drm/msm: fix OF child-node lookup

BugLink: https://bugs.launchpad.net/bugs/1837161
commit f9a7082327e26f54067a49cac2316d31e0cc8ba7 upstream.

Use the new of_get_compatible_child() helper to lookup the legacy
pwrlevels child node instead of using of_find_compatible_node(), which
searches the entire tree from a given start node and thus can return an
unrelated (i.e.  non-child) node.

This also addresses a potential use-after-free (e.g. after probe
deferral) as the tree-wide helper drops a reference to its first
argument (i.e. the probed device's node).

While at it, also fix the related child-node reference leak.

Fixes: e2af8b6b0ca1 ("drm/msm: gpu: Use OPP tables if we can")
Cc: stable <stable@vger.kernel.org>     # 4.12
Cc: Jordan Crouse <jcrouse@codeaurora.org>
Cc: Rob Clark <robdclark@gmail.com>
Cc: David Airlie <airlied@linux.ie>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Rob Herring <robh@kernel.org>
[ johan: backport to 4.14 ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c
index bfb3d689f47d386a6673c328d8fcb4aec70b7fce..0af19476ee8a8e25343e153c29ee6491650ef8f9 100644 (file)
--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
@@ -199,8 +199,7 @@ static int adreno_get_legacy_pwrlevels(struct device *dev)
        struct device_node *child, *node;
        int ret;
 
-       node = of_find_compatible_node(dev->of_node, NULL,
-               "qcom,gpu-pwrlevels");
+       node = of_get_compatible_child(dev->of_node, "qcom,gpu-pwrlevels");
        if (!node) {
                dev_err(dev, "Could not find the GPU powerlevels\n");
                return -ENXIO;
@@ -221,6 +220,8 @@ static int adreno_get_legacy_pwrlevels(struct device *dev)
                        dev_pm_opp_add(dev, val, 0);
        }
 
+       of_node_put(node);
+
        return 0;
 }