While parsing the DT, the anx7625 driver checks for the presence of a panel bridge on endpoint 1. If it is missing, pdata->panel_bridge stores the error pointer and the function returns successfully without first cleaning that variable. This is an issue since other functions later check for the presence of a panel bridge by testing the trueness of that variable.
In order to ensure proper behavior, zero out pdata->panel_bridge before returning when no panel bridge is found.
Fixes: 9e82ea0fb1df ("drm/bridge: anx7625: switch to devm_drm_of_get_bridge") Signed-off-by: Nícolas F. R. A. Prado nfraprado@collabora.com
---
drivers/gpu/drm/bridge/analogix/anx7625.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c index 53a5da6c49dd..3aed4de16690 100644 --- a/drivers/gpu/drm/bridge/analogix/anx7625.c +++ b/drivers/gpu/drm/bridge/analogix/anx7625.c @@ -1657,8 +1657,10 @@ static int anx7625_parse_dt(struct device *dev,
pdata->panel_bridge = devm_drm_of_get_bridge(dev, np, 1, 0); if (IS_ERR(pdata->panel_bridge)) { - if (PTR_ERR(pdata->panel_bridge) == -ENODEV) + if (PTR_ERR(pdata->panel_bridge) == -ENODEV) { + pdata->panel_bridge = NULL; return 0; + }
return PTR_ERR(pdata->panel_bridge); }
On Mon, Jun 13, 2022 at 12:37:05PM -0400, Nícolas F. R. A. Prado wrote:
While parsing the DT, the anx7625 driver checks for the presence of a panel bridge on endpoint 1. If it is missing, pdata->panel_bridge stores the error pointer and the function returns successfully without first cleaning that variable. This is an issue since other functions later check for the presence of a panel bridge by testing the trueness of that variable.
In order to ensure proper behavior, zero out pdata->panel_bridge before returning when no panel bridge is found.
Fixes: 9e82ea0fb1df ("drm/bridge: anx7625: switch to devm_drm_of_get_bridge") Signed-off-by: Nícolas F. R. A. Prado nfraprado@collabora.com
drivers/gpu/drm/bridge/analogix/anx7625.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c index 53a5da6c49dd..3aed4de16690 100644 --- a/drivers/gpu/drm/bridge/analogix/anx7625.c +++ b/drivers/gpu/drm/bridge/analogix/anx7625.c @@ -1657,8 +1657,10 @@ static int anx7625_parse_dt(struct device *dev,
pdata->panel_bridge = devm_drm_of_get_bridge(dev, np, 1, 0); if (IS_ERR(pdata->panel_bridge)) {
if (PTR_ERR(pdata->panel_bridge) == -ENODEV)
if (PTR_ERR(pdata->panel_bridge) == -ENODEV) {
pdata->panel_bridge = NULL; return 0;
}
return PTR_ERR(pdata->panel_bridge); }
-- 2.36.1
Thanks for spotting this error Nícolas. As you mentioned, prior to 9e82ea0fb1df the "pdata->panel_bridge" pointer was not modified (i.e. left to NULL) on the ENODEV error branch.
I missed it during the refactor, sorry about that.
Il 13/06/22 18:37, Nícolas F. R. A. Prado ha scritto:
While parsing the DT, the anx7625 driver checks for the presence of a panel bridge on endpoint 1. If it is missing, pdata->panel_bridge stores the error pointer and the function returns successfully without first cleaning that variable. This is an issue since other functions later check for the presence of a panel bridge by testing the trueness of that variable.
In order to ensure proper behavior, zero out pdata->panel_bridge before returning when no panel bridge is found.
Fixes: 9e82ea0fb1df ("drm/bridge: anx7625: switch to devm_drm_of_get_bridge") Signed-off-by: Nícolas F. R. A. Prado nfraprado@collabora.com
I would've preferred s/zero out/cleanup/g but it's also fine as you wrote it. Besides, good catch!
Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com
On Tue, 14 Jun 2022 at 09:52, AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com wrote:
Il 13/06/22 18:37, Nícolas F. R. A. Prado ha scritto:
While parsing the DT, the anx7625 driver checks for the presence of a panel bridge on endpoint 1. If it is missing, pdata->panel_bridge stores the error pointer and the function returns successfully without first cleaning that variable. This is an issue since other functions later check for the presence of a panel bridge by testing the trueness of that variable.
In order to ensure proper behavior, zero out pdata->panel_bridge before returning when no panel bridge is found.
Fixes: 9e82ea0fb1df ("drm/bridge: anx7625: switch to devm_drm_of_get_bridge") Signed-off-by: Nícolas F. R. A. Prado nfraprado@collabora.com
I would've preferred s/zero out/cleanup/g but it's also fine as you wrote it. Besides, good catch!
Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com
Applied to drm-misc-next
dri-devel@lists.freedesktop.org