<html><body><p> <pre> On Fri, 2025-07-18 at 11:32 +0800, Ma Ke wrote: > External email : Please do not click links or open attachments until you have verified the sender or the content. > > > Using device_find_child() and of_find_device_by_node() to locate > devices could cause an imbalance in the device's reference count. > device_find_child() and of_find_device_by_node() both call > get_device() to increment the reference count of the found device > before returning the pointer. In mtk_drm_get_all_drm_priv(), these > references are never released through put_device(), resulting in > permanent reference count increments. Additionally, the > for_each_child_of_node() iterator fails to release node references in > all code paths. This leaks device node references when loop > termination occurs before reaching MAX_CRTC. These reference count > leaks may prevent device/node resources from being properly released > during driver unbind operations. > > As comment of device_find_child() says, 'NOTE: you will need to drop > the reference with put_device() after use'. > > Found by code review. > > Cc: stable@vger.kernel.org > Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support") > Signed-off-by: Ma Ke <make24@iscas.ac.cn> > --- > drivers/gpu/drm/mediatek/mtk_drm_drv.c | 27 +++++++++++++++++--------- > 1 file changed, 18 insertions(+), 9 deletions(-) > > diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c > index 7c0c12dde488..c78186debd3e 100644 > --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c > +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c > @@ -388,19 +388,24 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev) > > of_id = of_match_node(mtk_drm_of_ids, node); > if (!of_id) > - continue; > + goto next; > > pdev = of_find_device_by_node(node); > if (!pdev) > - continue; > + goto next; > > drm_dev = device_find_child(&pdev->dev, NULL, mtk_drm_match); > - if (!drm_dev) > - continue; > + if (!drm_dev) { > + put_device(&pdev->dev); > + goto next; I've define label next_put_device_pdev_dev below, so goto next_put_device_pdev_dev; > + } > > temp_drm_priv = dev_get_drvdata(drm_dev); > - if (!temp_drm_priv) > - continue; > + if (!temp_drm_priv) { > + put_device(drm_dev); > + put_device(&pdev->dev); > + goto next; I've define label next_put_device_drm_dev below, so goto next_put_device_drm_dev; > + } > > if (temp_drm_priv->data->main_len) > all_drm_priv[CRTC_MAIN] = temp_drm_priv; > @@ -412,10 +417,14 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev) > if (temp_drm_priv->mtk_drm_bound) > cnt++; > > - if (cnt == MAX_CRTC) { > - of_node_put(node); next_put_device_drm_dev: > + put_device(drm_dev); next_put_device_pdev_dev: > + put_device(&pdev->dev); > + > +next: next_put_node: Regards, CK > + of_node_put(node); > + > + if (cnt == MAX_CRTC) > break; > - } > } > > if (drm_priv->data->mmsys_dev_num == cnt) { > -- > 2.25.1 > > </pre> </p></body></html><pre>************* MEDIATEK Confidentiality Notice ******************** The information contained in this e-mail message (including any attachments) may be confidential, proprietary, privileged, or otherwise exempt from disclosure under applicable laws. It is intended to be conveyed only to the designated recipient(s). Any use, dissemination, distribution, printing, retaining or copying of this e-mail (including its attachments) by unintended recipient(s) is strictly prohibited and may be unlawful. If you are not an intended recipient of this e-mail, or believe that you have received this e-mail in error, please notify the sender immediately (by replying to this e-mail), delete any and all copies of this e-mail (including any attachments) from your system, and do not disclose the content of this e-mail to any other person. Thank you! </pre>