From patchwork Tue Dec 31 10:40:02 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luca Ceresoli X-Patchwork-Id: 13923771 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id AA371E77188 for ; Tue, 31 Dec 2024 10:40:59 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 30E5A10E64D; Tue, 31 Dec 2024 10:40:59 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=bootlin.com header.i=@bootlin.com header.b="Ic7Dg541"; dkim-atps=neutral Received: from relay9-d.mail.gandi.net (relay9-d.mail.gandi.net [217.70.183.199]) by gabe.freedesktop.org (Postfix) with ESMTPS id 7301910E64D for ; Tue, 31 Dec 2024 10:40:57 +0000 (UTC) Received: by mail.gandi.net (Postfix) with ESMTPSA id 05672FF809; Tue, 31 Dec 2024 10:40:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1735641636; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=iTffFfD4VzEYR9vlW/p4V75r3lQ1DwU0EdWChMuyjI8=; b=Ic7Dg541QDABb3D67WnsoIwb/53TK87QIFofk4LJvHP7u0eswpPhbtyTAdLVya4AWYhIRT 3s3SmSHe8eUaKHXxSP1TmIOWFJUm6T344mJNc1HJJGt7IG3bKAQiX37zRHxJpwv4ZhdQeT L4UXcApiAdkyRbZ0ic8WWZnQNVRYc1a7PyewO/SLRRBSi00Ld6ENhuDNZpjuJXTKfjbBTp S7O3DsTqoiOk/HbzqkuzYrnoZDQnL39cdVCL46Lj6SqngI/BhQm9Qu3FOnL4XtRtm0+YD2 a+7XV7/Kv28nMA0Z9WxdahVam2ODNOK8jufop+IKcfJG5FJ1Mf9dS/pS/hRCoQ== From: Luca Ceresoli Date: Tue, 31 Dec 2024 11:40:02 +0100 Subject: [PATCH v5 08/10] drm/bridge: samsung-dsim: use supporting variable for out_bridge MIME-Version: 1.0 Message-Id: <20241231-hotplug-drm-bridge-v5-8-173065a1ece1@bootlin.com> References: <20241231-hotplug-drm-bridge-v5-0-173065a1ece1@bootlin.com> In-Reply-To: <20241231-hotplug-drm-bridge-v5-0-173065a1ece1@bootlin.com> To: Simona Vetter , Inki Dae , Jagan Teki , Marek Szyprowski , Catalin Marinas , Will Deacon , Shawn Guo , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , Daniel Thompson , Andrzej Hajda , Jonathan Corbet Cc: Paul Kocialkowski , Maxime Ripard , Dmitry Baryshkov , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Maarten Lankhorst , Thomas Zimmermann , David Airlie , =?utf-8?q?Herv=C3=A9_Codina?= , Thomas Petazzoni , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-doc@vger.kernel.org, Paul Kocialkowski , Luca Ceresoli X-Mailer: b4 0.14.2 X-GND-Sasl: luca.ceresoli@bootlin.com X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Instead of using dsi->out_bridge during the bridge search process, use a temporary variable and assign dsi->out_bridge only on successful completion. The main goal is to be able to drm_bridge_get() the out_bridge before setting it in dsi->out_bridge, which is done in a later commit. Setting dsi->out_bridge as in current code would leave a use-after-free window in case the bridge is deallocated by some other thread between 'dsi->out_bridge = devm_drm_panel_bridge_add()' and drm_bridge_get(). This change additionally avoids leaving an ERR_PTR value in dsi->out_bridge on failure. This is not necessarily a problem but it is not clean. Signed-off-by: Luca Ceresoli --- This patch was added in v5. --- drivers/gpu/drm/bridge/samsung-dsim.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c index f8b4fb8357659018ec0db65374ee5d05330639ae..c4d1563fd32019efde523dfc0863be044c05a826 100644 --- a/drivers/gpu/drm/bridge/samsung-dsim.c +++ b/drivers/gpu/drm/bridge/samsung-dsim.c @@ -1705,6 +1705,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host, struct device *dev = dsi->dev; struct device_node *np = dev->of_node; struct device_node *remote; + struct drm_bridge *out_bridge; struct drm_panel *panel; int ret; @@ -1740,21 +1741,23 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host, panel = of_drm_find_panel(remote); if (!IS_ERR(panel)) { - dsi->out_bridge = devm_drm_panel_bridge_add(dev, panel); + out_bridge = devm_drm_panel_bridge_add(dev, panel); } else { - dsi->out_bridge = of_drm_find_bridge(remote); - if (!dsi->out_bridge) - dsi->out_bridge = ERR_PTR(-EINVAL); + out_bridge = of_drm_find_bridge(remote); + if (!out_bridge) + out_bridge = ERR_PTR(-EINVAL); } of_node_put(remote); - if (IS_ERR(dsi->out_bridge)) { - ret = PTR_ERR(dsi->out_bridge); + if (IS_ERR(out_bridge)) { + ret = PTR_ERR(out_bridge); DRM_DEV_ERROR(dev, "failed to find the bridge: %d\n", ret); return ret; } + dsi->out_bridge = out_bridge; + DRM_DEV_INFO(dev, "Attached %s device (lanes:%d bpp:%d mode-flags:0x%lx)\n", device->name, device->lanes, mipi_dsi_pixel_format_to_bpp(device->format),