[PATCH] drm/bridge: it6505: fix use-after-free in it6505_parse_dt()

Wentao Liang
2026-04-07T09:39:17Z

Move of_node_put(ep) after the endpoint is fully used, otherwise the
node may be freed before being accessed in the if (ep) block.

Fixes: 380d920b582d ("drm/bridge: add it6505 driver to read data-lanes and link-frequencies from dt")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/gpu/drm/bridge/ite-it6505.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index 89649c17ffad..2e01b331a168 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -3371,7 +3371,6 @@ static void it6505_parse_dt(struct it6505 *it6505)
}

ep = of_graph_get_endpoint_by_regs(np, 1, 0);
- of_node_put(ep);

if (ep) {
len = it6505_get_data_lanes_count(ep, 1, 4);
@@ -3384,14 +3383,13 @@ static void it6505_parse_dt(struct it6505 *it6505)
*max_lane_count = MAX_LANE_COUNT;
dev_err(dev, "error data-lanes, use default");
}
+ of_node_put(ep);
} else {
*max_lane_count = MAX_LANE_COUNT;
dev_err(dev, "error endpoint, use default");
}

ep = of_graph_get_endpoint_by_regs(np, 0, 0);
- of_node_put(ep);
-
if (ep) {
len = of_property_read_variable_u64_array(ep,
"link-frequencies",
@@ -3410,6 +3408,7 @@ static void it6505_parse_dt(struct it6505 *it6505)
dev_err(dev, "error link frequencies, use default");
*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
}
+ of_node_put(ep);
} else {
dev_err(dev, "error endpoint, use default");
*max_dpi_pixel_clock = DPI_PIXEL_CLK_MAX;
--
2.34.1