of: Correct child specifier used as input of the 2nd nexus node

commit e4c00c9b1f70cd11792ff5b825899a6ee0234a62 upstream.

API of_parse_phandle_with_args_map() will use wrong input for nexus node
Nexus_2 as shown below:

    Node_1		Nexus_1                              Nexus_2
&Nexus_1,arg_1 -> arg_1,&Nexus_2,arg_2' -> &Nexus_2,arg_2 -> arg_2,...
		  map-pass-thru=<...>

Nexus_1's output arg_2 should be used as input of Nexus_2, but the API
wrongly uses arg_2' instead which != arg_2 due to Nexus_1's map-pass-thru.

Fix by always making @match_array point to @initial_match_array into
which to store nexus output.

Fixes: bd6f2fd5a1d5 ("of: Support parsing phandle argument lists through a nexus node")
Cc: stable@vger.kernel.org
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Link: https://lore.kernel.org/r/20250109-of_core_fix-v4-1-db8a72415b8c@quicinc.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/of/base.c b/drivers/of/base.c
index e1b2b9275e6874cd6f99247fd4964aefe5074972..c485b1ee4aca2c41713a8c0503ef8aa212f65e51 100644 (file)
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1635,7 +1635,6 @@ int of_parse_phandle_with_args_map(const struct device_node *np,
                 * specifier into the out_args structure, keeping the
                 * bits specified in <list>-map-pass-thru.
                 */
-               match_array = map - new_size;
                for (i = 0; i < new_size; i++) {
                        __be32 val = *(map - new_size + i);
 
@@ -1644,6 +1643,7 @@ int of_parse_phandle_with_args_map(const struct device_node *np,
                                val |= cpu_to_be32(out_args->args[i]) & pass[i];
                        }
 
+                       initial_match_array[i] = val;
                        out_args->args[i] = be32_to_cpu(val);
                }
                out_args->args_count = list_size = new_size;