On Tue, Apr 07, 2026 at 08:46:29AM +0000, Wentao Liang wrote:
> Move the of_device_is_available() check before devm_add_action_or_reset()
> to avoid using np after it may have been freed (if the action registration
> fails). Also release np immediately when the device is not available to
> prevent a reference leak.
>
> Fixes: 3c3642335065 ("drm/tegra: rgb: Fix the unbound reference count")
> Cc: [email protected]
> Signed-off-by: Wentao Liang <[email protected]>
> ---
> drivers/gpu/drm/tegra/rgb.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
> index ff5a749710db..d7586fc820ce 100644
> --- a/drivers/gpu/drm/tegra/rgb.c
> +++ b/drivers/gpu/drm/tegra/rgb.c
> @@ -215,13 +215,15 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
> if (!np)
> return -ENODEV;
>
> + if (!of_device_is_available(np)) {
> + of_node_put(np);
> + return -ENODEV;
> + }
> +
> err = devm_add_action_or_reset(dc->dev, tegra_dc_of_node_put, np);
> if (err < 0)
> return err;
>
> - if (!of_device_is_available(np))
> - return -ENODEV;
> -I don't see how this achieves anything. If the action registration fails, devm_add_action_or_reset() executes the action (that's the "or_reset" part), so that takes care of the leak. Similarly, when things fail, np is not going to be used anymore since we immediately return, so there's no use-after-free either. Thierry
signature.asc
Description: PGP signature
