Claude review: drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Bug analysis:** Correct. Looking at the kernel tree, `DEFINE_FREE(device_node, ...)` at `include/linux/of.h:138` is:
```c
DEFINE_FREE(device_node, struct device_node *, if (_T) of_node_put(_T))
```
The `if (_T)` guard makes it safe for `NULL` but not for `ERR_PTR()` values (which are non-NULL). The original code in `imx8qxp_pxl2dpi_find_next_bridge()` stores the return value of the helper directly into a `__free(device_node)` variable, so an `ERR_PTR(-ENODEV)` would trigger `of_node_put()` on a bogus address.

**Function signature change:** Clean and appropriate.
```c
-static struct device_node *
+static int
 imx8qxp_pxl2dpi_get_available_ep_from_port(struct imx8qxp_pxl2dpi *p2d,
-                                           u32 port_id)
+                                           u32 port_id,
+                                           struct device_node **ep)
```
The output parameter pattern is idiomatic for kernel code that needs to distinguish between "no result" and "error."

**Output initialization:** Correct and important:
```c
+       *ep = NULL;
```
This ensures that on any error path the caller's variable stays `NULL`, which is safe with `__free(device_node)`.

**Error path changes in the helper:** All three `ERR_PTR()` returns are correctly converted:
```c
-               ep = ERR_PTR(-ENODEV);
+               ret = -ENODEV;
                goto out;
```
The `goto out` pattern is preserved, and `of_node_put(port)` at the `out:` label still runs correctly.

**Success path:** Correctly writes through the output pointer:
```c
-       ep = of_get_next_available_child(port, NULL);
-       if (!ep) {
+       *ep = of_get_next_available_child(port, NULL);
+       if (!*ep) {
```

**Caller update in `imx8qxp_pxl2dpi_find_next_bridge()`:**
```c
-       struct device_node *ep __free(device_node) =
-               imx8qxp_pxl2dpi_get_available_ep_from_port(p2d, 1);
-       if (IS_ERR(ep))
-               return PTR_ERR(ep);
+       struct device_node *ep __free(device_node) = NULL;
+       int ret;
+
+       ret = imx8qxp_pxl2dpi_get_available_ep_from_port(p2d, 1, &ep);
+       if (ret)
+               return ret;
```
The `__free(device_node)` variable is initialized to `NULL` and only gets a valid pointer on success. On error, `ep` remains `NULL` and cleanup is safe. Good.

**Caller update in `imx8qxp_pxl2dpi_set_pixel_link_sel()`:**
```c
-       ep = imx8qxp_pxl2dpi_get_available_ep_from_port(p2d, 0);
-       if (IS_ERR(ep))
-               return PTR_ERR(ep);
+       ret = imx8qxp_pxl2dpi_get_available_ep_from_port(p2d, 0, &ep);
+       if (ret)
+               return ret;
```
This caller does *not* use `__free(device_node)` for `ep` — it has an explicit `of_node_put(ep)` at its `out:` label (visible in the kernel tree at lines 307–308). The patch correctly leaves that manual cleanup in place. On the error path from the helper, `ep` is `NULL` and the explicit `of_node_put(NULL)` is a no-op, which is correct.

**Fixes tag and Cc: stable:** Both appropriate. The fix references `ceea3f7806a10` which introduced the `__free(device_node)` usage that created this bug.

**No issues found.** The patch is minimal, correct, well-documented in the commit message, and suitable for stable backport.

---
Generated by Claude Code Patch Reviewer