Claude review: drm/bridge: it6505: fix use-after-free in it6505_parse_dt()

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**The bug is real.** In the original code, the pattern is:

```c
ep = of_graph_get_endpoint_by_regs(np, 1, 0);
of_node_put(ep);          // <-- drops refcount immediately

if (ep) {
    len = it6505_get_data_lanes_count(ep, 1, 4);  // <-- uses freed node
    ...
```

`of_graph_get_endpoint_by_regs()` returns a refcounted `device_node`. Calling `of_node_put()` immediately can drop the refcount to zero and free the node, making the subsequent dereference inside the `if (ep)` block a use-after-free. This same pattern occurs twice — once for endpoint (1,0) and once for endpoint (0,0).

**The fix is correct.** The patch moves `of_node_put(ep)` to the end of each `if (ep)` block, after `ep` is no longer needed:

```c
ep = of_graph_get_endpoint_by_regs(np, 1, 0);

if (ep) {
    len = it6505_get_data_lanes_count(ep, 1, 4);
    ...
    of_node_put(ep);       // <-- moved here, after all uses
} else {
    ...
}
```

**Observations:**

1. **The `else` branches don't need `of_node_put()`** — when `ep` is `NULL`, `of_node_put(NULL)` is a documented no-op in the kernel, so omitting it is fine and arguably cleaner.

2. **The fix is applied consistently** to both occurrences of the pattern in the function (endpoint regs (1,0) and (0,0)).

3. **Minor nit on the commit message:** The phrase "the node may be freed before being accessed in the if (ep) block" is slightly misleading. `of_node_put()` *does* drop the reference, and if the refcount reaches zero the node *will* be freed — it's not just "may be." In practice, `of_graph_get_endpoint_by_regs()` typically returns a node with refcount 1, so `of_node_put()` will free it. A more precise commit message would say "the node is freed before being accessed."

4. **Cc: stable is appropriate** given this is a real use-after-free bug, and the `Fixes:` tag correctly identifies commit `380d920b582d` which introduced this buggy pattern.

5. **No functional concerns** — the surrounding logic is unchanged, and the ref is properly balanced (one `of_graph_get_endpoint_by_regs()` get, one `of_node_put()` put, on the only path where `ep` is non-NULL).

**Reviewed-by: Looks good.** The patch correctly fixes a real use-after-free. The only suggestion would be a minor commit message wording improvement ("is freed" vs "may be freed"), which is not worth a respin.

---
Generated by Claude Code Patch Reviewer