tree 3970667cd7b30985037c00b75a13c1967b15fd18
parent 6f45fbc36d41de366c2f0d940e233499a4106afd
author Johan Hovold <johan@kernel.org> 1756458224 +0200
committer He Gao <hegao@google.com> 1758930826 -0700

drm/mediatek: fix potential OF node use-after-free

commit 4de37a48b6b58faaded9eb765047cf0d8785ea18 upstream.

The for_each_child_of_node() helper drops the reference it takes to each
node as it iterates over children and an explicit of_node_put() is only
needed when exiting the loop early.

Drop the recently introduced bogus additional reference count decrement
at each iteration that could potentially lead to a use-after-free.

BUG=b/446853736
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2025-39882 in the Linux kernel.

cos-patch: security-moderate
Fixes: 1f403699c40f ("drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv")
Change-Id: I2224b8e75d0af0447941211b89d6b35896089271
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/112273
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Miri Amarilio <mirilio@google.com>