| Message ID | 20230920082727.57729-1-angelogioacchino.delregno@collabora.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] drm/bridge: panel: Fix device link for DRM_BRIDGE_ATTACH_NO_CONNECTOR | expand |
On Wednesday, September 20, 2023 4:27 PM AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> wrote: > When external bridges are attached with > DRM_BRIDGE_ATTACH_NO_CONNECTOR, > the panel bridge may also get the same flag, but in the .attach() > callback for the panel bridge a device link is added only when this > flag is not present; To make things worse, the .detach() callback > tries to delete the device link unconditionally and without checking > if it was created in the first place, crashing the kernel with a NULL > pointer kernel panic upon calling panel_bridge_detach(). > > Fix that by moving the device_link_add() call before checking if the > DRM_BRIDGE_ATTACH_NO_CONNECTOR flag is present. > > Fixes: 199cf07ebd2b ("drm/bridge: panel: Add a device link between drm > device and panel device") > Signed-off-by: AngeloGioacchino Del Regno > <angelogioacchino.delregno@collabora.com> > --- > > Changes in v2: > - Added device_link_del() for (!bridge->encoder) error condition > > drivers/gpu/drm/bridge/panel.c | 17 +++++++++-------- > 1 file changed, 9 insertions(+), 8 deletions(-) Reviewed-by: Liu Ying <victor.liu@nxp.com>
Hi, On Wed, 20 Sep 2023 10:27:27 +0200, AngeloGioacchino Del Regno wrote: > When external bridges are attached with DRM_BRIDGE_ATTACH_NO_CONNECTOR, > the panel bridge may also get the same flag, but in the .attach() > callback for the panel bridge a device link is added only when this > flag is not present; To make things worse, the .detach() callback > tries to delete the device link unconditionally and without checking > if it was created in the first place, crashing the kernel with a NULL > pointer kernel panic upon calling panel_bridge_detach(). > > [...] Thanks, Applied to https://anongit.freedesktop.org/git/drm/drm-misc.git (drm-misc-next) [1/1] drm/bridge: panel: Fix device link for DRM_BRIDGE_ATTACH_NO_CONNECTOR https://cgit.freedesktop.org/drm/drm-misc/commit/?id=887878014534186cc50dbd16a62e744ad217b4b1
diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c index e00d2e94c751..e48823a4f1ed 100644 --- a/drivers/gpu/drm/bridge/panel.c +++ b/drivers/gpu/drm/bridge/panel.c @@ -67,14 +67,6 @@ static int panel_bridge_attach(struct drm_bridge *bridge, struct drm_device *drm_dev = bridge->dev; int ret; - if (flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR) - return 0; - - if (!bridge->encoder) { - DRM_ERROR("Missing encoder\n"); - return -ENODEV; - } - panel_bridge->link = device_link_add(drm_dev->dev, panel->dev, DL_FLAG_STATELESS); if (!panel_bridge->link) { @@ -83,6 +75,15 @@ static int panel_bridge_attach(struct drm_bridge *bridge, return -EINVAL; } + if (flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR) + return 0; + + if (!bridge->encoder) { + DRM_ERROR("Missing encoder\n"); + device_link_del(panel_bridge->link); + return -ENODEV; + } + drm_connector_helper_add(connector, &panel_bridge_connector_helper_funcs);
When external bridges are attached with DRM_BRIDGE_ATTACH_NO_CONNECTOR, the panel bridge may also get the same flag, but in the .attach() callback for the panel bridge a device link is added only when this flag is not present; To make things worse, the .detach() callback tries to delete the device link unconditionally and without checking if it was created in the first place, crashing the kernel with a NULL pointer kernel panic upon calling panel_bridge_detach(). Fix that by moving the device_link_add() call before checking if the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag is present. Fixes: 199cf07ebd2b ("drm/bridge: panel: Add a device link between drm device and panel device") Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> --- Changes in v2: - Added device_link_del() for (!bridge->encoder) error condition drivers/gpu/drm/bridge/panel.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)