[PATCH v5 08/10] drm/bridge: samsung-dsim: use supporting variable for out_bridge

[Luca Ceresoli]

Instead of using dsi->out_bridge during the bridge search process, use a
temporary variable and assign dsi->out_bridge only on successful
completion.

The main goal is to be able to drm_bridge_get() the out_bridge before
setting it in dsi->out_bridge, which is done in a later commit. Setting
dsi->out_bridge as in current code would leave a use-after-free window in
case the bridge is deallocated by some other thread between
'dsi->out_bridge = devm_drm_panel_bridge_add()' and drm_bridge_get().

This change additionally avoids leaving an ERR_PTR value in dsi->out_bridge
on failure. This is not necessarily a problem but it is not clean.

Signed-off-by: Luca Ceresoli <luca.ceres...@bootlin.com>

---

This patch was added in v5.
---
 drivers/gpu/drm/bridge/samsung-dsim.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c 
b/drivers/gpu/drm/bridge/samsung-dsim.c
index 
f8b4fb8357659018ec0db65374ee5d05330639ae..c4d1563fd32019efde523dfc0863be044c05a826
 100644
--- a/drivers/gpu/drm/bridge/samsung-dsim.c
+++ b/drivers/gpu/drm/bridge/samsung-dsim.c
@@ -1705,6 +1705,7 @@ static int samsung_dsim_host_attach(struct mipi_dsi_host 
*host,
        struct device *dev = dsi->dev;
        struct device_node *np = dev->of_node;
        struct device_node *remote;
+       struct drm_bridge *out_bridge;
        struct drm_panel *panel;
        int ret;
 
@@ -1740,21 +1741,23 @@ static int samsung_dsim_host_attach(struct 
mipi_dsi_host *host,
 
        panel = of_drm_find_panel(remote);
        if (!IS_ERR(panel)) {
-               dsi->out_bridge = devm_drm_panel_bridge_add(dev, panel);
+               out_bridge = devm_drm_panel_bridge_add(dev, panel);
        } else {
-               dsi->out_bridge = of_drm_find_bridge(remote);
-               if (!dsi->out_bridge)
-                       dsi->out_bridge = ERR_PTR(-EINVAL);
+               out_bridge = of_drm_find_bridge(remote);
+               if (!out_bridge)
+                       out_bridge = ERR_PTR(-EINVAL);
        }
 
        of_node_put(remote);
 
-       if (IS_ERR(dsi->out_bridge)) {
-               ret = PTR_ERR(dsi->out_bridge);
+       if (IS_ERR(out_bridge)) {
+               ret = PTR_ERR(out_bridge);
                DRM_DEV_ERROR(dev, "failed to find the bridge: %d\n", ret);
                return ret;
        }
 
+       dsi->out_bridge = out_bridge;
+
        DRM_DEV_INFO(dev, "Attached %s device (lanes:%d bpp:%d 
mode-flags:0x%lx)\n",
                     device->name, device->lanes,
                     mipi_dsi_pixel_format_to_bpp(device->format),

-- 
2.34.1