From: Zijun Hu <quic_zijuhu@quicinc.com>

@ret is used by of_parse_phandle_with_args_map() to record return value
and it is preseted with -EINVAL before the outer while loop, but it is
changed to 0 by below successful operation within the inner loop:
of_property_read_u32(new, cells_name, &new_size)

So cause 0(success) is returned for all failures which happen after the
operation, that is obviously wrong.

Fix by restoring @ret with preseted -EINVAL after the operation.

Fixes: bd6f2fd5a1d5 ("of: Support parsing phandle argument lists through a nexus node")
Cc: stable@vger.kernel.org
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
---
 drivers/of/base.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/of/base.c b/drivers/of/base.c
index 9a9313183d1f1b61918fe7e6fa80c2726b099a1c..b294924aa31cfed1ec06983f420a445f7fae7394 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1516,6 +1516,8 @@ int of_parse_phandle_with_args_map(const struct device_node *np,
 			ret = of_property_read_u32(new, cells_name, &new_size);
 			if (ret)
 				goto put;
+			/* Restore preseted error code */
+			ret = -EINVAL;
 
 			/* Check for malformed properties */
 			if (WARN_ON(new_size > MAX_PHANDLE_ARGS))

-- 
2.34.1

On Thu, Dec 5, 2024 at 6:53 PM Zijun Hu <zijun_hu@icloud.com> wrote:
>
> From: Zijun Hu <quic_zijuhu@quicinc.com>
>
> @ret is used by of_parse_phandle_with_args_map() to record return value
> and it is preseted with -EINVAL before the outer while loop, but it is
> changed to 0 by below successful operation within the inner loop:
> of_property_read_u32(new, cells_name, &new_size)
>
> So cause 0(success) is returned for all failures which happen after the
> operation, that is obviously wrong.
>
> Fix by restoring @ret with preseted -EINVAL after the operation.

Already have a similar fix queued up.

Rob