Hi Steven,
Thank you for the patch.
On Mon, Jul 12, 2021 at 04:57:58PM +0100, Steven Price wrote:
When bailing out due to the sanity check the iterator value needs to be freed because the early return prevents for_each_child_of_node() from doing the dereference itself.
Fixes: 4ee48cc5586b ("drm: of: Fix double-free bug")
I don't think the Fixes tag is correct, the issue was already present before 4ee48cc5586b. The fix looks right though.
Signed-off-by: Steven Price steven.price@arm.com
drivers/gpu/drm/drm_of.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
Daniel's email[1] made me take a look at this function and it appears that for_each_child_of_node()'s interface had caused a bad bug fix due to the hidden reference counting in the iterator.
[1] https://lore.kernel.org/r/YOxQ5TbkNrqCGBDJ%40phenom.ffwll.local
diff --git a/drivers/gpu/drm/drm_of.c b/drivers/gpu/drm/drm_of.c index 197c57477344..997b8827fed2 100644 --- a/drivers/gpu/drm/drm_of.c +++ b/drivers/gpu/drm/drm_of.c @@ -331,8 +331,10 @@ static int drm_of_lvds_get_remote_pixels_type( * configurations by passing the endpoints explicitly to * drm_of_lvds_get_dual_link_pixel_order(). */
if (!current_pt || pixels_type != current_pt)
if (!current_pt || pixels_type != current_pt) {of_node_put(endpoint); return -EINVAL;}}
return pixels_type;