Hi Joe,
Thank you for the patch.
On Sat, Dec 14, 2024 at 10:26:52AM +0900, Joe Hattori wrote:
> Current implementation of .probe() leaks a reference of i2c_adapter.
> Implement an error path and call put_device() on the obtained
> i2c_adapter in it to fix this refcount bug.
>
> This bug was found by an experimental static analysis tool that I am
> developing.
>
> Fixes: 0c275c30176b ("drm/bridge: Add bridge driver for display connectors")
> Signed-off-by: Joe Hattori <joe@xxxxxxxxxxxxxxxxxxxxx>
> ---
> Changes in V2:
> - Omit the null check before calling i2c_put_adapter().
> ---
> drivers/gpu/drm/bridge/display-connector.c | 27 +++++++++++++++-------
> 1 file changed, 19 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
> index 72bc508d4e6e..97f3a344a245 100644
> --- a/drivers/gpu/drm/bridge/display-connector.c
> +++ b/drivers/gpu/drm/bridge/display-connector.c
> @@ -332,8 +332,11 @@ static int display_connector_probe(struct platform_device *pdev)
> int ret;
>
> ret = display_connector_get_supply(pdev, conn, "dp-pwr");
> - if (ret < 0)
> - return dev_err_probe(&pdev->dev, ret, "failed to get DP PWR regulator\n");
> + if (ret < 0) {
> + ret = dev_err_probe(&pdev->dev, ret,
> + "failed to get DP PWR regulator\n");
> + goto err_put;
> + }
> }
>
> /* enable DDC */
> @@ -345,19 +348,24 @@ static int display_connector_probe(struct platform_device *pdev)
>
> if (IS_ERR(conn->ddc_en)) {
> dev_err(&pdev->dev, "Couldn't get ddc-en gpio\n");
> - return PTR_ERR(conn->ddc_en);
> + ret = PTR_ERR(conn->ddc_en);
> + goto err_put;
> }
>
> ret = display_connector_get_supply(pdev, conn, "hdmi-pwr");
> - if (ret < 0)
> - return dev_err_probe(&pdev->dev, ret, "failed to get HDMI +5V Power regulator\n");
> + if (ret < 0) {
> + ret = dev_err_probe(
> + &pdev->dev, ret,
> + "failed to get HDMI +5V Power regulator\n");
ret = dev_err_probe(&pdev->dev, ret,
"failed to get HDMI +5V Power regulator\n");
with that,
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@xxxxxxxxxxxxxxxx>
> + goto err_put;
> + }
> }
>
> if (conn->supply) {
> ret = regulator_enable(conn->supply);
> if (ret) {
> dev_err(&pdev->dev, "failed to enable PWR regulator: %d\n", ret);
> - return ret;
> + goto err_put;
> }
> }
>
> @@ -383,6 +391,10 @@ static int display_connector_probe(struct platform_device *pdev)
> drm_bridge_add(&conn->bridge);
>
> return 0;
> +
> +err_put:
> + i2c_put_adapter(conn->bridge.ddc);
> + return ret;
> }
>
> static void display_connector_remove(struct platform_device *pdev)
> @@ -397,8 +409,7 @@ static void display_connector_remove(struct platform_device *pdev)
>
> drm_bridge_remove(&conn->bridge);
>
> - if (!IS_ERR(conn->bridge.ddc))
> - i2c_put_adapter(conn->bridge.ddc);
> + i2c_put_adapter(conn->bridge.ddc);
> }
>
> static const struct of_device_id display_connector_match[] = {
--
Regards,
Laurent Pinchart
