[PATCH] drm/bridge: analogix_dp: Extract error pointer from correct variable

[PATCH] drm/bridge: analogix_dp: Extract error pointer from correct variable

[Ethan Tidmore]

In devm_drm_panel_bridge_add() error path the pointer error should be
extracted from dp->plat_data->next_bridge but instead it is extracted
from bridge, which is a valid pointer and not part of this error path.

Extract error pointer from correct variable.

Detected by Smatch:
drivers/gpu/drm/bridge/analogix/analogix_dp_core.c:1489 analogix_dp_bind()
warn: passing a valid pointer to 'PTR_ERR'

Fixes: 1b86a69b61df4 ("drm/bridge: analogix_dp: Apply panel_bridge helper")
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
---
 drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
index 460729fdcecd..3e46350170d4 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
@@ -1486,7 +1486,7 @@ int analogix_dp_bind(struct analogix_dp_device *dp, struct drm_device *drm_dev)
 		dp->plat_data->next_bridge = devm_drm_panel_bridge_add(dp->dev,
 								       dp->plat_data->panel);
 		if (IS_ERR(dp->plat_data->next_bridge)) {
-			ret = PTR_ERR(bridge);
+			ret = PTR_ERR(dp->plat_data->next_bridge);
 			goto err_unregister_aux;
 		}
 	}
-- 
2.54.0

Re: [PATCH] drm/bridge: analogix_dp: Extract error pointer from correct variable

[Luca Ceresoli]

On Wed Apr 29, 2026 at 5:08 AM CEST, Ethan Tidmore wrote:
> In devm_drm_panel_bridge_add() error path the pointer error should be
> extracted from dp->plat_data->next_bridge but instead it is extracted
> from bridge, which is a valid pointer and not part of this error path.
>
> Extract error pointer from correct variable.
>
> Detected by Smatch:
> drivers/gpu/drm/bridge/analogix/analogix_dp_core.c:1489 analogix_dp_bind()
> warn: passing a valid pointer to 'PTR_ERR'
>
> Fixes: 1b86a69b61df4 ("drm/bridge: analogix_dp: Apply panel_bridge helper")
> Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>

Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [PATCH] drm/bridge: analogix_dp: Extract error pointer from correct variable

[Damon Ding]

On 4/29/2026 7:29 PM, Luca Ceresoli wrote:
> On Wed Apr 29, 2026 at 5:08 AM CEST, Ethan Tidmore wrote:
>> In devm_drm_panel_bridge_add() error path the pointer error should be
>> extracted from dp->plat_data->next_bridge but instead it is extracted
>> from bridge, which is a valid pointer and not part of this error path.
>>
>> Extract error pointer from correct variable.
>>
>> Detected by Smatch:
>> drivers/gpu/drm/bridge/analogix/analogix_dp_core.c:1489 analogix_dp_bind()
>> warn: passing a valid pointer to 'PTR_ERR'
>>
>> Fixes: 1b86a69b61df4 ("drm/bridge: analogix_dp: Apply panel_bridge helper")
>> Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
> 
> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
> 
> 

Reviewed-by: Damon Ding <damon.ding@rock-chips.com>

Best regards,
Damon

Re: [PATCH] drm/bridge: analogix_dp: Extract error pointer from correct variable

[Luca Ceresoli]

On Tue, 28 Apr 2026 22:08:40 -0500, Ethan Tidmore wrote:
> In devm_drm_panel_bridge_add() error path the pointer error should be
> extracted from dp->plat_data->next_bridge but instead it is extracted
> from bridge, which is a valid pointer and not part of this error path.
> 
> Extract error pointer from correct variable.
> 
> Detected by Smatch:
> drivers/gpu/drm/bridge/analogix/analogix_dp_core.c:1489 analogix_dp_bind()
> warn: passing a valid pointer to 'PTR_ERR'
> 
> [...]

Applied, thanks!

[1/1] drm/bridge: analogix_dp: Extract error pointer from correct variable
      commit: 002ef4dc52dcc1dd0eb1556cffa8f02e2e7edd51

Best regards,
-- 
Luca Ceresoli <luca.ceresoli@bootlin.com>

Claude review: drm/bridge: analogix_dp: Extract error pointer from correct variable

[Claude Code Review Bot]

Overall Series Review

Subject: drm/bridge: analogix_dp: Extract error pointer from correct variable
Author: Ethan Tidmore <ethantidmore06@gmail.com>
Patches: 4
Reviewed: 2026-05-05T11:59:49.661899

---

This is a single-patch series that fixes a real, Smatch-detected bug in `analogix_dp_bind()` where `PTR_ERR()` is called on the wrong variable. The fix is straightforward and correct: the `IS_ERR()` check tests `dp->plat_data->next_bridge`, but the subsequent `PTR_ERR()` extracts the error code from `bridge` — a completely different, valid pointer. This means the error path would always return a bogus error code (likely 0 or a valid pointer cast to int), masking the real error.

**However**, this patch may already be obsolete. On drm-next, the `devm_drm_panel_bridge_add()` call and associated panel_bridge logic have been entirely removed from `analogix_dp_bind()`, meaning this code no longer exists in the current development tree. The patch would not apply cleanly to drm-next. The maintainers should evaluate whether this fix is still needed for stable backports to older kernels.

**Verdict**: The fix itself is correct but may be superseded by recent refactoring. Worth applying to stable branches if the affected code still exists there.

---
Generated by Claude Code Patch Reviewer

Claude review: drm/bridge: analogix_dp: Extract error pointer from correct variable

[Claude Code Review Bot]

Patch Review

**Bug Analysis**: Correct and real bug. The code does:
```c
dp->plat_data->next_bridge = devm_drm_panel_bridge_add(dp->dev,
                                                       dp->plat_data->panel);
if (IS_ERR(dp->plat_data->next_bridge)) {
    ret = PTR_ERR(bridge);  // BUG: wrong variable
    goto err_unregister_aux;
}
```

`bridge` is a separate local variable (the `struct drm_bridge *` for `dp->bridge`) that is a valid pointer at this point. Calling `PTR_ERR()` on a valid pointer returns garbage — typically a large positive number that gets truncated to an `int`, resulting in a misleading or zero return code. The caller would not see a proper `-ENODEV`/`-ENOMEM`/etc.

**Fix**: Correct. Changes `PTR_ERR(bridge)` to `PTR_ERR(dp->plat_data->next_bridge)`, matching the variable tested by `IS_ERR()`.

```c
ret = PTR_ERR(dp->plat_data->next_bridge);  // FIXED: matches IS_ERR check
```

**Commit message**: Clear and well-structured. Includes the Smatch warning, a proper `Fixes:` tag referencing the commit that introduced the bug (`1b86a69b61df4`), and a signed-off-by.

**Minor notes**:
- The `Fixes:` tag hash `1b86a69b61df4` uses 13 hex chars — the standard convention is 12 chars. This is cosmetic and most tooling handles it fine, but `1b86a69b61df` would be more conventional.
- As noted above, this code has been removed in drm-next. The maintainers should consider whether this patch should target stable branches instead.

**Rating**: The fix is correct, minimal, and addresses a genuine bug. Recommended for merge (targeting the appropriate branch where this code still exists).

---
Generated by Claude Code Patch Reviewer