re: drm/bridge: tc358767: convert to devm_drm_bridge_alloc() API

re: drm/bridge: tc358767: convert to devm_drm_bridge_alloc() API

[Colin King (gmail)]

[-- Attachment #1.1.1: Type: text/plain, Size: 913 bytes --]

Hi,

I believe there is a regression in linux-next caused by the following 
commit:

commit a59a271769149f0b8258507276f3d2a24370cbdb
Author: Luca Ceresoli <luca.ceresoli@bootlin.com>
Date:   Wed May 28 11:29:36 2025 +0200

     drm/bridge: tc358767: convert to devm_drm_bridge_alloc() API


the issue is as follows:

static int tc_probe_bridge_endpoint(struct tc_data *tc, enum tc_mode mode)
{
         struct device *dev = tc->dev;
         struct of_endpoint endpoint;
         struct device_node *node = NULL;

         for_each_endpoint_of_node(dev->of_node, node) {
                 if (endpoint.port == 2) {
			...
			...

The check for endpoint.port == 2 is checking an uninitialized field in 
the uninitialized structure endpoint. The code before this commit called 
  of_graph_parse_endpoint(node, &endpoint) to fetch endpoint and now 
this seems to be missing.

Colin



[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 4901 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]

Re: drm/bridge: tc358767: convert to devm_drm_bridge_alloc() API

[Luca Ceresoli]

Hello Colin,

sorry for the late reply (vacation time).

On Wed, 2 Jul 2025 10:41:52 +0100
"Colin King (gmail)" <colin.i.king@gmail.com> wrote:

> Hi,
> 
> I believe there is a regression in linux-next caused by the following 
> commit:
> 
> commit a59a271769149f0b8258507276f3d2a24370cbdb
> Author: Luca Ceresoli <luca.ceresoli@bootlin.com>
> Date:   Wed May 28 11:29:36 2025 +0200
> 
>      drm/bridge: tc358767: convert to devm_drm_bridge_alloc() API
> 
> 
> the issue is as follows:
> 
> static int tc_probe_bridge_endpoint(struct tc_data *tc, enum tc_mode mode)
> {
>          struct device *dev = tc->dev;
>          struct of_endpoint endpoint;
>          struct device_node *node = NULL;
> 
>          for_each_endpoint_of_node(dev->of_node, node) {

Well spotted! I wonder why this was not caught by my spatch runs.

I think there should be an extra line here:

   of_graph_parse_endpoint(node, &endpoint);

>                  if (endpoint.port == 2) {
> 			...
> 			...
> 
> The check for endpoint.port == 2 is checking an uninitialized field in 
> the uninitialized structure endpoint. The code before this commit called 
>   of_graph_parse_endpoint(node, &endpoint) to fetch endpoint and now 
> this seems to be missing.

As the commit message states, with this patch we are iterating over the
endpoints twice. However when iterating twice we need to parse the
endpoints twice as well.

I'm double checking this before sending a fix.

Luca

-- 
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com