[PATCH] drm/tegra: rgb: Fix the unbound reference count

[Thierry Reding]

On Wed, Feb 05, 2025 at 11:21:35AM +0000, Biju Das wrote:
> The of_get_child_by_name() increments the refcount in tegra_dc_rgb_probe,
> but the driver does not decrement the refcount during unbind. Fix the
> unbound reference count using devm_add_action_or_reset() helper.
> 
> Fixes: d8f4a9eda006 ("drm: Add NVIDIA Tegra20 support")
> Signed-off-by: Biju Das <biju.das.jz at bp.renesas.com>
> ---
>  drivers/gpu/drm/tegra/rgb.c | 14 +++++++++++++-
>  1 file changed, 13 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
> index 1e8ec50b759e..2065157daab3 100644
> --- a/drivers/gpu/drm/tegra/rgb.c
> +++ b/drivers/gpu/drm/tegra/rgb.c
> @@ -200,6 +200,11 @@ static const struct drm_encoder_helper_funcs tegra_rgb_encoder_helper_funcs = {
>  	.atomic_check = tegra_rgb_encoder_atomic_check,
>  };
>  
> +static void tegra_dc_of_node_put(void *data)
> +{
> +	of_node_put(data);
> +}
> +
>  int tegra_dc_rgb_probe(struct tegra_dc *dc)
>  {
>  	struct device_node *np;
> @@ -207,7 +212,14 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
>  	int err;
>  
>  	np = of_get_child_by_name(dc->dev->of_node, "rgb");
> -	if (!np || !of_device_is_available(np))
> +	if (!np)
> +		return -ENODEV;
> +
> +	err = devm_add_action_or_reset(dc->dev, tegra_dc_of_node_put, dc->dev);

Actually, I think this needs to be:

  err = devm_add_action_or_reset(dc->dev, tegra_dc_of_node_put, np);

otherwise tegra_dc_of_node_put() would attempt to call of_node_put() on
dc->dev, which won't work, or rather cause corruption of some sort.

Shout if you disagree.

Thierry
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20250507/037bd9aa/attachment.sig>