From nobody Tue Jun 16 11:20:42 2026 Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 36E5E276049 for ; Sun, 19 Apr 2026 12:21:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776601317; cv=none; b=qBm5qENDeytA3pfm3W4YtfDPxG4jC7GwFP0eEGDTk2v+4ip93eJLDY0zEhrILYpcdoe/F07zAT0Dmf8LXRtUA0XcN+fK+EafgHvo0L98+4l9Pv8fxTAQ3fs2nQ3OAvbU8SzPecflNtl7ZfHbSL775N4q4I1x6TdDf+SRjDZEn9A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776601317; c=relaxed/simple; bh=nmgKREmCWZiDkKASZtmRc2MVHkFKpfUbB1epmq3XSBo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ihT2YLAr14foc3hz7r8AUC37X2KQRKBhrAllBI92GFyMigK/j4Aw+B1s0giVi5W1HlzTmsP4qW1Gxsh6LbzWQRMp2e7FW4A44yxM3/0lx/Xvzd9L4HldYycF5pDQ4U3AB9Nie2QLoT5+QAbQ53BTzAlpptEgKdRy3GGfwxyr43U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=X5+I2G8o; arc=none smtp.client-ip=209.85.210.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="X5+I2G8o" Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-82f6b592fc7so964763b3a.3 for ; Sun, 19 Apr 2026 05:21:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776601316; x=1777206116; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=pmWG7OM2EB7RxxwskQ0/zeTI1Kmre4JByGl1ksiUCqU=; b=X5+I2G8oz/+yG4hTU2ZhYBfWqwlcvhdhVmhH6aYXUZ2hR2A5XWKz5yZ3xi5EUv3aTH Kash6Y2MHbNjZQ68b9tRHYtyujsDMq1i8jAzBctzdi01dbBrDeWcJIXH1SBu4w/MMlRV bP08/jkfoKrTNacumiWVEl7Ie3Zbf+ILGe8VTfdIXXaWU6Mr5oI1Xzc9tsYbeqzOnEkM kITO58pPTbHh/pcwEdsjxT7wGFmBQL2yM+phGXdwdbJEGCHTgmZ1vJ4OP5oqQTXd01QF QDV7qKEo8JWu6GZYwe1+fnB88j+oQAtrDNNz7P6TfKVrzD2ZMkq8+V5W1LsDwLEk3xR8 2iZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776601316; x=1777206116; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=pmWG7OM2EB7RxxwskQ0/zeTI1Kmre4JByGl1ksiUCqU=; b=TnYmRreGb9zXnAWIPUIHmkfETPAg7OaKHHCuvcSnRhGNLinn61Ykfy96AnrylVdt0o isdwQVmztzau6Fa9uycKhTJBpPeyuKPoPloPXGLo3FN9yUuAuR8r3KNWC3z2L8C0rG0u dy8TpR18r+LWxw0yPneT+GGheHd+qpacEFVJBUzH5kdKywVH826PRgYeaiZYdHi0mhPZ OfgwvzxIZGqLQyKcjrdWH3N5fvONcJBWDefsEanAWMbziYGlTpzXzwEdEGEQrwdvOBMu ic3ciKM3Eq8us8mb7in6LbJMt4wWWmT6LS2BsX/4EWMFXhLstH/0ctmC59bR5GYrIdqd zikA== X-Forwarded-Encrypted: i=1; AFNElJ9TU4XZF/K7+kmR2Hk5WNCv7DEOsnwV/hb9B1nUmEpOtvrv5Epex41k9ro09Bvo9G8J8RHuS9fTPCkEh9o=@vger.kernel.org X-Gm-Message-State: AOJu0Yz4c4QSpKy6hyiJzRyGw6o+TOE+UAwCaQ9UPimH0NYApfiewOTi pPEDitvEjtLZtdE3+K9mOtv7rxUi4nYFsUSaqEiETQpuf3ud3GZ0fPWk X-Gm-Gg: AeBDieslgmKcXGPOZECqk7dOSIN6oKDCBvpYx7/FtBTBhB3TEvbOyTY85YEqWz03i04 6RoekF42FgWVZevu+k71S4WQf3gGzKLrfsbyWUEdvZNd88DW8NckHMBz55vjwbWzxZyu28+Vvm3 EIwpUyh6hMVmDLXPS60iBYl5vWWeMkKqEm+TXUxk3oIgBtkcha3WmrDM6hq//N0KCj9BQk3U9j7 /H2QlBJG5O8SlxPI0p1G0g+sEn6dyqV277eaYKMMsRjK0qfB6hcYMfmNID8fSEpUIwd22zWNeH8 0HgnIdzfmcENUQ1X+74IPH9f9JZb+i39lwYZKXPlavCjGL5ghJ4BJXG2E2cBQ+9NEeooAwHQSYo 4aawYMZBznjZ3Qm82XXTgOlP3HoFc3RD6MJOI7BlngdCktQWIm625rC4xl3vHYIn71bwwp2+fpu 7O5LF9FcdsQJeKT+pb34U4wKJFaZlt15CB X-Received: by 2002:a05:6a00:2d8d:b0:82f:1d38:f68f with SMTP id d2e1a72fcca58-82f8c8bee86mr10893475b3a.31.1776601315542; Sun, 19 Apr 2026 05:21:55 -0700 (PDT) Received: from lgs.. ([2408:8417:d50:4775:fc0:88de:ed15:556b]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82f8e9d2fa9sm7700034b3a.16.2026.04.19.05.21.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 19 Apr 2026 05:21:55 -0700 (PDT) From: Guangshuo Li To: Liu Ying , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Frank Li , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , Luca Ceresoli , dri-devel@lists.freedesktop.org, imx@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li , stable@vger.kernel.org Subject: [PATCH] drm/bridge: imx8qxp-pxl2dpi: avoid of_node_put() on ERR_PTR() Date: Sun, 19 Apr 2026 20:21:34 +0800 Message-ID: <20260419122134.97529-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" imx8qxp_pxl2dpi_get_available_ep_from_port() may return ERR_PTR(-ENODEV) or ERR_PTR(-EINVAL). imx8qxp_pxl2dpi_find_next_bridge() stores that value in a __free(device_node) variable and then immediately checks IS_ERR(ep). On the error path, returning from the function triggers the cleanup handler for __free(device_node). Since the device_node cleanup helper only checks for NULL before calling of_node_put(), this results in of_node_put(ERR_PTR(...)), which may lead to an invalid kobject_put() dereference and crash the kernel. Fix it by avoiding __free(device_node) for the endpoint pointer and releasing it explicitly after obtaining the remote port parent. This issue was found by a custom static analysis tool. Fixes: ceea3f7806a10 ("drm/bridge: imx8qxp-pxl2dpi: simplify put of device_= node pointers") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c b/drivers/gpu/drm= /bridge/imx/imx8qxp-pxl2dpi.c index 441fd32dc91c..3610ca94a8e6 100644 --- a/drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c +++ b/drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c @@ -264,12 +264,15 @@ imx8qxp_pxl2dpi_get_available_ep_from_port(struct imx= 8qxp_pxl2dpi *p2d, =20 static int imx8qxp_pxl2dpi_find_next_bridge(struct imx8qxp_pxl2dpi *p2d) { - struct device_node *ep __free(device_node) =3D - imx8qxp_pxl2dpi_get_available_ep_from_port(p2d, 1); + struct device_node *ep; + + ep =3D imx8qxp_pxl2dpi_get_available_ep_from_port(p2d, 1); if (IS_ERR(ep)) return PTR_ERR(ep); =20 struct device_node *remote __free(device_node) =3D of_graph_get_remote_po= rt_parent(ep); + of_node_put(ep); + if (!remote || !of_device_is_available(remote)) { DRM_DEV_ERROR(p2d->dev, "no available remote\n"); return -ENODEV; --=20 2.43.0