linux-kernel - Re: [PATCH 10/12] drm/bridge: samsung-dsim: samsung_dsim_host_attach: use a temporary variable for the next bridge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <be425ab8-1772-46fb-84ee-0c8840c3eef2@samsung.com>
Date: Thu, 8 Jan 2026 10:26:22 +0100
From: Marek Szyprowski <m.szyprowski@...sung.com>
To: Luca Ceresoli <luca.ceresoli@...tlin.com>, Maarten Lankhorst
	<maarten.lankhorst@...ux.intel.com>, Maxime Ripard <mripard@...nel.org>,
	Thomas Zimmermann <tzimmermann@...e.de>, David Airlie <airlied@...il.com>,
	Simona Vetter <simona@...ll.ch>, Philippe Cornu <philippe.cornu@...com>,
	benjamin.gaignard@...aro.org, Andrzej Hajda <andrzej.hajda@...el.com>, Neil
	Armstrong <neil.armstrong@...aro.org>, Robert Foss <rfoss@...nel.org>,
	Laurent Pinchart <Laurent.pinchart@...asonboard.com>, Jonas Karlman
	<jonas@...boo.se>, Jernej Skrabec <jernej.skrabec@...il.com>, Adrien
	Grassein <adrien.grassein@...il.com>, Liu Ying <victor.liu@....com>, Shawn
	Guo <shawnguo@...nel.org>, Sascha Hauer <s.hauer@...gutronix.de>,
	Pengutronix Kernel Team <kernel@...gutronix.de>, Fabio Estevam
	<festevam@...il.com>, Inki Dae <inki.dae@...sung.com>, Jagan Teki
	<jagan@...rulasolutions.com>
Cc: Hui Pu <Hui.Pu@...ealthcare.com>, Thomas Petazzoni
	<thomas.petazzoni@...tlin.com>, dri-devel@...ts.freedesktop.org,
	linux-kernel@...r.kernel.org, imx@...ts.linux.dev,
	linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH 10/12] drm/bridge: samsung-dsim:
 samsung_dsim_host_attach: use a temporary variable for the next bridge

On 07.01.2026 14:13, Luca Ceresoli wrote:
> In preparation to handle refcounting of the out_bridge, we need to ensure
> the out_bridge pointer contains either a valid bridge pointer or NULL, not
> an ERR_PTR. Otherwise calls such as drm_bridge_get/put() would try to
> redeference an ERR_PTR.
>
> As a preliminary cleanup, add a temporary local 'next_bridge' pointer and
> only copy it in dsi->out_bridge when returning successfully.
>
> Signed-off-by: Luca Ceresoli <luca.ceresoli@...tlin.com>
> ---
>   drivers/gpu/drm/bridge/samsung-dsim.c | 14 ++++++++------
>   1 file changed, 8 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c
> index eabc4c32f6ab..b3003aa49dc3 100644
> --- a/drivers/gpu/drm/bridge/samsung-dsim.c
> +++ b/drivers/gpu/drm/bridge/samsung-dsim.c
> @@ -1886,6 +1886,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
>   {
>   	struct samsung_dsim *dsi = host_to_dsi(host);
>   	const struct samsung_dsim_plat_data *pdata = dsi->plat_data;
> +	struct drm_bridge *next_bridge;
>   	struct device *dev = dsi->dev;
>   	struct device_node *np = dev->of_node;
>   	struct device_node *remote;
> @@ -1924,17 +1925,17 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
>   
>   	panel = of_drm_find_panel(remote);
>   	if (!IS_ERR(panel)) {
> -		dsi->out_bridge = devm_drm_panel_bridge_add(dev, panel);
> +		next_bridge = devm_drm_panel_bridge_add(dev, panel);
>   	} else {
> -		dsi->out_bridge = of_drm_find_bridge(remote);
> -		if (!dsi->out_bridge)
> -			dsi->out_bridge = ERR_PTR(-EINVAL);
> +		next_bridge = of_drm_find_bridge(remote);
> +		if (!next_bridge)
> +			next_bridge = ERR_PTR(-EINVAL);
>   	}
>   
>   	of_node_put(remote);
>   
> -	if (IS_ERR(dsi->out_bridge)) {
> -		ret = PTR_ERR(dsi->out_bridge);
> +	if (IS_ERR(next_bridge)) {
> +		ret = PTR_ERR(next_bridge);
>   		DRM_DEV_ERROR(dev, "failed to find the bridge: %d\n", ret);
>   		return ret;
>   	}
> @@ -1967,6 +1968,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
>   	dsi->lanes = device->lanes;
>   	dsi->format = device->format;
>   	dsi->mode_flags = device->mode_flags;
> +	dsi->out_bridge = next_bridge;
>   

This assignment is too late, dsi->out_bridge is used (indirectly, by 
samsung_dsim_attach() called from drm_bridge_attach()) by

ret = pdata->host_ops->attach(dsi, device);

a few lines before this assignment, so the following fix has to be added:

diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c 
b/drivers/gpu/drm/bridge/samsung-dsim.c index b3003aa49dc3..f88aa8ab2879 
100644 --- a/drivers/gpu/drm/bridge/samsung-dsim.c +++ 
b/drivers/gpu/drm/bridge/samsung-dsim.c @@ -1959,6 +1959,7 @@ static int 
samsung_dsim_host_attach(struct mipi_dsi_host *host, return ret; } + 
dsi->out_bridge = next_bridge; if (pdata->host_ops && 
pdata->host_ops->attach) { ret = pdata->host_ops->attach(dsi, device); 
if (ret) @@ -1968,7 +1969,6 @@ static int 
samsung_dsim_host_attach(struct mipi_dsi_host *host, dsi->lanes = 
device->lanes; dsi->format = device->format; dsi->mode_flags = 
device->mode_flags; - dsi->out_bridge = next_bridge; return 0; }

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland