Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] phy: rockchip: typec: unbalanced of_node_put() in rockchip_typec_phy_probe() --
commit 5dd2a89486cce6e81a7e0bfa3f39b495d7254541 Author: Chaoyi Chen <[email protected]> phy: rockchip: phy-rockchip-typec: Add DRM AUX bridge This commit registers a transparent DRM AUX bridge device for the dp-port child node in the Rockchip Type-C PHY driver using drm_aux_bridge_register_from_node(). > diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c > b/drivers/phy/rockchip/phy-rockchip-typec.c > index d9701b6106d55..48070b50416e5 100644 > --- a/drivers/phy/rockchip/phy-rockchip-typec.c > +++ b/drivers/phy/rockchip/phy-rockchip-typec.c [ ... ] > @@ -1162,16 +1163,24 @@ static int rockchip_typec_phy_probe(struct > platform_device *pdev) > > for_each_available_child_of_node(np, child_np) { > struct phy *phy; > + ret = 0; > > - if (of_node_name_eq(child_np, "dp-port")) > + if (of_node_name_eq(child_np, "dp-port")) { > phy = devm_phy_create(dev, child_np, > &rockchip_dp_phy_ops); > - else if (of_node_name_eq(child_np, "usb3-port")) > + ret = drm_aux_bridge_register_from_node(dev, child_np); > + } else if (of_node_name_eq(child_np, "usb3-port")) > phy = devm_phy_create(dev, child_np, > &rockchip_usb3_phy_ops); > else > continue; > > + if (ret) { > + pm_runtime_disable(dev); > + of_node_put(child_np); > + return ret; > + } [Severity: High] Does passing child_np directly to drm_aux_bridge_register_from_node() here cause an OF node reference count underflow on child_np? In rockchip_typec_phy_probe(), for_each_available_child_of_node() holds a reference on child_np only for the current loop iteration and drops it when advancing to the next child (or via of_node_put(child_np) on early return). However, in drivers/gpu/drm/bridge/aux-bridge.c, drm_aux_bridge_register_from_node() assigns adev->dev.of_node via device_set_node() without taking a reference with of_node_get(), while both its error path and drm_aux_bridge_release() drop a reference: drivers/gpu/drm/bridge/aux-bridge.c:drm_aux_bridge_register_from_node() { if (np) device_set_node(&adev->dev, of_fwnode_handle(np)); else device_set_of_node_from_dev(&adev->dev, parent); ret = auxiliary_device_init(adev); if (ret) { of_node_put(adev->dev.of_node); ida_free(&drm_aux_bridge_ida, adev->id); kfree(adev); return ret; } } drivers/gpu/drm/bridge/aux-bridge.c:drm_aux_bridge_release() { struct auxiliary_device *adev = to_auxiliary_dev(dev); of_node_put(dev->of_node); ida_free(&drm_aux_bridge_ida, adev->id); kfree(adev); } If drm_aux_bridge_register_from_node() fails at or after auxiliary_device_init(), it calls of_node_put(child_np) internally, and then the error path in rockchip_typec_phy_probe() calls of_node_put(child_np) a second time. Similarly, if drm_aux_bridge_register_from_node() succeeds, the loop drops its reference on child_np when advancing to the next child node, and drm_aux_bridge_release() will later call of_node_put(dev->of_node) when the auxiliary device is released without owning a reference. > if (IS_ERR(phy)) { > dev_err(dev, "failed to create phy: %pOFn\n", > child_np); [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=5
