it6505_parse_dt() obtains an endpoint node with
of_graph_get_endpoint_by_regs() and drops that reference with
of_node_put() right away, before the node is checked and passed to
it6505_get_data_lanes_count(), of_property_read_u32_array() and
of_property_read_variable_u64_array().
The reference from of_graph_get_endpoint_by_regs() is the only thing
keeping the endpoint alive, so releasing it first leaves the following
property lookups operating on a node that another of_node_put() can free
concurrently, for instance when a device tree overlay providing the
endpoint is removed.
Keep the reference until the properties have been read and only then
call of_node_put(), for both endpoints parsed by the function.
Fixes: 380d920b582d ("drm/bridge: add it6505 driver to read data-lanes and
link-frequencies from dt")
Cc: [email protected]
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <[email protected]>
---
drivers/gpu/drm/bridge/ite-it6505.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c
b/drivers/gpu/drm/bridge/ite-it6505.c
index e136ac71edbb..228a0861919b 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -3342,8 +3342,6 @@ static void it6505_parse_dt(struct it6505 *it6505)
}
ep = of_graph_get_endpoint_by_regs(np, 1, 0);
- of_node_put(ep);
-
if (ep) {
len = it6505_get_data_lanes_count(ep, 1, 4);
@@ -3355,14 +3353,14 @@ static void it6505_parse_dt(struct it6505 *it6505)
*max_lane_count = MAX_LANE_COUNT;
dev_err(dev, "error data-lanes, use default");
}
+
+ of_node_put(ep);
} else {
*max_lane_count = MAX_LANE_COUNT;
dev_err(dev, "error endpoint, use default");
}
ep = of_graph_get_endpoint_by_regs(np, 0, 0);
- of_node_put(ep);
-
if (ep) {
len = of_property_read_variable_u64_array(ep,
"link-frequencies",
@@ -3381,6 +3379,8 @@ static void it6505_parse_dt(struct it6505 *it6505)
dev_err(dev, "error link frequencies, use default");
*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
}
+
+ of_node_put(ep);
} else {
dev_err(dev, "error endpoint, use default");
*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
--
2.34.1
