From nobody Wed Feb 11 02:07:40 2026 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 56D292356BE for ; Wed, 2 Apr 2025 08:36:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743583001; cv=none; b=ZNI6VpT0H+zI6JiFa4eoh1PfYUADDQmtFaHn0qnirdwTKI6ojL4RDMJ6XeyXEvhRg92RxkfvAAdTomxtaWJ9Pk+b4n7O1g3sb0zXMIMGD6hMCgFkZEiGUzG/gZNEJui3p9ldscU9UvMuERd99Na2q1Su1cwxsEryuOuL4WNXuvk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743583001; c=relaxed/simple; bh=q9gkJHzvjfpt83qtbZofheYpOUw1WDB4WQBgLWzwjPw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RiCfarFYkyFGIRWP/j5nlWLGN1Ogv2ZRm9QBUZrH5cDLqHZy3m5IP0V7jWFKxkD8joEr14TySwKOND7L5u57FOJ/W19+9488bX18XVzIxU7ow9n2Vf2wH2H5lTNeXwAhlgAnWZBvF71JdKWlO4k+Y+mtS64JXUqAhz0M4KgBV+I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=T2dM7mnl; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="T2dM7mnl" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1743582997; bh=q9gkJHzvjfpt83qtbZofheYpOUw1WDB4WQBgLWzwjPw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=T2dM7mnlCbjSMegWXKPfmZnDiHCvP2S8U9UO6vIupTp7U/nCk8EbuHWieUQGtmCWV HpSm6w1VylC9hNUsgm2PJEY4QKxk+meUud7WO8CxrHhMfZpRWC40xKfCrY5EACWnHL Pyb3LTpQT0G6f9MgM7M4y0Qr/Yp4c8MV2IM+wRJKwb4lMwlAbs02INQKknj5eoB6mu 4VY9KDdePnEgAqWYBVYQ9IEU6L/zxu67IbnMHctj6SrHHUaZUxZAdlf7DMBaEGXrba W3ug9NYg+VjdEYqZM4rbh8+UIOp+TLnSgKn/QCaqKsJERjpHBvJz209706vkVwTH8p CeiK1O0cRcGOw== Received: from IcarusMOD.eternityproject.eu (2-237-20-237.ip236.fastwebnet.it [2.237.20.237]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: kholk11) by bali.collaboradmins.com (Postfix) with ESMTPSA id 8379117E014F; Wed, 2 Apr 2025 10:36:36 +0200 (CEST) From: AngeloGioacchino Del Regno To: chunkuang.hu@kernel.org Cc: p.zabel@pengutronix.de, airlied@gmail.com, simona@ffwll.ch, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, nancy.lin@mediatek.com, ck.hu@mediatek.com, djkurtz@chromium.org, littlecvr@chromium.org, bibby.hsieh@mediatek.com, dri-devel@lists.freedesktop.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, wenst@chromium.org, kernel@collabora.com Subject: [PATCH v1 2/5] drm/mediatek: Fix kobject put for component sub-drivers Date: Wed, 2 Apr 2025 10:36:25 +0200 Message-ID: <20250402083628.20111-3-angelogioacchino.delregno@collabora.com> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250402083628.20111-1-angelogioacchino.delregno@collabora.com> References: <20250402083628.20111-1-angelogioacchino.delregno@collabora.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In function mtk_drm_get_all_priv(), this driver is incrementing the refcount for the sub-drivers of mediatek-drm with a call to device_find_child() when taking a reference to all of those child devices. When the component bind fails multiple times this results in a refcount_t overflow, as the reference count is never decremented: fix that by adding a call to put_device() for all of the mmsys devices in a loop, in error cases of mtk_drm_bind() and in the mtk_drm_unbind() callback. Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mm= sys support") Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai --- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/media= tek/mtk_drm_drv.c index a8fbccb50c74..6b31df587507 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c @@ -676,6 +676,10 @@ static int mtk_drm_bind(struct device *dev) for (i =3D 0; i < private->data->mmsys_dev_num; i++) private->all_drm_private[i]->drm =3D NULL; err_put_dev: + for (i =3D 0; i < private->data->mmsys_dev_num; i++) { + /* For device_find_child in mtk_drm_get_all_priv() */ + put_device(private->all_drm_private[i]->dev); + } put_device(private->mutex_dev); return ret; } @@ -683,6 +687,7 @@ static int mtk_drm_bind(struct device *dev) static void mtk_drm_unbind(struct device *dev) { struct mtk_drm_private *private =3D dev_get_drvdata(dev); + int i; =20 /* for multi mmsys dev, unregister drm dev in mmsys master */ if (private->drm_master) { @@ -690,6 +695,10 @@ static void mtk_drm_unbind(struct device *dev) mtk_drm_kms_deinit(private->drm); drm_dev_put(private->drm); =20 + for (i =3D 0; i < private->data->mmsys_dev_num; i++) { + /* For device_find_child in mtk_drm_get_all_priv() */ + put_device(private->all_drm_private[i]->dev); + } put_device(private->mutex_dev); } private->mtk_drm_bound =3D false; --=20 2.48.1