of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done.
dw_hdmi->bridge is used only in dw_hdmi_top_thread_irq(), so in order to avoid potential use-after-free ensure the irq is freed before putting the dw_hdmi->bridge reference. Signed-off-by: Luca Ceresoli <[email protected]> --- drivers/gpu/drm/meson/meson_dw_hdmi.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c index 0d7c68b29dff..fef1702acb14 100644 --- a/drivers/gpu/drm/meson/meson_dw_hdmi.c +++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c @@ -778,7 +778,7 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master, if (IS_ERR(meson_dw_hdmi->hdmi)) return PTR_ERR(meson_dw_hdmi->hdmi); - meson_dw_hdmi->bridge = of_drm_find_bridge(pdev->dev.of_node); + meson_dw_hdmi->bridge = of_drm_find_and_get_bridge(pdev->dev.of_node); DRM_DEBUG_DRIVER("HDMI controller initialized\n"); @@ -789,8 +789,12 @@ static void meson_dw_hdmi_unbind(struct device *dev, struct device *master, void *data) { struct meson_dw_hdmi *meson_dw_hdmi = dev_get_drvdata(dev); + struct platform_device *pdev = to_platform_device(dev); + int irq = platform_get_irq(pdev, 0); + devm_free_irq(dev, irq, meson_dw_hdmi); dw_hdmi_unbind(meson_dw_hdmi->hdmi); + drm_bridge_put(meson_dw_hdmi->bridge); } static const struct component_ops meson_dw_hdmi_ops = { -- 2.52.0
