From: Zijun Hu <quic_zijuhu@xxxxxxxxxxx>
commit e4c00c9b1f70cd11792ff5b825899a6ee0234a62 upstream.
API of_parse_phandle_with_args_map() will use wrong input for nexus node
Nexus_2 as shown below:
Node_1 Nexus_1 Nexus_2
&Nexus_1,arg_1 -> arg_1,&Nexus_2,arg_2' -> &Nexus_2,arg_2 -> arg_2,...
map-pass-thru=<...>
Nexus_1's output arg_2 should be used as input of Nexus_2, but the API
wrongly uses arg_2' instead which != arg_2 due to Nexus_1's map-pass-thru.
Fix by always making @match_array point to @initial_match_array into
which to store nexus output.
Fixes: bd6f2fd5a1d5 ("of: Support parsing phandle argument lists through a nexus node")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Zijun Hu <quic_zijuhu@xxxxxxxxxxx>
Link: https://lore.kernel.org/r/20250109-of_core_fix-v4-1-db8a72415b8c@xxxxxxxxxxx
Signed-off-by: Rob Herring (Arm) <robh@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/of/base.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1733,7 +1733,6 @@ int of_parse_phandle_with_args_map(const
* specifier into the out_args structure, keeping the
* bits specified in <list>-map-pass-thru.
*/
- match_array = map - new_size;
for (i = 0; i < new_size; i++) {
__be32 val = *(map - new_size + i);
@@ -1742,6 +1741,7 @@ int of_parse_phandle_with_args_map(const
val |= cpu_to_be32(out_args->args[i]) & pass[i];
}
+ initial_match_array[i] = val;
out_args->args[i] = be32_to_cpu(val);
}
out_args->args_count = list_size = new_size;
Patches currently in stable-queue which might be from quic_zijuhu@xxxxxxxxxxx are
queue-5.4/of-reserved-memory-fix-using-wrong-number-of-cells-to-get-property-alignment.patch
queue-5.4/of-fix-of_find_node_opts_by_path-handling-of-alias-path-options.patch
queue-5.4/pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch
queue-5.4/of-correct-child-specifier-used-as-input-of-the-2nd-nexus-node.patch
