[PATCH v8 5/7] phy: rockchip: phy-rockchip-typec: Add DRM AUX bridge

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] phy: rockchip: typec: unbalanced of_node_put() in rockchip_typec_phy_probe()
--

commit 5dd2a89486cce6e81a7e0bfa3f39b495d7254541
Author: Chaoyi Chen <chaoyi.chen at rock-chips.com>

phy: rockchip: phy-rockchip-typec: Add DRM AUX bridge

This commit registers a transparent DRM AUX bridge device for the dp-port
child node in the Rockchip Type-C PHY driver using
drm_aux_bridge_register_from_node().

> diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c b/drivers/phy/rockchip/phy-rockchip-typec.c
> index d9701b6106d55..48070b50416e5 100644
> --- a/drivers/phy/rockchip/phy-rockchip-typec.c
> +++ b/drivers/phy/rockchip/phy-rockchip-typec.c
[ ... ]
> @@ -1162,16 +1163,24 @@ static int rockchip_typec_phy_probe(struct platform_device *pdev)
>  
>  	for_each_available_child_of_node(np, child_np) {
>  		struct phy *phy;
> +		ret = 0;
>  
> -		if (of_node_name_eq(child_np, "dp-port"))
> +		if (of_node_name_eq(child_np, "dp-port")) {
>  			phy = devm_phy_create(dev, child_np,
>  					      &rockchip_dp_phy_ops);
> -		else if (of_node_name_eq(child_np, "usb3-port"))
> +			ret = drm_aux_bridge_register_from_node(dev, child_np);
> +		} else if (of_node_name_eq(child_np, "usb3-port"))
>  			phy = devm_phy_create(dev, child_np,
>  					      &rockchip_usb3_phy_ops);
>  		else
>  			continue;
>  
> +		if (ret) {
> +			pm_runtime_disable(dev);
> +			of_node_put(child_np);
> +			return ret;
> +		}

[Severity: High]
Does passing child_np directly to drm_aux_bridge_register_from_node() here
cause an OF node reference count underflow on child_np?

In rockchip_typec_phy_probe(), for_each_available_child_of_node() holds a
reference on child_np only for the current loop iteration and drops it when
advancing to the next child (or via of_node_put(child_np) on early return).

However, in drivers/gpu/drm/bridge/aux-bridge.c,
drm_aux_bridge_register_from_node() assigns adev->dev.of_node via
device_set_node() without taking a reference with of_node_get(), while both
its error path and drm_aux_bridge_release() drop a reference:

drivers/gpu/drm/bridge/aux-bridge.c:drm_aux_bridge_register_from_node() {
	if (np)
		device_set_node(&adev->dev, of_fwnode_handle(np));
	else
		device_set_of_node_from_dev(&adev->dev, parent);

	ret = auxiliary_device_init(adev);
	if (ret) {
		of_node_put(adev->dev.of_node);
		ida_free(&drm_aux_bridge_ida, adev->id);
		kfree(adev);
		return ret;
	}
}

drivers/gpu/drm/bridge/aux-bridge.c:drm_aux_bridge_release() {
	struct auxiliary_device *adev = to_auxiliary_dev(dev);

	of_node_put(dev->of_node);
	ida_free(&drm_aux_bridge_ida, adev->id);

	kfree(adev);
}

If drm_aux_bridge_register_from_node() fails at or after
auxiliary_device_init(), it calls of_node_put(child_np) internally, and then
the error path in rockchip_typec_phy_probe() calls of_node_put(child_np) a
second time.

Similarly, if drm_aux_bridge_register_from_node() succeeds, the loop drops
its reference on child_np when advancing to the next child node, and
drm_aux_bridge_release() will later call of_node_put(dev->of_node) when the
auxiliary device is released without owning a reference.

>  		if (IS_ERR(phy)) {
>  			dev_err(dev, "failed to create phy: %pOFn\n",
>  				child_np);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261020072816.180-1-kernel@airkyi.com?part=5