linux-kernel - [PATCH] drm/bridge: samsung-dsim: Fix potential double-free in TE GPIO handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250804122418.104360-1-linmq006@gmail.com>
Date: Mon,  4 Aug 2025 20:24:18 +0800
From: Miaoqian Lin <linmq006@...il.com>
To: Inki Dae <inki.dae@...sung.com>,
	Jagan Teki <jagan@...rulasolutions.com>,
	Marek Szyprowski <m.szyprowski@...sung.com>,
	Andrzej Hajda <andrzej.hajda@...el.com>,
	Neil Armstrong <neil.armstrong@...aro.org>,
	Robert Foss <rfoss@...nel.org>,
	Laurent Pinchart <Laurent.pinchart@...asonboard.com>,
	Jonas Karlman <jonas@...boo.se>,
	Jernej Skrabec <jernej.skrabec@...il.com>,
	Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
	Maxime Ripard <mripard@...nel.org>,
	Thomas Zimmermann <tzimmermann@...e.de>,
	David Airlie <airlied@...il.com>,
	Simona Vetter <simona@...ll.ch>,
	Marek Vasut <marex@...x.de>,
	dri-devel@...ts.freedesktop.org,
	linux-kernel@...r.kernel.org
Cc: linmq006@...il.com
Subject: [PATCH] drm/bridge: samsung-dsim: Fix potential double-free in TE GPIO handling

The devm_gpiod_get_optional() function uses device-managed resources that
are automatically cleaned up. The
gpiod_put() calls in both the error path of samsung_dsim_register_te_irq()
and in samsung_dsim_unregister_te_irq() are redundant and may lead to
double-free when the device is removed.

Fixes: e7447128ca4a ("drm: bridge: Generalize Exynos-DSI driver into a Samsung DSIM bridge")
Signed-off-by: Miaoqian Lin <linmq006@...il.com>
---
 drivers/gpu/drm/bridge/samsung-dsim.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c
index bccc88d25948..6ffaee6b7738 100644
--- a/drivers/gpu/drm/bridge/samsung-dsim.c
+++ b/drivers/gpu/drm/bridge/samsung-dsim.c
@@ -1691,7 +1691,6 @@ static int samsung_dsim_register_te_irq(struct samsung_dsim *dsi, struct device
 				   IRQF_TRIGGER_RISING | IRQF_NO_AUTOEN, "TE", dsi);
 	if (ret) {
 		dev_err(dsi->dev, "request interrupt failed with %d\n", ret);
-		gpiod_put(dsi->te_gpio);
 		return ret;
 	}
 
@@ -1790,10 +1789,8 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
 
 static void samsung_dsim_unregister_te_irq(struct samsung_dsim *dsi)
 {
-	if (dsi->te_gpio) {
+	if (dsi->te_gpio)
 		free_irq(gpiod_to_irq(dsi->te_gpio), dsi);
-		gpiod_put(dsi->te_gpio);
-	}
 }
 
 static int samsung_dsim_host_detach(struct mipi_dsi_host *host,
-- 
2.35.1