drm/bridge: panel: Prevent ERR_PTR Dereference

Commit 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to
drm_panel") introduced an access to the bridge pointer in the
devm_drm_panel_bridge_add_typed() function.

However, due to the unusual ERR_PTR check when getting that pointer, the
pointer access is done even though the pointer might be an error
pointer.

Rework the function for a more traditional design that will return
immediately if it gets an ERR_PTR so that we never access the pointer in
that case.

Fixes: 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to drm_panel")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20230102120123.19062-1-maxime@cerno.tech
Link: https://patchwork.freedesktop.org/patch/msgid/20230102120123.19062-1-maxime@cerno.tech

diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c
index 1708098fba6d9adc6f3e20458a22b21e111f38de..e8aae3cdc73d4e32d3e32aac273d48792956d8a5 100644 (file)
--- a/drivers/gpu/drm/bridge/panel.c
+++ b/drivers/gpu/drm/bridge/panel.c
@@ -357,15 +357,16 @@ struct drm_bridge *devm_drm_panel_bridge_add_typed(struct device *dev,
                return ERR_PTR(-ENOMEM);
 
        bridge = drm_panel_bridge_add_typed(panel, connector_type);
-       if (!IS_ERR(bridge)) {
-               *ptr = bridge;
-               devres_add(dev, ptr);
-       } else {
+       if (IS_ERR(bridge)) {
                devres_free(ptr);
+               return bridge;
        }
 
        bridge->pre_enable_prev_first = panel->prepare_prev_first;
 
+       *ptr = bridge;
+       devres_add(dev, ptr);
+
        return bridge;
 }
 EXPORT_SYMBOL(devm_drm_panel_bridge_add_typed);