On Tue Jul 7 23:03:26 2026 +0800, Hao-Qun Huang wrote:
> tegra_vip_channel_of_parse() initializes np from dev->of_node without
> taking a reference, but its error paths drop one through the
> err_node_put label. This underflows the refcount of the VIP device's
> OF node when endpoint parsing fails on a malformed device tree.
>
> The only reference the function takes on np is the success-path
> of_node_get() stored in vip->chan.of_node, and that one is already
> released by the tegra_vip_init() error path and by tegra_vip_exit().
>
> Return errors directly instead of jumping to the bogus cleanup label.
>
> Fixes: e740d199cf0f ("staging: media: tegra-video: add support for Tegra20
> parallel input")
> Cc: [email protected]
> Assisted-by: Claude:claude-fable-5
> Signed-off-by: Hao-Qun Huang <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/staging/media/tegra-video/vip.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
---
diff --git a/drivers/staging/media/tegra-video/vip.c
b/drivers/staging/media/tegra-video/vip.c
index 9ff1f1750a15..5fba11e31e1d 100644
--- a/drivers/staging/media/tegra-video/vip.c
+++ b/drivers/staging/media/tegra-video/vip.c
@@ -126,7 +126,7 @@ static int tegra_vip_channel_of_parse(struct tegra_vip *vip)
if (!ep) {
err = -EINVAL;
dev_err_probe(dev, err, "%pOF: error getting endpoint node\n",
np);
- goto err_node_put;
+ return err;
}
fwh = of_fwnode_handle(ep);
@@ -134,14 +134,14 @@ static int tegra_vip_channel_of_parse(struct tegra_vip
*vip)
of_node_put(ep);
if (err) {
dev_err_probe(dev, err, "%pOF: failed to parse v4l2
endpoint\n", np);
- goto err_node_put;
+ return err;
}
num_pads = of_graph_get_endpoint_count(np);
if (num_pads != TEGRA_VIP_PADS_NUM) {
err = -EINVAL;
dev_err_probe(dev, err, "%pOF: need 2 pads, got %d\n", np,
num_pads);
- goto err_node_put;
+ return err;
}
vip->chan.of_node = of_node_get(np);
@@ -149,10 +149,6 @@ static int tegra_vip_channel_of_parse(struct tegra_vip
*vip)
vip->chan.pads[TEGRA_VIP_PAD_SOURCE].flags = MEDIA_PAD_FL_SOURCE;
return 0;
-
-err_node_put:
- of_node_put(np);
- return err;
}
static int tegra_vip_channel_init(struct tegra_vip *vip)
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
