Current implementation of .probe() leaks a reference of i2c_adapter.
Implement an error path and call put_device() on the obtained
i2c_adapter in it to fix this refcount bug.

This bug was found by an experimental static analysis tool that I am
developing.

Fixes: 0c275c30176b ("drm/bridge: Add bridge driver for display connectors")
Signed-off-by: Joe Hattori <j...@pf.is.s.u-tokyo.ac.jp>
---
Changes in V2:
- Omit the null check before calling i2c_put_adapter().
---
 drivers/gpu/drm/bridge/display-connector.c | 27 +++++++++++++++-------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/bridge/display-connector.c 
b/drivers/gpu/drm/bridge/display-connector.c
index 72bc508d4e6e..97f3a344a245 100644
--- a/drivers/gpu/drm/bridge/display-connector.c
+++ b/drivers/gpu/drm/bridge/display-connector.c
@@ -332,8 +332,11 @@ static int display_connector_probe(struct platform_device 
*pdev)
                int ret;
 
                ret = display_connector_get_supply(pdev, conn, "dp-pwr");
-               if (ret < 0)
-                       return dev_err_probe(&pdev->dev, ret, "failed to get DP 
PWR regulator\n");
+               if (ret < 0) {
+                       ret = dev_err_probe(&pdev->dev, ret,
+                                           "failed to get DP PWR regulator\n");
+                       goto err_put;
+               }
        }
 
        /* enable DDC */
@@ -345,19 +348,24 @@ static int display_connector_probe(struct platform_device 
*pdev)
 
                if (IS_ERR(conn->ddc_en)) {
                        dev_err(&pdev->dev, "Couldn't get ddc-en gpio\n");
-                       return PTR_ERR(conn->ddc_en);
+                       ret = PTR_ERR(conn->ddc_en);
+                       goto err_put;
                }
 
                ret = display_connector_get_supply(pdev, conn, "hdmi-pwr");
-               if (ret < 0)
-                       return dev_err_probe(&pdev->dev, ret, "failed to get 
HDMI +5V Power regulator\n");
+               if (ret < 0) {
+                       ret = dev_err_probe(
+                               &pdev->dev, ret,
+                               "failed to get HDMI +5V Power regulator\n");
+                       goto err_put;
+               }
        }
 
        if (conn->supply) {
                ret = regulator_enable(conn->supply);
                if (ret) {
                        dev_err(&pdev->dev, "failed to enable PWR regulator: 
%d\n", ret);
-                       return ret;
+                       goto err_put;
                }
        }
 
@@ -383,6 +391,10 @@ static int display_connector_probe(struct platform_device 
*pdev)
        drm_bridge_add(&conn->bridge);
 
        return 0;
+
+err_put:
+       i2c_put_adapter(conn->bridge.ddc);
+       return ret;
 }
 
 static void display_connector_remove(struct platform_device *pdev)
@@ -397,8 +409,7 @@ static void display_connector_remove(struct platform_device 
*pdev)
 
        drm_bridge_remove(&conn->bridge);
 
-       if (!IS_ERR(conn->bridge.ddc))
-               i2c_put_adapter(conn->bridge.ddc);
+       i2c_put_adapter(conn->bridge.ddc);
 }
 
 static const struct of_device_id display_connector_match[] = {
-- 
2.34.1

Reply via email to