Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Double-free and reference count underflow of the `child_np` device tree node reference due to conflicting ownership with `drm_aux_bridge_register_from_node()`. --
--- Patch [3]: [PATCH v3 3/5] phy: rockchip: phy-rockchip-typec: Add DRM AUX bridge --- commit 7121c384753e095d5a040f2bd93021b7ae8110d7 Author: Chaoyi Chen <[email protected]> phy: rockchip: phy-rockchip-typec: Add DRM AUX bridge Using the DRM_AUX_BRIDGE helper to create the transparent DRM bridge device. > diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c > b/drivers/phy/rockchip/phy-rockchip-typec.c > index d9701b6106d55..48070b50416e5 100644 > --- a/drivers/phy/rockchip/phy-rockchip-typec.c > +++ b/drivers/phy/rockchip/phy-rockchip-typec.c > @@ -1162,16 +1163,24 @@ static int rockchip_typec_phy_probe(struct > platform_device *pdev) > > for_each_available_child_of_node(np, child_np) { > struct phy *phy; > + ret = 0; > > - if (of_node_name_eq(child_np, "dp-port")) > + if (of_node_name_eq(child_np, "dp-port")) { > phy = devm_phy_create(dev, child_np, > &rockchip_dp_phy_ops); > - else if (of_node_name_eq(child_np, "usb3-port")) > + ret = drm_aux_bridge_register_from_node(dev, child_np); > + } else if (of_node_name_eq(child_np, "usb3-port")) > phy = devm_phy_create(dev, child_np, > &rockchip_usb3_phy_ops); > else > continue; > > + if (ret) { > + pm_runtime_disable(dev); > + of_node_put(child_np); [Severity: High] Does this cause a reference count underflow for the child_np device node? drm_aux_bridge_register_from_node() assigns the node to an auxiliary device, and its error and release paths in drm/bridge/aux-bridge.c unconditionally call of_node_put() to drop the reference. However, the for_each_available_child_of_node() iterator owns the reference to child_np during this loop iteration. Passing it to drm_aux_bridge_register_from_node() without acquiring an additional reference via of_node_get() appears to hand off a reference the bridge doesn't own. If drm_aux_bridge_register_from_node() succeeds, the loop advances and drops the iterator's reference, leading to a double-put when the bridge is eventually released. If drm_aux_bridge_register_from_node() fails, it drops the reference internally. The explicit of_node_put(child_np) here in the error block would then cause an immediate double-put. > + return ret; > + } [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=3
