drm/mediatek: fix potential OF node use-after-free
authorJohan Hovold <johan@kernel.org>
Fri, 29 Aug 2025 09:03:44 +0000 (11:03 +0200)
committerChun-Kuang Hu <chunkuang.hu@kernel.org>
Wed, 10 Sep 2025 12:49:37 +0000 (12:49 +0000)
commit4de37a48b6b58faaded9eb765047cf0d8785ea18
tree411ce236049188921119666f1ca98fa100edd9a1
parentc34414883f773412964404d77cd2fea04c6f7d60
drm/mediatek: fix potential OF node use-after-free

The for_each_child_of_node() helper drops the reference it takes to each
node as it iterates over children and an explicit of_node_put() is only
needed when exiting the loop early.

Drop the recently introduced bogus additional reference count decrement
at each iteration that could potentially lead to a use-after-free.

Fixes: 1f403699c40f ("drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv")
Cc: Ma Ke <make24@iscas.ac.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: CK Hu <ck.hu@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patchwork.kernel.org/project/dri-devel/patch/20250829090345.21075-2-johan@kernel.org/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
drivers/gpu/drm/mediatek/mtk_drm_drv.c