[PATCH] drm/tegra: rgb: Fix use-after-free and leak in tegra_dc_rgb_probe()

[Wentao Liang]

Move the of_device_is_available() check before devm_add_action_or_reset()
to avoid using np after it may have been freed (if the action registration
fails). Also release np immediately when the device is not available to
prevent a reference leak.

Fixes: 3c3642335065 ("drm/tegra: rgb: Fix the unbound reference count")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/gpu/drm/tegra/rgb.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
index ff5a749710db..d7586fc820ce 100644
--- a/drivers/gpu/drm/tegra/rgb.c
+++ b/drivers/gpu/drm/tegra/rgb.c
@@ -215,13 +215,15 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
 	if (!np)
 		return -ENODEV;
 
+	if (!of_device_is_available(np)) {
+		of_node_put(np);
+		return -ENODEV;
+	}
+
 	err = devm_add_action_or_reset(dc->dev, tegra_dc_of_node_put, np);
 	if (err < 0)
 		return err;
 
-	if (!of_device_is_available(np))
-		return -ENODEV;
-
 	rgb = devm_kzalloc(dc->dev, sizeof(*rgb), GFP_KERNEL);
 	if (!rgb)
 		return -ENOMEM;
-- 
2.34.1