diff options
| author | Dmitry Baryshkov <dmitry.baryshkov@linaro.org> | 2023-12-17 01:59:10 +0200 |
|---|---|---|
| committer | Dmitry Baryshkov <dmitry.baryshkov@linaro.org> | 2023-12-19 02:06:16 +0200 |
| commit | 6914968a0b52507bf19d85e5fb9e35272e17cd35 (patch) | |
| tree | 7c1bd8914b5449a3236f5f2eb692ec54a9d53451 /drivers/gpu/drm/bridge | |
| parent | 8a53e29fe05c56f643eaab285f224c09b9c3dd4c (diff) | |
| download | linux-stable-6914968a0b52507bf19d85e5fb9e35272e17cd35.tar.gz linux-stable-6914968a0b52507bf19d85e5fb9e35272e17cd35.tar.bz2 linux-stable-6914968a0b52507bf19d85e5fb9e35272e17cd35.zip | |
drm/bridge: properly refcount DT nodes in aux bridge drivers
The aux-bridge and aux-hpd-bridge drivers didn't call of_node_get() on
the device nodes further used for dev->of_node and platform data. When
bridge devices are released, the reference counts are decreased,
resulting in refcount underflow / use-after-free warnings. Get
corresponding refcounts during AUX bridge allocation.
Reported-by: Luca Weiss <luca.weiss@fairphone.com>
Fixes: 2a04739139b2 ("drm/bridge: add transparent bridge helper")
Fixes: 26f4bac3d884 ("drm/bridge: aux-hpd: Replace of_device.h with explicit include")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231216235910.911958-1-dmitry.baryshkov@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Diffstat (limited to 'drivers/gpu/drm/bridge')
| -rw-r--r-- | drivers/gpu/drm/bridge/aux-bridge.c | 3 | ||||
| -rw-r--r-- | drivers/gpu/drm/bridge/aux-hpd-bridge.c | 4 |
2 files changed, 4 insertions, 3 deletions
diff --git a/drivers/gpu/drm/bridge/aux-bridge.c b/drivers/gpu/drm/bridge/aux-bridge.c index 49d7c2ab1ecc..b29980f95379 100644 --- a/drivers/gpu/drm/bridge/aux-bridge.c +++ b/drivers/gpu/drm/bridge/aux-bridge.c @@ -6,6 +6,7 @@ */ #include <linux/auxiliary_bus.h> #include <linux/module.h> +#include <linux/of.h> #include <drm/drm_bridge.h> #include <drm/bridge/aux-bridge.h> @@ -57,7 +58,7 @@ int drm_aux_bridge_register(struct device *parent) adev->id = ret; adev->name = "aux_bridge"; adev->dev.parent = parent; - adev->dev.of_node = parent->of_node; + adev->dev.of_node = of_node_get(parent->of_node); adev->dev.release = drm_aux_bridge_release; ret = auxiliary_device_init(adev); diff --git a/drivers/gpu/drm/bridge/aux-hpd-bridge.c b/drivers/gpu/drm/bridge/aux-hpd-bridge.c index 1999a053d59b..bb55f697a181 100644 --- a/drivers/gpu/drm/bridge/aux-hpd-bridge.c +++ b/drivers/gpu/drm/bridge/aux-hpd-bridge.c @@ -68,9 +68,9 @@ struct device *drm_dp_hpd_bridge_register(struct device *parent, adev->id = ret; adev->name = "dp_hpd_bridge"; adev->dev.parent = parent; - adev->dev.of_node = parent->of_node; + adev->dev.of_node = of_node_get(parent->of_node); adev->dev.release = drm_aux_hpd_bridge_release; - adev->dev.platform_data = np; + adev->dev.platform_data = of_node_get(np); ret = auxiliary_device_init(adev); if (ret) { |