1. Patchew
  2. linux
  3. [PATCH 00/12] drm/bridge: convert users of of_drm_find_bridge(), part 2
  4. View patch

[PATCH 10/12] drm/bridge: samsung-dsim: samsung_dsim_host_attach: use a temporary variable for the next bridge

Luca Ceresoli posted 12 patches 1 month ago
There is a newer version of this series
[PATCH 10/12] drm/bridge: samsung-dsim: samsung_dsim_host_attach: use a temporary variable for the next bridge
Posted by Luca Ceresoli 1 month ago 
In preparation to handle refcounting of the out_bridge, we need to ensure
the out_bridge pointer contains either a valid bridge pointer or NULL, not
an ERR_PTR. Otherwise calls such as drm_bridge_get/put() would try to
redeference an ERR_PTR.

As a preliminary cleanup, add a temporary local 'next_bridge' pointer and
only copy it in dsi->out_bridge when returning successfully.

Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
---
 drivers/gpu/drm/bridge/samsung-dsim.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c
index eabc4c32f6ab..b3003aa49dc3 100644
--- a/drivers/gpu/drm/bridge/samsung-dsim.c
+++ b/drivers/gpu/drm/bridge/samsung-dsim.c
@@ -1886,6 +1886,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
 {
 	struct samsung_dsim *dsi = host_to_dsi(host);
 	const struct samsung_dsim_plat_data *pdata = dsi->plat_data;
+	struct drm_bridge *next_bridge;
 	struct device *dev = dsi->dev;
 	struct device_node *np = dev->of_node;
 	struct device_node *remote;
@@ -1924,17 +1925,17 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
 
 	panel = of_drm_find_panel(remote);
 	if (!IS_ERR(panel)) {
-		dsi->out_bridge = devm_drm_panel_bridge_add(dev, panel);
+		next_bridge = devm_drm_panel_bridge_add(dev, panel);
 	} else {
-		dsi->out_bridge = of_drm_find_bridge(remote);
-		if (!dsi->out_bridge)
-			dsi->out_bridge = ERR_PTR(-EINVAL);
+		next_bridge = of_drm_find_bridge(remote);
+		if (!next_bridge)
+			next_bridge = ERR_PTR(-EINVAL);
 	}
 
 	of_node_put(remote);
 
-	if (IS_ERR(dsi->out_bridge)) {
-		ret = PTR_ERR(dsi->out_bridge);
+	if (IS_ERR(next_bridge)) {
+		ret = PTR_ERR(next_bridge);
 		DRM_DEV_ERROR(dev, "failed to find the bridge: %d\n", ret);
 		return ret;
 	}
@@ -1967,6 +1968,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
 	dsi->lanes = device->lanes;
 	dsi->format = device->format;
 	dsi->mode_flags = device->mode_flags;
+	dsi->out_bridge = next_bridge;
 
 	return 0;
 }

-- 
2.52.0
Re: [PATCH 10/12] drm/bridge: samsung-dsim: samsung_dsim_host_attach: use a temporary variable for the next bridge
Posted by Marek Szyprowski 1 month ago 
On 07.01.2026 14:13, Luca Ceresoli wrote:
> In preparation to handle refcounting of the out_bridge, we need to ensure
> the out_bridge pointer contains either a valid bridge pointer or NULL, not
> an ERR_PTR. Otherwise calls such as drm_bridge_get/put() would try to
> redeference an ERR_PTR.
>
> As a preliminary cleanup, add a temporary local 'next_bridge' pointer and
> only copy it in dsi->out_bridge when returning successfully.
>
> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
> ---
>   drivers/gpu/drm/bridge/samsung-dsim.c | 14 ++++++++------
>   1 file changed, 8 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c
> index eabc4c32f6ab..b3003aa49dc3 100644
> --- a/drivers/gpu/drm/bridge/samsung-dsim.c
> +++ b/drivers/gpu/drm/bridge/samsung-dsim.c
> @@ -1886,6 +1886,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
>   {
>   	struct samsung_dsim *dsi = host_to_dsi(host);
>   	const struct samsung_dsim_plat_data *pdata = dsi->plat_data;
> +	struct drm_bridge *next_bridge;
>   	struct device *dev = dsi->dev;
>   	struct device_node *np = dev->of_node;
>   	struct device_node *remote;
> @@ -1924,17 +1925,17 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
>   
>   	panel = of_drm_find_panel(remote);
>   	if (!IS_ERR(panel)) {
> -		dsi->out_bridge = devm_drm_panel_bridge_add(dev, panel);
> +		next_bridge = devm_drm_panel_bridge_add(dev, panel);
>   	} else {
> -		dsi->out_bridge = of_drm_find_bridge(remote);
> -		if (!dsi->out_bridge)
> -			dsi->out_bridge = ERR_PTR(-EINVAL);
> +		next_bridge = of_drm_find_bridge(remote);
> +		if (!next_bridge)
> +			next_bridge = ERR_PTR(-EINVAL);
>   	}
>   
>   	of_node_put(remote);
>   
> -	if (IS_ERR(dsi->out_bridge)) {
> -		ret = PTR_ERR(dsi->out_bridge);
> +	if (IS_ERR(next_bridge)) {
> +		ret = PTR_ERR(next_bridge);
>   		DRM_DEV_ERROR(dev, "failed to find the bridge: %d\n", ret);
>   		return ret;
>   	}
> @@ -1967,6 +1968,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
>   	dsi->lanes = device->lanes;
>   	dsi->format = device->format;
>   	dsi->mode_flags = device->mode_flags;
> +	dsi->out_bridge = next_bridge;
>   

This assignment is too late, dsi->out_bridge is used (indirectly, by 
samsung_dsim_attach() called from drm_bridge_attach()) by

ret = pdata->host_ops->attach(dsi, device);

a few lines before this assignment, so the following fix has to be added:

diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c 
b/drivers/gpu/drm/bridge/samsung-dsim.c index b3003aa49dc3..f88aa8ab2879 
100644 --- a/drivers/gpu/drm/bridge/samsung-dsim.c +++ 
b/drivers/gpu/drm/bridge/samsung-dsim.c @@ -1959,6 +1959,7 @@ static int 
samsung_dsim_host_attach(struct mipi_dsi_host *host, return ret; } + 
dsi->out_bridge = next_bridge; if (pdata->host_ops && 
pdata->host_ops->attach) { ret = pdata->host_ops->attach(dsi, device); 
if (ret) @@ -1968,7 +1969,6 @@ static int 
samsung_dsim_host_attach(struct mipi_dsi_host *host, dsi->lanes = 
device->lanes; dsi->format = device->format; dsi->mode_flags = 
device->mode_flags; - dsi->out_bridge = next_bridge; return 0; }

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland
Re: [PATCH 10/12] drm/bridge: samsung-dsim: samsung_dsim_host_attach: use a temporary variable for the next bridge
Posted by Luca Ceresoli 1 month ago 
Hi Marek,

On Thu Jan 8, 2026 at 10:26 AM CET, Marek Szyprowski wrote:
> On 07.01.2026 14:13, Luca Ceresoli wrote:
>> In preparation to handle refcounting of the out_bridge, we need to ensure
>> the out_bridge pointer contains either a valid bridge pointer or NULL, not
>> an ERR_PTR. Otherwise calls such as drm_bridge_get/put() would try to
>> redeference an ERR_PTR.
>>
>> As a preliminary cleanup, add a temporary local 'next_bridge' pointer and
>> only copy it in dsi->out_bridge when returning successfully.
>>
>> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
>> ---
>>   drivers/gpu/drm/bridge/samsung-dsim.c | 14 ++++++++------
>>   1 file changed, 8 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c
>> index eabc4c32f6ab..b3003aa49dc3 100644
>> --- a/drivers/gpu/drm/bridge/samsung-dsim.c
>> +++ b/drivers/gpu/drm/bridge/samsung-dsim.c
>> @@ -1886,6 +1886,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
>>   {
>>   	struct samsung_dsim *dsi = host_to_dsi(host);
>>   	const struct samsung_dsim_plat_data *pdata = dsi->plat_data;
>> +	struct drm_bridge *next_bridge;
>>   	struct device *dev = dsi->dev;
>>   	struct device_node *np = dev->of_node;
>>   	struct device_node *remote;
>> @@ -1924,17 +1925,17 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
>>
>>   	panel = of_drm_find_panel(remote);
>>   	if (!IS_ERR(panel)) {
>> -		dsi->out_bridge = devm_drm_panel_bridge_add(dev, panel);
>> +		next_bridge = devm_drm_panel_bridge_add(dev, panel);
>>   	} else {
>> -		dsi->out_bridge = of_drm_find_bridge(remote);
>> -		if (!dsi->out_bridge)
>> -			dsi->out_bridge = ERR_PTR(-EINVAL);
>> +		next_bridge = of_drm_find_bridge(remote);
>> +		if (!next_bridge)
>> +			next_bridge = ERR_PTR(-EINVAL);
>>   	}
>>
>>   	of_node_put(remote);
>>
>> -	if (IS_ERR(dsi->out_bridge)) {
>> -		ret = PTR_ERR(dsi->out_bridge);
>> +	if (IS_ERR(next_bridge)) {
>> +		ret = PTR_ERR(next_bridge);
>>   		DRM_DEV_ERROR(dev, "failed to find the bridge: %d\n", ret);
>>   		return ret;
>>   	}
>> @@ -1967,6 +1968,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host *host,
>>   	dsi->lanes = device->lanes;
>>   	dsi->format = device->format;
>>   	dsi->mode_flags = device->mode_flags;
>> +	dsi->out_bridge = next_bridge;
>>
>
> This assignment is too late, dsi->out_bridge is used (indirectly, by
> samsung_dsim_attach() called from drm_bridge_attach()) by
>
> ret = pdata->host_ops->attach(dsi, device);

Thanks for testing, reporting, and suggesting a solution. I'm not sure why
it worked on my setup, but this is indeed a bug.

> a few lines before this assignment, so the following fix has to be added:
>
> diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c
> b/drivers/gpu/drm/bridge/samsung-dsim.c index b3003aa49dc3..f88aa8ab2879
> 100644 --- a/drivers/gpu/drm/bridge/samsung-dsim.c +++
> b/drivers/gpu/drm/bridge/samsung-dsim.c @@ -1959,6 +1959,7 @@ static int
> samsung_dsim_host_attach(struct mipi_dsi_host *host, return ret; } +
> dsi->out_bridge = next_bridge; if (pdata->host_ops &&
> pdata->host_ops->attach) { ret = pdata->host_ops->attach(dsi, device);
> if (ret) @@ -1968,7 +1969,6 @@ static int
> samsung_dsim_host_attach(struct mipi_dsi_host *host, dsi->lanes =
> device->lanes; dsi->format = device->format; dsi->mode_flags =
> device->mode_flags; - dsi->out_bridge = next_bridge; return 0; }

This needed a bit of demangling :) but it looks like a correct solution.

I took a moment to understand why this did not break my setup. The answer
is I have a fsl,imx8mp-mipi-dsim, which has no .attach set in its
samsung_dsim_host_ops.

Sorry for the inconvenience. I'm fixing this in v2.

Luca

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
Re: [PATCH 10/12] drm/bridge: samsung-dsim: samsung_dsim_host_attach: use a temporary variable for the next bridge
Posted by Maxime Ripard 1 month ago 
On Wed, 7 Jan 2026 14:13:01 +0100, Luca Ceresoli wrote:
> In preparation to handle refcounting of the out_bridge, we need to ensure
> the out_bridge pointer contains either a valid bridge pointer or NULL, not
> an ERR_PTR. Otherwise calls such as drm_bridge_get/put() would try to
> redeference an ERR_PTR.
> 
> 
> [ ... ]

Acked-by: Maxime Ripard <mripard@kernel.org>

Thanks!
Maxime

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.