Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

drm/display: bridge_connector: get/put the panel_bridge

The panel_bridge pointer is taken inside the loop and used after the
loop. Being a local variable, use a cleanup action to ensure it is put on
return.

Based on the code structure the panel_bridge pointer might be assigned
during multiple loop iterations. Even though this is probably not possible
in the practice, ensure there is no reference leak by putting the reference
to the old value before overwriting with the new value.

Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Tested-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> # db410c
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://patch.msgid.link/20251017-drm-bridge-alloc-getput-bridge-connector-fix-hdmi_cec-v2-3-667abf6d47c0@bootlin.com
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>

+5 -3
+5 -3
drivers/gpu/drm/display/drm_bridge_connector.c
··· 652 652 struct drm_bridge_connector *bridge_connector; 653 653 struct drm_connector *connector; 654 654 struct i2c_adapter *ddc = NULL; 655 - struct drm_bridge *panel_bridge = NULL; 655 + struct drm_bridge *panel_bridge __free(drm_bridge_put) = NULL; 656 656 unsigned int supported_formats = BIT(HDMI_COLORSPACE_RGB); 657 657 unsigned int max_bpc = 8; 658 658 bool support_hdcp = false; ··· 787 787 if (bridge->ddc) 788 788 ddc = bridge->ddc; 789 789 790 - if (drm_bridge_is_panel(bridge)) 791 - panel_bridge = bridge; 790 + if (drm_bridge_is_panel(bridge)) { 791 + drm_bridge_put(panel_bridge); 792 + panel_bridge = drm_bridge_get(bridge); 793 + } 792 794 793 795 if (bridge->support_hdcp) 794 796 support_hdcp = true;