[PATCH] media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled
The function calls of_parse_phandle() which returns a device node with an incremented reference count. When the bonded device is not available, the function returns NULL without releasing the reference, causing a reference leak.
Add of_node_put(np) to release the device node reference. The of_node_put function handles NULL pointers.
Found through static analysis by reviewing the doc of of_parse_phandle() and cross-checking its usage patterns across the codebase.
Fixes: 7625ee981af1 ("[media] media: platform: rcar_drif: Add DRIF support") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin linmq006@gmail.com --- drivers/media/platform/renesas/rcar_drif.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/renesas/rcar_drif.c b/drivers/media/platform/renesas/rcar_drif.c index fc8b6bbef793..c5d676eb1091 100644 --- a/drivers/media/platform/renesas/rcar_drif.c +++ b/drivers/media/platform/renesas/rcar_drif.c @@ -1246,6 +1246,7 @@ static struct device_node *rcar_drif_bond_enabled(struct platform_device *p) if (np && of_device_is_available(np)) return np;
+ of_node_put(np); return NULL; }
On Wed, 3 Sept 2025 at 15:37, Miaoqian Lin linmq006@gmail.com wrote:
The function calls of_parse_phandle() which returns a device node with an incremented reference count. When the bonded device is not available, the function returns NULL without releasing the reference, causing a reference leak.
Add of_node_put(np) to release the device node reference. The of_node_put function handles NULL pointers.
Found through static analysis by reviewing the doc of of_parse_phandle() and cross-checking its usage patterns across the codebase.
Fixes: 7625ee981af1 ("[media] media: platform: rcar_drif: Add DRIF support") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin linmq006@gmail.com
Reviewed-by: Geert Uytterhoeven geert+renesas@glider.be
Note that this is a duplicate of "[PATCH] media: rcar_drif: Fix an OF node leak in rcar_drif_bond_enabled()", which was never applied.
[1] https://lore.kernel.org/20250105111050.3859712-1-joe@pf.is.s.u-tokyo.ac.jp
Gr{oetje,eeting}s,
Geert
Reviewed-by: Geert Uytterhoeven geert+renesas@glider.be
Are any description details still improvable?
Note that this is a duplicate of "[PATCH] media: rcar_drif: Fix an OF node leak in rcar_drif_bond_enabled()", which was never applied.
[1] https://lore.kernel.org/20250105111050.3859712-1-joe@pf.is.s.u-tokyo.ac.jp
Would it be nicer (in principle) to integrate this patch finally?
Regards, Markus
From: Miaoqian Lin linmq006@gmail.com Sent: 03 September 2025 14:37 To: Fabrizio Castro fabrizio.castro.jz@renesas.com; Mauro Carvalho Chehab mchehab@kernel.org; Geert Uytterhoeven geert+renesas@glider.be; magnus.damm magnus.damm@gmail.com; Ramesh Shanmugasundaram ramesh.shanmugasundaram@bp.renesas.com; Hans Verkuil hverkuil@kernel.org; linux- media@vger.kernel.org; linux-renesas-soc@vger.kernel.org; linux-kernel@vger.kernel.org Cc: linmq006@gmail.com; stable@vger.kernel.org Subject: [PATCH] media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled
The function calls of_parse_phandle() which returns a device node with an incremented reference count. When the bonded device is not available, the function returns NULL without releasing the reference, causing a reference leak.
Add of_node_put(np) to release the device node reference. The of_node_put function handles NULL pointers.
Found through static analysis by reviewing the doc of of_parse_phandle() and cross-checking its usage patterns across the codebase.
Fixes: 7625ee981af1 ("[media] media: platform: rcar_drif: Add DRIF support") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin linmq006@gmail.com
Reviewed-by: Fabrizio Castro fabrizio.castro.jz@renesas.com
drivers/media/platform/renesas/rcar_drif.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/renesas/rcar_drif.c b/drivers/media/platform/renesas/rcar_drif.c index fc8b6bbef793..c5d676eb1091 100644 --- a/drivers/media/platform/renesas/rcar_drif.c +++ b/drivers/media/platform/renesas/rcar_drif.c @@ -1246,6 +1246,7 @@ static struct device_node *rcar_drif_bond_enabled(struct platform_device *p) if (np && of_device_is_available(np)) return np;
- of_node_put(np); return NULL;
}
-- 2.35.1
linux-stable-mirror@lists.linaro.org
-
Fabrizio Castro -
Geert Uytterhoeven -
Markus Elfring -
Miaoqian Lin