[PATCH] drm/bridge: it6505: fix use-after-free in it6505_parse_dt()

[PATCH] drm/bridge: it6505: fix use-after-free in it6505_parse_dt()

[Wentao Liang]

Move of_node_put(ep) after the endpoint is fully used, otherwise the
node may be freed before being accessed in the if (ep) block.

Fixes: 380d920b582d ("drm/bridge: add it6505 driver to read data-lanes and link-frequencies from dt")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/bridge/ite-it6505.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index 89649c17ffad..2e01b331a168 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -3371,7 +3371,6 @@ static void it6505_parse_dt(struct it6505 *it6505)
 	}
 
 	ep = of_graph_get_endpoint_by_regs(np, 1, 0);
-	of_node_put(ep);
 
 	if (ep) {
 		len = it6505_get_data_lanes_count(ep, 1, 4);
@@ -3384,14 +3383,13 @@ static void it6505_parse_dt(struct it6505 *it6505)
 			*max_lane_count = MAX_LANE_COUNT;
 			dev_err(dev, "error data-lanes, use default");
 		}
+		of_node_put(ep);
 	} else {
 		*max_lane_count = MAX_LANE_COUNT;
 		dev_err(dev, "error endpoint, use default");
 	}
 
 	ep = of_graph_get_endpoint_by_regs(np, 0, 0);
-	of_node_put(ep);
-
 	if (ep) {
 		len = of_property_read_variable_u64_array(ep,
 							  "link-frequencies",
@@ -3410,6 +3408,7 @@ static void it6505_parse_dt(struct it6505 *it6505)
 			dev_err(dev, "error link frequencies, use default");
 			*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
 		}
+		of_node_put(ep);
 	} else {
 		dev_err(dev, "error endpoint, use default");
 		*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
-- 
2.34.1

Claude review: drm/bridge: it6505: fix use-after-free in it6505_parse_dt()

[Claude Code Review Bot]

Overall Series Review

Subject: drm/bridge: it6505: fix use-after-free in it6505_parse_dt()
Author: Wentao Liang <vulab@iscas.ac.cn>
Patches: 1
Reviewed: 2026-04-12T13:40:31.451726

---

This is a single patch claiming to fix a use-after-free in `it6505_parse_dt()`. The claim is that `of_node_put(ep)` is called before `ep` is used inside the `if (ep)` block. While the diagnosis of a real bug is correct — calling `of_node_put()` before using the node is wrong — there is a significant gap in the fix: it only places `of_node_put(ep)` on the `if (ep)` (true) path and **omits it on the `else` path and on early-return/error paths**. However, since `ep` is `NULL` in the `else` branch, `of_node_put(NULL)` is a no-op, so this omission is actually correct behavior (not a leak). The fix is functionally correct.

**Verdict: The patch is correct and fixes a real bug, but is cosmetically imperfect in its commit message framing.**

---

---
Generated by Claude Code Patch Reviewer

Claude review: drm/bridge: it6505: fix use-after-free in it6505_parse_dt()

[Claude Code Review Bot]

Patch Review

**The bug is real.** In the original code, the pattern is:

```c
ep = of_graph_get_endpoint_by_regs(np, 1, 0);
of_node_put(ep);          // <-- drops refcount immediately

if (ep) {
    len = it6505_get_data_lanes_count(ep, 1, 4);  // <-- uses freed node
    ...
```

`of_graph_get_endpoint_by_regs()` returns a refcounted `device_node`. Calling `of_node_put()` immediately can drop the refcount to zero and free the node, making the subsequent dereference inside the `if (ep)` block a use-after-free. This same pattern occurs twice — once for endpoint (1,0) and once for endpoint (0,0).

**The fix is correct.** The patch moves `of_node_put(ep)` to the end of each `if (ep)` block, after `ep` is no longer needed:

```c
ep = of_graph_get_endpoint_by_regs(np, 1, 0);

if (ep) {
    len = it6505_get_data_lanes_count(ep, 1, 4);
    ...
    of_node_put(ep);       // <-- moved here, after all uses
} else {
    ...
}
```

**Observations:**

1. **The `else` branches don't need `of_node_put()`** — when `ep` is `NULL`, `of_node_put(NULL)` is a documented no-op in the kernel, so omitting it is fine and arguably cleaner.

2. **The fix is applied consistently** to both occurrences of the pattern in the function (endpoint regs (1,0) and (0,0)).

3. **Minor nit on the commit message:** The phrase "the node may be freed before being accessed in the if (ep) block" is slightly misleading. `of_node_put()` *does* drop the reference, and if the refcount reaches zero the node *will* be freed — it's not just "may be." In practice, `of_graph_get_endpoint_by_regs()` typically returns a node with refcount 1, so `of_node_put()` will free it. A more precise commit message would say "the node is freed before being accessed."

4. **Cc: stable is appropriate** given this is a real use-after-free bug, and the `Fixes:` tag correctly identifies commit `380d920b582d` which introduced this buggy pattern.

5. **No functional concerns** — the surrounding logic is unchanged, and the ref is properly balanced (one `of_graph_get_endpoint_by_regs()` get, one `of_node_put()` put, on the only path where `ep` is non-NULL).

**Reviewed-by: Looks good.** The patch correctly fixes a real use-after-free. The only suggestion would be a minor commit message wording improvement ("is freed" vs "may be freed"), which is not worth a respin.

---
Generated by Claude Code Patch Reviewer

[PATCH] drm/bridge: it6505: fix use-after-free in it6505_parse_dt()

[Wentao Liang]

In it6505_parse_dt(), of_node_put(ep) is called prematurely before the
last access to ep when reading the "link-frequencies" property, leading
to a use-after-free if the node's reference count drops to zero. Move
the of_node_put() calls after the last use of ep in both the success
and error paths.

Fixes: 380d920b582d ("drm/bridge: add it6505 driver to read data-lanes and link-frequencies from dt")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/bridge/ite-it6505.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index a094803ba7aa..4155b5e67c2d 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -3361,13 +3361,13 @@ static void it6505_parse_dt(struct it6505 *it6505)
 	}
 
 	ep = of_graph_get_endpoint_by_regs(np, 0, 0);
-	of_node_put(ep);
 
 	if (ep) {
 		len = of_property_read_variable_u64_array(ep,
 							  "link-frequencies",
 							  &link_frequencies, 0,
 							  1);
+		of_node_put(ep);
 		if (len >= 0) {
 			do_div(link_frequencies, 1000);
 			if (link_frequencies > 297000) {
@@ -3382,6 +3382,7 @@ static void it6505_parse_dt(struct it6505 *it6505)
 			*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
 		}
 	} else {
+		of_node_put(ep);
 		dev_err(dev, "error endpoint, use default");
 		*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
 	}
-- 
2.34.1