linux-kernel - Re: [PATCH] drm/mediatek: Fix refcounting in mtk_drm_get_all_drm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aOOQu9Lu_3-EhtGd@hovoldconsulting.com>
Date: Mon, 6 Oct 2025 11:49:47 +0200
From: Johan Hovold <johan@...nel.org>
To: Sjoerd Simons <sjoerd@...labora.com>
Cc: Chun-Kuang Hu <chunkuang.hu@...nel.org>,
	Philipp Zabel <p.zabel@...gutronix.de>,
	David Airlie <airlied@...il.com>, Simona Vetter <simona@...ll.ch>,
	Matthias Brugger <matthias.bgg@...il.com>,
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>,
	CK Hu <ck.hu@...iatek.com>, dri-devel@...ts.freedesktop.org,
	linux-mediatek@...ts.infradead.org, linux-kernel@...r.kernel.org,
	linux-arm-kernel@...ts.infradead.org, kernel@...labora.com,
	stable@...r.kernel.org
Subject: Re: [PATCH] drm/mediatek: Fix refcounting in mtk_drm_get_all_drm_priv

On Fri, Oct 03, 2025 at 10:08:28AM +0200, Sjoerd Simons wrote:
> dev_get_drvdata simply returns the driver data part of drm_dev, which
> has its lifetime bound to the drm_dev.

No, that is not correct: the driver data goes away when the driver is
unbound, not when the device is freed.

> So only drop the reference in the
> error paths, on success they will get dropped later.

But there is indeed a partial fix for the device leak here which was
overlooked. Good catch.

> Cc: stable@...r.kernel.org
> Fixes: 9ba2556cef1df ("drm/mediatek: clean up driver data initialisation")

This is clearly not the commit that introduced the issue (even if I also
failed to notice the reference imbalance).

Since there is no need to keep the references, I've just sent a fix
which instead fixes this by dropping the previous partial fix:

	https://lore.kernel.org/r/20251006093937.27869-1-johan@kernel.org

Johan