[PATCH] drm/bridge: panel: Prevent ERR_PTR Dereference

[Laurent Pinchart]

Hi Maxime,

Thank you for the patch.

On Mon, Jan 02, 2023 at 01:01:23PM +0100, Maxime Ripard wrote:
> Commit 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to
> drm_panel") introduced an access to the bridge pointer in the
> devm_drm_panel_bridge_add_typed() function.
> 
> However, due to the unusual ERR_PTR check when getting that pointer, the
> pointer access is done even though the pointer might be an error
> pointer.
> 
> Rework the function for a more traditional design that will return
> immediately if it gets an ERR_PTR so that we never access the pointer in
> that case.
> 
> Fixes: 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to drm_panel")
> Reported-by: kernel test robot <lkp at intel.com>
> Reported-by: Dan Carpenter <error27 at gmail.com>
> Signed-off-by: Maxime Ripard <maxime at cerno.tech>

Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas at ideasonboard.com>

> ---
>  drivers/gpu/drm/bridge/panel.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c
> index 1708098fba6d..e8aae3cdc73d 100644
> --- a/drivers/gpu/drm/bridge/panel.c
> +++ b/drivers/gpu/drm/bridge/panel.c
> @@ -357,15 +357,16 @@ struct drm_bridge *devm_drm_panel_bridge_add_typed(struct device *dev,
>  		return ERR_PTR(-ENOMEM);
>  
>  	bridge = drm_panel_bridge_add_typed(panel, connector_type);
> -	if (!IS_ERR(bridge)) {
> -		*ptr = bridge;
> -		devres_add(dev, ptr);
> -	} else {
> +	if (IS_ERR(bridge)) {
>  		devres_free(ptr);
> +		return bridge;
>  	}
>  
>  	bridge->pre_enable_prev_first = panel->prepare_prev_first;
>  
> +	*ptr = bridge;
> +	devres_add(dev, ptr);
> +
>  	return bridge;
>  }
>  EXPORT_SYMBOL(devm_drm_panel_bridge_add_typed);

-- 
Regards,

Laurent Pinchart