Skip to contentSkip to conversation

drm/mediatek: fix device leaks at bind

PATCH In review Johan Hovold 3 participants 6 messages Jul 22, 2025 – Aug 29, 2025

Subsystems (4)
Stable branch DRM drivers Arm MediaTek DRM drivers for MediaTek
lore
Share & tools
lore

Johan Hovold

author
#0 lore raw

PATCH 1/1 drm/mediatek: fix device leaks at bind

Make sure to drop the references to the sibling platform devices and their child drm devices taken by of_find_device_by_node() and device_find_child() when initialising the driver data during bind().

Fixes 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support")
Cc [email protected] # 6.4
Cc Nancy.Lin <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
---
 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 2 ++
 1 file changed, 2 insertions(+)
drivers/gpu/drm/mediatek/mtk_drm_drv.c +2 -0
index 7c0c12dde488..33b83576af7e 100644
@@ -395,10 +395,12 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev)
 			continue;
 
 		drm_dev = device_find_child(&pdev->dev, NULL, mtk_drm_match);
+		put_device(&pdev->dev);
 		if (!drm_dev)
 			continue;
 
 		temp_drm_priv = dev_get_drvdata(drm_dev);
+		put_device(drm_dev);
 		if (!temp_drm_priv)
 			continue;
Signature · 1 line
2.49.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 6 lines · Johan Hovold

External email : Please do not click links or open attachments until you have verified the sender or the content.

Make sure to drop the references to the sibling platform devices and their child drm devices taken by of_find_device_by_node() and device_find_child() when initialising the driver data during bind().

Reviewed-by CK Hu <[email protected]>
Quoted 29 lines
Fixes 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support")
Cc [email protected] # 6.4
Cc Nancy.Lin <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
---
 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 2 ++
 1 file changed, 2 insertions(+)
drivers/gpu/drm/mediatek/mtk_drm_drv.c +2 -1
index 7c0c12dde488..33b83576af7e 100644
@@ -395,10 +395,12 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev)
                        continue;
 
                drm_dev = device_find_child(&pdev->dev, NULL, mtk_drm_match);
+               put_device(&pdev->dev);
                if (!drm_dev)
                        continue;
 
                temp_drm_priv = dev_get_drvdata(drm_dev);
+               put_device(drm_dev);
                if (!temp_drm_priv)
                        continue;
 
--

2.49.1

author
#2 lore raw
In reply to Johan Hovold
Quoted 8 lines · Johan Hovold

Make sure to drop the references to the sibling platform devices and their child drm devices taken by of_find_device_by_node() and device_find_child() when initialising the driver data during bind().

Fixes 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support")
Cc [email protected] # 6.4
Cc Nancy.Lin <[email protected]>
Signed-off-by Johan Hovold <[email protected]>

Can this one be picked up?

Johan

maintainer
#3 lore raw

Hi, Johan:

Johan Hovold <[email protected]> 於 2025年8月27日 週三 下午5:51寫道：

Quoted 6 lines · Johan Hovold
Quoted 4 lines

Make sure to drop the references to the sibling platform devices and their child drm devices taken by of_find_device_by_node() and device_find_child() when initialising the driver data during bind().

Quoted 6 lines
Quoted 4 lines
Fixes 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support")
Cc [email protected] # 6.4
Cc Nancy.Lin <[email protected]>
Signed-off-by Johan Hovold <[email protected]>

Can this one be picked up?

Ma Ke has sent a similar patch [1] before you. And that patch fix more things. I've already pick up the final version [2].

[1] https://patchwork.kernel.org/project/dri-devel/patch/[email protected]/
[2] https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux.git/commit/?h=mediatek-drm-fixes-20250825&id=1f403699c40f0806a707a9a6eed3b8904224021a

Regards,
Chun-Kuang.

Quoted 2 lines

Johan

author
#4 lore raw
Quoted 12 lines · Chun-Kuang Hu

Johan Hovold <[email protected]> 於 2025年8月27日 週三 下午5:51寫道：

Quoted 10 lines · Johan Hovold
Quoted 8 lines

Make sure to drop the references to the sibling platform devices and their child drm devices taken by of_find_device_by_node() and device_find_child() when initialising the driver data during bind().

Fixes 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support")
Cc [email protected] # 6.4
Cc Nancy.Lin <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
Quoted 7 lines
Quoted 1 line

Can this one be picked up?

Ma Ke has sent a similar patch [1] before you. And that patch fix more things. I've already pick up the final version [2].

[1] https://patchwork.kernel.org/project/dri-devel/patch/[email protected]/
[2] https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux.git/commit/?h=mediatek-drm-fixes-20250825&id=1f403699c40f0806a707a9a6eed3b8904224021a

I'm afraid that patch is completely broken and introduces a potential use-after-free by adding a bogus decrement of the OF node refcount.

I suggest you drop that one and pick up mine instead which is correct and cleaner.

Johan

author
#5 lore raw
Quoted 18 lines · Johan Hovold
Quoted 17 lines · Chun-Kuang Hu

Johan Hovold <[email protected]> 於 2025年8月27日 週三 下午5:51寫道：

Quoted 11 lines · Johan Hovold
Quoted 8 lines

Make sure to drop the references to the sibling platform devices and their child drm devices taken by of_find_device_by_node() and device_find_child() when initialising the driver data during bind().

Fixes 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support")
Cc [email protected] # 6.4
Cc Nancy.Lin <[email protected]>
Signed-off-by Johan Hovold <[email protected]>

Can this one be picked up?

Ma Ke has sent a similar patch [1] before you. And that patch fix more things. I've already pick up the final version [2].

Quoted 8 lines
Quoted 2 lines

[1] https://patchwork.kernel.org/project/dri-devel/patch/[email protected]/
[2] https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux.git/commit/?h=mediatek-drm-fixes-20250825&id=1f403699c40f0806a707a9a6eed3b8904224021a

I'm afraid that patch is completely broken and introduces a potential use-after-free by adding a bogus decrement of the OF node refcount.

I suggest you drop that one and pick up mine instead which is correct and cleaner.

I see now that that patch was included in a drm pull request for rc4. I'll send an incremental fix instead.

Johan