Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] drm/bridge: double-put of next_bridge on error and teardown --
commit 836b7cdeed1872c95aba63f08e9bc717bdb9d7d6 Author: Wentao Liang <[email protected]> drm/bridge: lt8912b: Fix next_bridge reference leak in lt8912_parse_dt() This commit attempts to fix a reference leak by manually calling drm_bridge_put() on the next bridge during error paths in lt8912_parse_dt() and during driver teardown in lt8912_put_dt(). > diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c > b/drivers/gpu/drm/bridge/lontium-lt8912b.c > index e347d04b7b2de..3bd920a43e936 100644 > --- a/drivers/gpu/drm/bridge/lontium-lt8912b.c > +++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c > @@ -748,6 +748,7 @@ static int lt8912_parse_dt(struct lt8912 *lt) > return 0; > > err_free_host_node: > + drm_bridge_put(lt->bridge.next_bridge); [Severity: High] Does this manual put operation leave a dangling pointer that will trigger a double-put? The lt struct is allocated via devm_drm_bridge_alloc(), which registers a devres cleanup action that eventually calls __drm_bridge_free(). That cleanup natively handles dropping the chained bridge reference by calling drm_bridge_put(bridge->next_bridge). Since this pointer isn't cleared here, will devres cleanup attempt to put this already-freed reference again if an error occurs after of_drm_find_and_get_bridge() succeeds (for example, if lt8912_get_regulators() fails)? > of_node_put(port_node); > of_node_put(lt->host_node); > return ret; > @@ -755,6 +756,7 @@ static int lt8912_parse_dt(struct lt8912 *lt) > > static int lt8912_put_dt(struct lt8912 *lt) > { > + drm_bridge_put(lt->bridge.next_bridge); [Severity: High] Similarly, will this cause a double-put during driver unbind? When the driver is unbound, lt8912_put_dt() manually drops the reference here. Then the devres cleanup automatically drops it again using the dangling pointer, which could lead to a refcount underflow and use-after-free of the next DRM bridge in the chain. Could we either rely entirely on the devres cleanup, or use something like a clear-and-put approach to avoid leaving a dangling pointer? > of_node_put(lt->host_node); > return 0; > } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
