+ Pavel
-----Original Message----- From: Steven Price steven.price@arm.com Sent: 12 July 2021 16:58 To: Daniel Vetter daniel@ffwll.ch; David Airlie airlied@linux.ie; Maarten Lankhorst maarten.lankhorst@linux.intel.com; Maxime Ripard mripard@kernel.org; Thomas Zimmermann tzimmermann@suse.de Cc: Steven Price steven.price@arm.com; dri-devel@lists.freedesktop.org; linux-kernel@vger.kernel.org; Biju Das biju.das.jz@bp.renesas.com; Laurent Pinchart laurent.pinchart@ideasonboard.com Subject: [PATCH] drm/of: free the iterator object on failure
When bailing out due to the sanity check the iterator value needs to be freed because the early return prevents for_each_child_of_node() from doing the dereference itself.
Fixes: 4ee48cc5586b ("drm: of: Fix double-free bug") Signed-off-by: Steven Price steven.price@arm.com
drivers/gpu/drm/drm_of.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
Daniel's email[1] made me take a look at this function and it appears that for_each_child_of_node()'s interface had caused a bad bug fix due to the hidden reference counting in the iterator.
[1] https://jpn01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flore.ker nel.org%2Fr%2FYOxQ5TbkNrqCGBDJ%2540phenom.ffwll.local&data=04%7C01%7Cb iju.das.jz%40bp.renesas.com%7Cb0570b66e03a43fb8fa008d9454dddaa%7C53d82571d a1947e49cb4625a166a4a2a%7C0%7C0%7C637617023006562683%7CUnknown%7CTWFpbGZsb 3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C10 00&sdata=cQICPYJzmgNkFsNw1wMH9Or73rohnCCGH1DrUg3hvhw%3D&reserved=0
diff --git a/drivers/gpu/drm/drm_of.c b/drivers/gpu/drm/drm_of.c index 197c57477344..997b8827fed2 100644 --- a/drivers/gpu/drm/drm_of.c +++ b/drivers/gpu/drm/drm_of.c @@ -331,8 +331,10 @@ static int drm_of_lvds_get_remote_pixels_type( * configurations by passing the endpoints explicitly to * drm_of_lvds_get_dual_link_pixel_order(). */
if (!current_pt || pixels_type != current_pt)
if (!current_pt || pixels_type != current_pt) {of_node_put(endpoint); return -EINVAL;}}
return pixels_type;
-- 2.20.1