From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup
Date: Thu, 07 May 2026 13:23:41 +1000
Message-ID: <review-patch1-20260506142434.643523-1-lgs201920130244@gmail.com>
In-Reply-To: <20260506142434.643523-1-lgs201920130244@gmail.com>
References: <20260506142434.643523-1-lgs201920130244@gmail.com> <20260506142434.643523-1-lgs201920130244@gmail.com>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Patch Review

**Bug analysis:** Correct. Looking at the kernel tree, `DEFINE_FREE(device_=
node, ...)` at `include/linux/of.h:138` is:
```c
DEFINE_FREE(device_node, struct device_node *, if (_T) of_node_put(_T))
```
The `if (_T)` guard makes it safe for `NULL` but not for `ERR_PTR()` values=
 (which are non-NULL). The original code in `imx8qxp_pxl2dpi_find_next_brid=
ge()` stores the return value of the helper directly into a `__free(device_=
node)` variable, so an `ERR_PTR(-ENODEV)` would trigger `of_node_put()` on =
a bogus address.

**Function signature change:** Clean and appropriate.
```c
-static struct device_node *
+static int
 imx8qxp_pxl2dpi_get_available_ep_from_port(struct imx8qxp_pxl2dpi *p2d,
-                                           u32 port_id)
+                                           u32 port_id,
+                                           struct device_node **ep)
```
The output parameter pattern is idiomatic for kernel code that needs to dis=
tinguish between "no result" and "error."

**Output initialization:** Correct and important:
```c
+       *ep =3D NULL;
```
This ensures that on any error path the caller's variable stays `NULL`, whi=
ch is safe with `__free(device_node)`.

**Error path changes in the helper:** All three `ERR_PTR()` returns are cor=
rectly converted:
```c
-               ep =3D ERR_PTR(-ENODEV);
+               ret =3D -ENODEV;
                goto out;
```
The `goto out` pattern is preserved, and `of_node_put(port)` at the `out:` =
label still runs correctly.

**Success path:** Correctly writes through the output pointer:
```c
-       ep =3D of_get_next_available_child(port, NULL);
-       if (!ep) {
+       *ep =3D of_get_next_available_child(port, NULL);
+       if (!*ep) {
```

**Caller update in `imx8qxp_pxl2dpi_find_next_bridge()`:**
```c
-       struct device_node *ep __free(device_node) =3D
-               imx8qxp_pxl2dpi_get_available_ep_from_port(p2d, 1);
-       if (IS_ERR(ep))
-               return PTR_ERR(ep);
+       struct device_node *ep __free(device_node) =3D NULL;
+       int ret;
+
+       ret =3D imx8qxp_pxl2dpi_get_available_ep_from_port(p2d, 1, &ep);
+       if (ret)
+               return ret;
```
The `__free(device_node)` variable is initialized to `NULL` and only gets a=
 valid pointer on success. On error, `ep` remains `NULL` and cleanup is saf=
e. Good.

**Caller update in `imx8qxp_pxl2dpi_set_pixel_link_sel()`:**
```c
-       ep =3D imx8qxp_pxl2dpi_get_available_ep_from_port(p2d, 0);
-       if (IS_ERR(ep))
-               return PTR_ERR(ep);
+       ret =3D imx8qxp_pxl2dpi_get_available_ep_from_port(p2d, 0, &ep);
+       if (ret)
+               return ret;
```
This caller does *not* use `__free(device_node)` for `ep` =E2=80=94 it has =
an explicit `of_node_put(ep)` at its `out:` label (visible in the kernel tr=
ee at lines 307=E2=80=93308). The patch correctly leaves that manual cleanu=
p in place. On the error path from the helper, `ep` is `NULL` and the expli=
cit `of_node_put(NULL)` is a no-op, which is correct.

**Fixes tag and Cc: stable:** Both appropriate. The fix references `ceea3f7=
806a10` which introduced the `__free(device_node)` usage that created this =
bug.

**No issues found.** The patch is minimal, correct, well-documented in the =
commit message, and suitable for stable backport.

---
Generated by Claude Code Patch Reviewer