Re: [PATCH] drm/tegra: rgb: Fix use-after-free and leak in tegra_dc_rgb_probe()

[Thierry Reding]

On Tue, Apr 07, 2026 at 08:46:29AM +0000, Wentao Liang wrote:
> Move the of_device_is_available() check before devm_add_action_or_reset()
> to avoid using np after it may have been freed (if the action registration
> fails). Also release np immediately when the device is not available to
> prevent a reference leak.
> 
> Fixes: 3c3642335065 ("drm/tegra: rgb: Fix the unbound reference count")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>  drivers/gpu/drm/tegra/rgb.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
> index ff5a749710db..d7586fc820ce 100644
> --- a/drivers/gpu/drm/tegra/rgb.c
> +++ b/drivers/gpu/drm/tegra/rgb.c
> @@ -215,13 +215,15 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
>  	if (!np)
>  		return -ENODEV;
>  
> +	if (!of_device_is_available(np)) {
> +		of_node_put(np);
> +		return -ENODEV;
> +	}
> +
>  	err = devm_add_action_or_reset(dc->dev, tegra_dc_of_node_put, np);
>  	if (err < 0)
>  		return err;
>  
> -	if (!of_device_is_available(np))
> -		return -ENODEV;
> -

I don't see how this achieves anything. If the action registration
fails, devm_add_action_or_reset() executes the action (that's the
"or_reset" part), so that takes care of the leak. Similarly, when things
fail, np is not going to be used anymore since we immediately return, so
there's no use-after-free either.

Thierry

Attachment: signature.asc
Description: PGP signature