[PATCH] drm/bridge: it6505: fix use-after-free in it6505_parse_dt()

[PATCH] drm/bridge: it6505: fix use-after-free in it6505_parse_dt()

[Wentao Liang]

Move of_node_put(ep) after the endpoint is fully used, otherwise the
node may be freed before being accessed in the if (ep) block.

Fixes: 380d920b582d ("drm/bridge: add it6505 driver to read data-lanes and link-frequencies from dt")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/bridge/ite-it6505.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index 89649c17ffad..2e01b331a168 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -3371,7 +3371,6 @@ static void it6505_parse_dt(struct it6505 *it6505)
 	}
 
 	ep = of_graph_get_endpoint_by_regs(np, 1, 0);
-	of_node_put(ep);
 
 	if (ep) {
 		len = it6505_get_data_lanes_count(ep, 1, 4);
@@ -3384,14 +3383,13 @@ static void it6505_parse_dt(struct it6505 *it6505)
 			*max_lane_count = MAX_LANE_COUNT;
 			dev_err(dev, "error data-lanes, use default");
 		}
+		of_node_put(ep);
 	} else {
 		*max_lane_count = MAX_LANE_COUNT;
 		dev_err(dev, "error endpoint, use default");
 	}
 
 	ep = of_graph_get_endpoint_by_regs(np, 0, 0);
-	of_node_put(ep);
-
 	if (ep) {
 		len = of_property_read_variable_u64_array(ep,
 							  "link-frequencies",
@@ -3410,6 +3408,7 @@ static void it6505_parse_dt(struct it6505 *it6505)
 			dev_err(dev, "error link frequencies, use default");
 			*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
 		}
+		of_node_put(ep);
 	} else {
 		dev_err(dev, "error endpoint, use default");
 		*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
-- 
2.34.1

[PATCH] drm/bridge: it6505: fix use-after-free in it6505_parse_dt()

[Wentao Liang]

In it6505_parse_dt(), of_node_put(ep) is called prematurely before the
last access to ep when reading the "link-frequencies" property, leading
to a use-after-free if the node's reference count drops to zero. Move
the of_node_put() calls after the last use of ep in both the success
and error paths.

Fixes: 380d920b582d ("drm/bridge: add it6505 driver to read data-lanes and link-frequencies from dt")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/bridge/ite-it6505.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index a094803ba7aa..4155b5e67c2d 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -3361,13 +3361,13 @@ static void it6505_parse_dt(struct it6505 *it6505)
 	}
 
 	ep = of_graph_get_endpoint_by_regs(np, 0, 0);
-	of_node_put(ep);
 
 	if (ep) {
 		len = of_property_read_variable_u64_array(ep,
 							  "link-frequencies",
 							  &link_frequencies, 0,
 							  1);
+		of_node_put(ep);
 		if (len >= 0) {
 			do_div(link_frequencies, 1000);
 			if (link_frequencies > 297000) {
@@ -3382,6 +3382,7 @@ static void it6505_parse_dt(struct it6505 *it6505)
 			*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
 		}
 	} else {
+		of_node_put(ep);
 		dev_err(dev, "error endpoint, use default");
 		*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
 	}
-- 
2.34.1

Claude review: drm/bridge: it6505: fix use-after-free in it6505_parse_dt()

[Claude Code Review Bot]

Overall Series Review

Subject: drm/bridge: it6505: fix use-after-free in it6505_parse_dt()
Author: Wentao Liang <vulab@iscas.ac.cn>
Patches: 1
Reviewed: 2026-04-12T11:30:02.603337

---

This is a single patch claiming to fix a use-after-free in `it6505_parse_dt()`. The identified bug is real — the original code calls `of_node_put(ep)` before `ep` is subsequently passed to `of_property_read_variable_u64_array()`, which is a use-after-free if the refcount drops to zero. However, the patch has two issues: (1) it adds a spurious `of_node_put(ep)` in the `else` branch where `ep` is guaranteed to be NULL, and (2) it fails to fix the **exact same bug** present earlier in the same function for the first `of_graph_get_endpoint_by_regs()` call.

**Verdict: Needs revision.** The core fix is correct for the second endpoint lookup, but the patch is incomplete — the same use-after-free pattern exists a few lines above and is left unfixed.

---

---
Generated by Claude Code Patch Reviewer

Claude review: drm/bridge: it6505: fix use-after-free in it6505_parse_dt()

[Claude Code Review Bot]

Patch Review

**The identified bug is real.** In the original code:
```c
ep = of_graph_get_endpoint_by_regs(np, 0, 0);
of_node_put(ep);

if (ep) {
    len = of_property_read_variable_u64_array(ep, /* use-after-free */
                          "link-frequencies",
                          &link_frequencies, 0, 1);
```
`of_node_put(ep)` is called before `ep` is used in `of_property_read_variable_u64_array()`. Moving the put after the last use of `ep` is the correct fix for this instance.

**Issue 1 — Unnecessary `of_node_put(ep)` in the `else` branch.** The patch adds:
```c
} else {
    of_node_put(ep);
    dev_err(dev, "error endpoint, use default");
```
The `else` branch is only entered when `ep == NULL`. `of_node_put(NULL)` is a no-op (it checks for NULL internally), so this call is dead code. It's harmless but misleading — it gives the impression that a real reference is being released. This should be removed.

**Issue 2 — Same bug exists at lines 3344–3353 (unfixed).** The exact same use-after-free pattern exists earlier in the function for the *first* endpoint lookup:
```c
ep = of_graph_get_endpoint_by_regs(np, 1, 0);   /* line 3344 */
of_node_put(ep);                                  /* line 3345 — too early! */

if (ep) {
    len = it6505_get_data_lanes_count(ep, 1, 4);  /* line 3348 — use-after-free */

    if (len > 0 && len != 3) {
        of_property_read_u32_array(ep, "data-lanes",  /* line 3351 — use-after-free */
                       data_lanes, len);
```
Here `ep` is used in both `it6505_get_data_lanes_count()` and `of_property_read_u32_array()` after the refcount has already been dropped. A complete fix should address both instances. Since the commit message says "fix use-after-free in it6505_parse_dt()" and the Fixes tag references the commit that introduced *both* patterns, readers would expect both to be fixed.

**Recommendation:** Resubmit with both instances fixed, and drop the no-op `of_node_put(ep)` from the `else` branches. The fix for both should be the same: move `of_node_put(ep)` to inside the `if (ep)` block, after the last use of `ep`.

---
Generated by Claude Code Patch Reviewer