From patchwork Thu Jul 23 01:35:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cristian Ciocaltea X-Patchwork-Id: 2757 Return-Path: X-Original-To: noreply@patchwork.local Delivered-To: noreply@patchwork.local Received: from tor.lore.kernel.org (tor.lore.kernel.org [172.105.105.114]) by mxe881.netcup.net (Postfix) with ESMTPS id 465C31C2B5B for ; Thu, 23 Jul 2026 03:39:54 +0200 (CEST) Authentication-Results: mxe881; dkim=pass header.d=collabora.com; spf=pass (sender IP is 172.105.105.114) smtp.mailfrom=linux-sunxi+bounces-24665-noreply=patchwork.local@lists.linux.dev smtp.helo=tor.lore.kernel.org Received-SPF: pass (mxe881: domain of lists.linux.dev designates 172.105.105.114 as permitted sender) client-ip=172.105.105.114; envelope-from=linux-sunxi+bounces-24665-noreply=patchwork.local@lists.linux.dev; helo=tor.lore.kernel.org; Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id 9574E310501E for ; Thu, 23 Jul 2026 01:36:15 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id AB7A333DEC2; Thu, 23 Jul 2026 01:35:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="JJldB6FD" X-Original-To: linux-sunxi@lists.linux.dev Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF112331ED0 for ; Thu, 23 Jul 2026 01:35:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784770523; cv=none; b=WFWMX59YH6M/Yq045YBb9Bf9IH646OAqKxKQj6AEnhmcOCEHflizxgDfqJvIwQRekcPLXmK9QjaqjLRkvejF07JxHgFLwrEOV+qm2lViKZSqYIHsPIDsTsZLqvrucd1cQkwL/dIVwHuPYZivCwTXh9WcVLKhbisS45iGI3l52h4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784770523; c=relaxed/simple; bh=T7Fb3/FvJZGQaNLv0cZ3OdL0hvfbtlb8F+Z2Tu/MECM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=sIgGvReodGeFOGAMJepDDRt1w9L5cLgocHcNu86v9U/dj6q0mCrkheFz/RsacFG9Em0d95ErFL8xT9ejjLn0XsyIOJOvgjoQmN89wtPm3r5hshZ7uNSD5gEGndxLqfXM/AGumwjHjXjbHudx4/AgxUe+HIHokwgAVV2xZhG1MwU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=JJldB6FD; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1784770518; bh=T7Fb3/FvJZGQaNLv0cZ3OdL0hvfbtlb8F+Z2Tu/MECM=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=JJldB6FDZOpnrHrMHzt5pJZIgqAx46gX+IUnEZ2WsB2faFqcDV8QSz6FhyivZIlZW Ib9VHvUVeMtk+au5DxAwrER7aLOGuCeskSbq1ad+UkhFmkxhUAUyDajdWaLPfvESG5 rLVp9HQbr6UnXeOqRiEmZltcagUbOSQj4w3T/nEE0QaLDn+NQkw6du1L+tXtFmL0P9 /J8UjfSjZzFqfDtODTrgg1L2kAMyK27dtMTfOvbpyObI5rOYZRt5DLZ5W9AnCCqwYn 8rbWP3MD26zrEaYWxZdTN4UHPum7koUr0wNSprb32t3PsrepjBCZG1cJnm++NFVhiY U6ChBQZRq9ghA== Received: from localhost (unknown [100.64.0.241]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange secp256r1 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: cristicc) by bali.collaboradmins.com (Postfix) with ESMTPSA id C979E17E1274; Thu, 23 Jul 2026 03:35:18 +0200 (CEST) From: Cristian Ciocaltea Date: Thu, 23 Jul 2026 04:35:13 +0300 Subject: [PATCH v9 24/61] drm/rockchip: dw_hdmi_qp: Fix NULL deref in PM ops on incomplete bind Precedence: bulk X-Mailing-List: linux-sunxi@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20260723-dw-hdmi-qp-scramb-v9-24-4fb12ea22ac9@collabora.com> References: <20260723-dw-hdmi-qp-scramb-v9-0-4fb12ea22ac9@collabora.com> In-Reply-To: <20260723-dw-hdmi-qp-scramb-v9-0-4fb12ea22ac9@collabora.com> To: Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Luca Ceresoli , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Chen-Yu Tsai , Samuel Holland , Dave Stevenson , =?utf-8?q?Ma=C3=ADra_Canal?= , Raspberry Pi Kernel Maintenance , Sandy Huang , =?utf-8?q?Heiko_St=C3=BCbner?= , Andy Yan , Algea Cao , Daniel Stone , Liu Ying , Phong LE Cc: kernel@collabora.com, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-rockchip@lists.infradead.org, Sashiko X-Mailer: b4 0.15.2 X-MORS-Enabled: yes X-MORS-DOMAIN: patchwork.local X-MORS-HOSTING: hosting172546 X-MORS-USER: hosting172546 X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= The system-sleep PM callbacks fetch the driver state via dev_get_drvdata() and dereference it unconditionally. However, they can run while the device is not fully bound. If the system suspends before the component framework invokes the bind callback (e.g. during a deferred probe waiting for the VOP), dev_get_drvdata() returns NULL. Moreover, if dw_hdmi_qp_bind() fails, drvdata is already set but hdmi->hdmi is left holding an error pointer. In either case dw_hdmi_qp_rockchip_resume() dereferences an invalid pointer, causing a kernel panic; the suspend path is equally affected. Guard both callbacks against NULL checks, and reset hdmi->hdmi to NULL when dw_hdmi_qp_bind() fails so the guards are effective. hdmi->ctrl_ops is assigned before platform_set_drvdata(), so it is safe to use whenever drvdata is non-NULL. Fixes: 128a9bf8ace2 ("drm/rockchip: Add basic RK3588 HDMI output support") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260702151550.8E14D1F000E9@smtp.kernel.org/ Signed-off-by: Cristian Ciocaltea --- drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c index 9c4cf68d79d5..7c9d26d79664 100644 --- a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c +++ b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c @@ -686,9 +686,12 @@ static int dw_hdmi_qp_rockchip_bind(struct device *dev, struct device *master, platform_set_drvdata(pdev, hdmi); hdmi->hdmi = dw_hdmi_qp_bind(pdev, encoder, &plat_data); - if (IS_ERR(hdmi->hdmi)) - return dev_err_probe(hdmi->dev, PTR_ERR(hdmi->hdmi), + if (IS_ERR(hdmi->hdmi)) { + ret = PTR_ERR(hdmi->hdmi); + hdmi->hdmi = NULL; + return dev_err_probe(hdmi->dev, ret, "Failed to bind dw-hdmi-qp"); + } connector = drm_bridge_connector_init(drm, encoder); if (IS_ERR(connector)) @@ -726,7 +729,8 @@ static int __maybe_unused dw_hdmi_qp_rockchip_suspend(struct device *dev) { struct rockchip_hdmi_qp *hdmi = dev_get_drvdata(dev); - dw_hdmi_qp_suspend(dev, hdmi->hdmi); + if (hdmi && hdmi->hdmi) + dw_hdmi_qp_suspend(dev, hdmi->hdmi); return 0; } @@ -735,12 +739,15 @@ static int __maybe_unused dw_hdmi_qp_rockchip_resume(struct device *dev) { struct rockchip_hdmi_qp *hdmi = dev_get_drvdata(dev); - hdmi->ctrl_ops->io_init(hdmi); + if (hdmi) { + hdmi->ctrl_ops->io_init(hdmi); - dw_hdmi_qp_resume(dev, hdmi->hdmi); + if (hdmi->hdmi) + dw_hdmi_qp_resume(dev, hdmi->hdmi); - if (hdmi->encoder.encoder.dev) - drm_helper_hpd_irq_event(hdmi->encoder.encoder.dev); + if (hdmi->encoder.encoder.dev) + drm_helper_hpd_irq_event(hdmi->encoder.encoder.dev); + } return 0; }