[PATCH] drm/mipi-dsi: fix of_node reference leak in of_mipi_dsi_device_add error path

[Wentao Liang]

of_mipi_dsi_device_add() acquires an of_node reference via
of_node_get() before passing it to mipi_dsi_device_register_full().
However, when mipi_dsi_device_register_full() fails (e.g.,
mipi_dsi_device_add() returns an error), the acquired reference is
never released, causing the device_node to leak.

device_set_node() merely stores the fwnode pointer without taking
an additional refcount, so the reference from of_node_get() is the
only one the device holds on the success path.  On the error path
the reference must be released by the caller that acquired it.

Fix this by checking the return value of
mipi_dsi_device_register_full() and calling of_node_put() on error.

Fixes: c63ae8a9686b ("drm/dsi: Use mipi_dsi_device_register_full() for DSI device creation")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/gpu/drm/drm_mipi_dsi.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c
index 0390e14d3157..b54c10d92c57 100644
--- a/drivers/gpu/drm/drm_mipi_dsi.c
+++ b/drivers/gpu/drm/drm_mipi_dsi.c
@@ -163,6 +163,7 @@ of_mipi_dsi_device_add(struct mipi_dsi_host *host, struct device_node *node)
 {
 	struct mipi_dsi_device_info info = { };
 	int ret;
+	struct mipi_dsi_device *dsi;
 	u32 reg;
 
 	if (of_alias_from_compatible(node, info.type, sizeof(info.type)) < 0) {
@@ -179,8 +180,10 @@ of_mipi_dsi_device_add(struct mipi_dsi_host *host, struct device_node *node)
 
 	info.channel = reg;
 	info.node = of_node_get(node);
-
-	return mipi_dsi_device_register_full(host, &info);
+	dsi = mipi_dsi_device_register_full(host, &info);
+	if (IS_ERR(dsi))
+		of_node_put(node);
+	return dsi;
 }
 #else
 static struct mipi_dsi_device *
-- 
2.34.1