| Message ID | 20241214012652.2104807-1-joe@pf.is.s.u-tokyo.ac.jp (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] drm/bridge: display-connector: implement the error path of .probe() | expand |
On Sat, Dec 14, 2024 at 10:26:52AM +0900, Joe Hattori wrote: > Current implementation of .probe() leaks a reference of i2c_adapter. > Implement an error path and call put_device() on the obtained > i2c_adapter in it to fix this refcount bug. > > This bug was found by an experimental static analysis tool that I am > developing. > > Fixes: 0c275c30176b ("drm/bridge: Add bridge driver for display connectors") > Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> > --- > Changes in V2: > - Omit the null check before calling i2c_put_adapter(). > --- > drivers/gpu/drm/bridge/display-connector.c | 27 +++++++++++++++------- > 1 file changed, 19 insertions(+), 8 deletions(-) Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Hi Joe, Thank you for the patch. On Sat, Dec 14, 2024 at 10:26:52AM +0900, Joe Hattori wrote: > Current implementation of .probe() leaks a reference of i2c_adapter. > Implement an error path and call put_device() on the obtained > i2c_adapter in it to fix this refcount bug. > > This bug was found by an experimental static analysis tool that I am > developing. > > Fixes: 0c275c30176b ("drm/bridge: Add bridge driver for display connectors") > Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> > --- > Changes in V2: > - Omit the null check before calling i2c_put_adapter(). > --- > drivers/gpu/drm/bridge/display-connector.c | 27 +++++++++++++++------- > 1 file changed, 19 insertions(+), 8 deletions(-) > > diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c > index 72bc508d4e6e..97f3a344a245 100644 > --- a/drivers/gpu/drm/bridge/display-connector.c > +++ b/drivers/gpu/drm/bridge/display-connector.c > @@ -332,8 +332,11 @@ static int display_connector_probe(struct platform_device *pdev) > int ret; > > ret = display_connector_get_supply(pdev, conn, "dp-pwr"); > - if (ret < 0) > - return dev_err_probe(&pdev->dev, ret, "failed to get DP PWR regulator\n"); > + if (ret < 0) { > + ret = dev_err_probe(&pdev->dev, ret, > + "failed to get DP PWR regulator\n"); > + goto err_put; > + } > } > > /* enable DDC */ > @@ -345,19 +348,24 @@ static int display_connector_probe(struct platform_device *pdev) > > if (IS_ERR(conn->ddc_en)) { > dev_err(&pdev->dev, "Couldn't get ddc-en gpio\n"); > - return PTR_ERR(conn->ddc_en); > + ret = PTR_ERR(conn->ddc_en); > + goto err_put; > } > > ret = display_connector_get_supply(pdev, conn, "hdmi-pwr"); > - if (ret < 0) > - return dev_err_probe(&pdev->dev, ret, "failed to get HDMI +5V Power regulator\n"); > + if (ret < 0) { > + ret = dev_err_probe( > + &pdev->dev, ret, > + "failed to get HDMI +5V Power regulator\n"); ret = dev_err_probe(&pdev->dev, ret, "failed to get HDMI +5V Power regulator\n"); with that, Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> > + goto err_put; > + } > } > > if (conn->supply) { > ret = regulator_enable(conn->supply); > if (ret) { > dev_err(&pdev->dev, "failed to enable PWR regulator: %d\n", ret); > - return ret; > + goto err_put; > } > } > > @@ -383,6 +391,10 @@ static int display_connector_probe(struct platform_device *pdev) > drm_bridge_add(&conn->bridge); > > return 0; > + > +err_put: > + i2c_put_adapter(conn->bridge.ddc); > + return ret; > } > > static void display_connector_remove(struct platform_device *pdev) > @@ -397,8 +409,7 @@ static void display_connector_remove(struct platform_device *pdev) > > drm_bridge_remove(&conn->bridge); > > - if (!IS_ERR(conn->bridge.ddc)) > - i2c_put_adapter(conn->bridge.ddc); > + i2c_put_adapter(conn->bridge.ddc); > } > > static const struct of_device_id display_connector_match[] = {
diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c index 72bc508d4e6e..97f3a344a245 100644 --- a/drivers/gpu/drm/bridge/display-connector.c +++ b/drivers/gpu/drm/bridge/display-connector.c @@ -332,8 +332,11 @@ static int display_connector_probe(struct platform_device *pdev) int ret; ret = display_connector_get_supply(pdev, conn, "dp-pwr"); - if (ret < 0) - return dev_err_probe(&pdev->dev, ret, "failed to get DP PWR regulator\n"); + if (ret < 0) { + ret = dev_err_probe(&pdev->dev, ret, + "failed to get DP PWR regulator\n"); + goto err_put; + } } /* enable DDC */ @@ -345,19 +348,24 @@ static int display_connector_probe(struct platform_device *pdev) if (IS_ERR(conn->ddc_en)) { dev_err(&pdev->dev, "Couldn't get ddc-en gpio\n"); - return PTR_ERR(conn->ddc_en); + ret = PTR_ERR(conn->ddc_en); + goto err_put; } ret = display_connector_get_supply(pdev, conn, "hdmi-pwr"); - if (ret < 0) - return dev_err_probe(&pdev->dev, ret, "failed to get HDMI +5V Power regulator\n"); + if (ret < 0) { + ret = dev_err_probe( + &pdev->dev, ret, + "failed to get HDMI +5V Power regulator\n"); + goto err_put; + } } if (conn->supply) { ret = regulator_enable(conn->supply); if (ret) { dev_err(&pdev->dev, "failed to enable PWR regulator: %d\n", ret); - return ret; + goto err_put; } } @@ -383,6 +391,10 @@ static int display_connector_probe(struct platform_device *pdev) drm_bridge_add(&conn->bridge); return 0; + +err_put: + i2c_put_adapter(conn->bridge.ddc); + return ret; } static void display_connector_remove(struct platform_device *pdev) @@ -397,8 +409,7 @@ static void display_connector_remove(struct platform_device *pdev) drm_bridge_remove(&conn->bridge); - if (!IS_ERR(conn->bridge.ddc)) - i2c_put_adapter(conn->bridge.ddc); + i2c_put_adapter(conn->bridge.ddc); } static const struct of_device_id display_connector_match[] = {
Current implementation of .probe() leaks a reference of i2c_adapter. Implement an error path and call put_device() on the obtained i2c_adapter in it to fix this refcount bug. This bug was found by an experimental static analysis tool that I am developing. Fixes: 0c275c30176b ("drm/bridge: Add bridge driver for display connectors") Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> --- Changes in V2: - Omit the null check before calling i2c_put_adapter(). --- drivers/gpu/drm/bridge/display-connector.c | 27 +++++++++++++++------- 1 file changed, 19 insertions(+), 8 deletions(-)