse.de> wrote:
>> Hi,
>>
>> thanks for the patch.
>>
>> Am 20.04.26 um 02:25 schrieb Yuho Choi:
>>> display_get_pci_dev_of() gets a referenced PCI device via
>>> pci_get_device(). Drop that reference when pci_enable_device() fails and
>>> release it during the managed teardown path after pci_disable_device().
>>>
>>> Without that, ofdrm leaks the pci_dev reference on both the error path
>>> and the normal cleanup path.
>> Did you use an AI to find or fix this bug?
>>
>> https://docs.kernel.org/process/coding-assistants.html
>>
>> Best regards
>> Thomas
>>
>>> Fixes: c8a17756c425 ("drm/ofdrm: Add ofdrm for Open Firmware framebuffers")
>>> Co-developed-by: Myeonghun Pak <mhun512@gmail.com>
>>> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
>>> Co-developed-by: Ijae Kim <ae878000@gmail.com>
>>> Signed-off-by: Ijae Kim <ae878000@gmail.com>
>>> Co-developed-by: Taegyu Kim <tmk5904@psu.edu>
>>> Signed-off-by: Taegyu Kim <tmk5904@psu.edu>
>>> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
>>> ---
>>>    drivers/gpu/drm/sysfb/ofdrm.c | 2 ++
>>>    1 file changed, 2 insertions(+)
>>>
>>> diff --git a/drivers/gpu/drm/sysfb/ofdrm.c b/drivers/gpu/drm/sysfb/ofdrm.c
>>> index d38ba70f4e0d3..247cf13c80a05 100644
>>> --- a/drivers/gpu/drm/sysfb/ofdrm.c
>>> +++ b/drivers/gpu/drm/sysfb/ofdrm.c
>>> @@ -350,6 +350,7 @@ static void ofdrm_pci_release(void *data)
>>>        struct pci_dev *pcidev = data;
>>>
>>>        pci_disable_device(pcidev);
>>> +     pci_dev_put(pcidev);
>>>    }
>>>
>>>    static int ofdrm_device_init_pci(struct ofdrm_device *odev)
>>> @@ -375,6 +376,7 @@ static int ofdrm_device_init_pci(struct ofdrm_device *odev)
>>>        if (ret) {
>>>                drm_err(dev, "pci_enable_device(%s) failed: %d\n",
>>>                        dev_name(&pcidev->dev), ret);
>>> +             pci_dev_put(pcidev);
>>>                return ret;
>>>        }
>>>        ret = devm_add_action_or_reset(&pdev->dev, ofdrm_pci_release, pcidev);
>> --
>> --
>> Thomas Zimmermann
>> Graphics Driver Developer
>> SUSE Software Solutions Germany GmbH
>> Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
>> GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
>>
>>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

Re: drm/sysfb: ofdrm: fix PCI device reference leaks

[Markus Elfring]

> This issue was identified during our ongoing static-analysis research
> while reviewing kernel code. Specifically, an experimental static analysis tool found
> that we are currently developing. The tool is not public yet, so I prefer not to disclose
> further project details at this stage. …

Will any additional background information become available?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/researcher-guidelines.rst?h=v7.0#n5

Regards,
Markus

Re: [PATCH v1] drm/sysfb: ofdrm: fix PCI device reference leaks

[Thomas Zimmermann]

Am 20.04.26 um 02:25 schrieb Yuho Choi:
> display_get_pci_dev_of() gets a referenced PCI device via
> pci_get_device(). Drop that reference when pci_enable_device() fails and
> release it during the managed teardown path after pci_disable_device().
>
> Without that, ofdrm leaks the pci_dev reference on both the error path
> and the normal cleanup path.
>
> Fixes: c8a17756c425 ("drm/ofdrm: Add ofdrm for Open Firmware framebuffers")
> Co-developed-by: Myeonghun Pak <mhun512@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Co-developed-by: Taegyu Kim <tmk5904@psu.edu>
> Signed-off-by: Taegyu Kim <tmk5904@psu.edu>
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>

Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>

> ---
>   drivers/gpu/drm/sysfb/ofdrm.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/drivers/gpu/drm/sysfb/ofdrm.c b/drivers/gpu/drm/sysfb/ofdrm.c
> index d38ba70f4e0d3..247cf13c80a05 100644
> --- a/drivers/gpu/drm/sysfb/ofdrm.c
> +++ b/drivers/gpu/drm/sysfb/ofdrm.c
> @@ -350,6 +350,7 @@ static void ofdrm_pci_release(void *data)
>   	struct pci_dev *pcidev = data;
>   
>   	pci_disable_device(pcidev);
> +	pci_dev_put(pcidev);
>   }
>   
>   static int ofdrm_device_init_pci(struct ofdrm_device *odev)
> @@ -375,6 +376,7 @@ static int ofdrm_device_init_pci(struct ofdrm_device *odev)
>   	if (ret) {
>   		drm_err(dev, "pci_enable_device(%s) failed: %d\n",
>   			dev_name(&pcidev->dev), ret);
> +		pci_dev_put(pcidev);
>   		return ret;
>   	}
>   	ret = devm_add_action_or_reset(&pdev->dev, ofdrm_pci_release, pcidev);

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)