In the for_each_child_of_node loop, private->comp_node[comp_id] and
private->mutex_node are assigned via of_node_get without first releasing
any previously stored reference for the same index. When the same comp_id
or mmsys_id matches multiple nodes, earlier node references are
overwritten and permanently leaked.

Suggested-by: Greg KH <[email protected]>
Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys 
support")
Cc: [email protected]
Signed-off-by: WenTao Liang <[email protected]>
---
Changes in v2:
- Fix patch format based on reviewer feedback
---
 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c 
b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index c86a3f54f35b..58860f7071a9 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -1138,6 +1138,7 @@ static int mtk_drm_probe(struct platform_device *pdev)
 
                        id = of_alias_get_id(node, "mutex");
                        if (id < 0 || id == private->data->mmsys_id) {
+                               of_node_put(private->mutex_node);
                                private->mutex_node = of_node_get(node);
                                dev_dbg(dev, "get mutex for mmsys %d", 
private->data->mmsys_id);
                        }
@@ -1154,6 +1155,7 @@ static int mtk_drm_probe(struct platform_device *pdev)
                if (!mtk_drm_find_mmsys_comp(private, comp_id))
                        continue;
 
+               of_node_put(private->comp_node[comp_id]);
                private->comp_node[comp_id] = of_node_get(node);
 
                /*
-- 
2.39.5 (Apple Git-154)

Reply via email to