While parsing the DT, the anx7625 driver checks for the presence of a
panel bridge on endpoint 1. If it is missing, pdata->panel_bridge stores
the error pointer and the function returns successfully without first
cleaning that variable. This is an issue since other functions later
check for the presence of a panel bridge by testing the trueness of that
variable.
In order to ensure proper behavior, zero out pdata->panel_bridge before
returning when no panel bridge is found.
Fixes: 9e82ea0fb1df ("drm/bridge: anx7625: switch to devm_drm_of_get_bridge")
Signed-off-by: Nícolas F. R. A. Prado <[email protected]>
---
drivers/gpu/drm/bridge/analogix/anx7625.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
index 53a5da6c49dd..3aed4de16690 100644
--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
+++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
@@ -1657,8 +1657,10 @@ static int anx7625_parse_dt(struct device *dev,
pdata->panel_bridge = devm_drm_of_get_bridge(dev, np, 1, 0);
if (IS_ERR(pdata->panel_bridge)) {
- if (PTR_ERR(pdata->panel_bridge) == -ENODEV)
+ if (PTR_ERR(pdata->panel_bridge) == -ENODEV) {
+ pdata->panel_bridge = NULL;
return 0;
+ }
return PTR_ERR(pdata->panel_bridge);
}
--
2.36.1
On Mon, Jun 13, 2022 at 12:37:05PM -0400, N?colas F. R. A. Prado wrote:
> While parsing the DT, the anx7625 driver checks for the presence of a
> panel bridge on endpoint 1. If it is missing, pdata->panel_bridge stores
> the error pointer and the function returns successfully without first
> cleaning that variable. This is an issue since other functions later
> check for the presence of a panel bridge by testing the trueness of that
> variable.
>
> In order to ensure proper behavior, zero out pdata->panel_bridge before
> returning when no panel bridge is found.
>
> Fixes: 9e82ea0fb1df ("drm/bridge: anx7625: switch to devm_drm_of_get_bridge")
> Signed-off-by: N?colas F. R. A. Prado <[email protected]>
>
> ---
>
> drivers/gpu/drm/bridge/analogix/anx7625.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
> index 53a5da6c49dd..3aed4de16690 100644
> --- a/drivers/gpu/drm/bridge/analogix/anx7625.c
> +++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
> @@ -1657,8 +1657,10 @@ static int anx7625_parse_dt(struct device *dev,
>
> pdata->panel_bridge = devm_drm_of_get_bridge(dev, np, 1, 0);
> if (IS_ERR(pdata->panel_bridge)) {
> - if (PTR_ERR(pdata->panel_bridge) == -ENODEV)
> + if (PTR_ERR(pdata->panel_bridge) == -ENODEV) {
> + pdata->panel_bridge = NULL;
> return 0;
> + }
>
> return PTR_ERR(pdata->panel_bridge);
> }
> --
> 2.36.1
>
Thanks for spotting this error N?colas. As you mentioned, prior to
9e82ea0fb1df the "pdata->panel_bridge" pointer was not modified
(i.e. left to NULL) on the ENODEV error branch.
I missed it during the refactor, sorry about that.
Il 13/06/22 18:37, Nícolas F. R. A. Prado ha scritto:
> While parsing the DT, the anx7625 driver checks for the presence of a
> panel bridge on endpoint 1. If it is missing, pdata->panel_bridge stores
> the error pointer and the function returns successfully without first
> cleaning that variable. This is an issue since other functions later
> check for the presence of a panel bridge by testing the trueness of that
> variable.
>
> In order to ensure proper behavior, zero out pdata->panel_bridge before
> returning when no panel bridge is found.
>
> Fixes: 9e82ea0fb1df ("drm/bridge: anx7625: switch to devm_drm_of_get_bridge")
> Signed-off-by: Nícolas F. R. A. Prado <[email protected]>
>
I would've preferred s/zero out/cleanup/g but it's also fine as you wrote it.
Besides, good catch!
Reviewed-by: AngeloGioacchino Del Regno <[email protected]>
On Tue, 14 Jun 2022 at 09:52, AngeloGioacchino Del Regno
<[email protected]> wrote:
>
> Il 13/06/22 18:37, Nícolas F. R. A. Prado ha scritto:
> > While parsing the DT, the anx7625 driver checks for the presence of a
> > panel bridge on endpoint 1. If it is missing, pdata->panel_bridge stores
> > the error pointer and the function returns successfully without first
> > cleaning that variable. This is an issue since other functions later
> > check for the presence of a panel bridge by testing the trueness of that
> > variable.
> >
> > In order to ensure proper behavior, zero out pdata->panel_bridge before
> > returning when no panel bridge is found.
> >
> > Fixes: 9e82ea0fb1df ("drm/bridge: anx7625: switch to devm_drm_of_get_bridge")
> > Signed-off-by: Nícolas F. R. A. Prado <[email protected]>
> >
>
> I would've preferred s/zero out/cleanup/g but it's also fine as you wrote it.
> Besides, good catch!
>
> Reviewed-by: AngeloGioacchino Del Regno <[email protected]>
>
Applied to drm-misc-next