From patchwork Tue Sep 1 18:50:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cristian Ciocaltea X-Patchwork-Id: 3117 Return-Path: X-Original-To: noreply@patchwork.local Delivered-To: noreply@patchwork.local Received: from sea.lore.kernel.org (sea.lore.kernel.org [172.234.253.10]) by mxe881.netcup.net (Postfix) with ESMTPS id E34901C1943 for ; Tue, 1 Sep 2026 21:27:46 +0200 (CEST) Authentication-Results: mxe881; dkim=pass header.d=collabora.com; spf=pass (sender IP is 172.234.253.10) smtp.mailfrom=linux-sunxi+bounces-25404-noreply=patchwork.local@lists.linux.dev smtp.helo=sea.lore.kernel.org Received-SPF: pass (mxe881: domain of lists.linux.dev designates 172.234.253.10 as permitted sender) client-ip=172.234.253.10; envelope-from=linux-sunxi+bounces-25404-noreply=patchwork.local@lists.linux.dev; helo=sea.lore.kernel.org; Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sea.lore.kernel.org (Postfix) with ESMTP id D2A7E101B8F for ; Tue, 1 Sep 2026 18:52:14 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id B5D764A206C; Tue, 1 Sep 2026 18:50:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="I9EWgqCE" X-Original-To: linux-sunxi@lists.linux.dev Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 84EC64A0127 for ; Tue, 1 Sep 2026 18:50:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788288656; cv=none; b=aA+VBMmVVxRjH08MMnBQyF5A7pg2yI3zQjjdhaFU/hMBGVOYHYGaIOMbj9Iu6TTMeaT2M6F5yPTN+PRZRERBtEkFCG3Yo7IMmScHczUh+h/uz7VpWu94x4JX7HvOpipuFPRSzVwTtGaR7QF1ioVZzUTWoPSJuf3+MVvPJ1e/Bsk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788288656; c=relaxed/simple; bh=FYdmAkPWFKCF8O++onHpEmGeuQyVm5oG12OGbdUPBSU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=rjiccRHZ0gTT77O0pc5jcAomE2kQKTJ8iZpGg4LiH1CK2y/lRHmAcatuikyu1g+VtmtHz9JuXCOBUrXbhXk13IIMtj9cNYdsBA3tNyqU0qv/UKxCEMXKDiBWOByOi/fWr5nIoLQ4Dzuv8qvoXvNPGJqfhmGGaOdI7oTG6tATHyk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=I9EWgqCE; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1788288650; bh=FYdmAkPWFKCF8O++onHpEmGeuQyVm5oG12OGbdUPBSU=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=I9EWgqCEXTO1HQHg65SdoSbw5hytYZgMJMA6p8u+jfLmpEjrhQGG4EJiMqZnRCDsB Dc0di44ZLXRA8tRKhF1P6oTNQt94LGIvGkt2iERzqSi6/USBZn9VGT/olY9/vut1Lu X1gy2To1yHvCtyQAhZnSjelA83+9OSrXVBAfu7CCuV++LfRlBJWCyGb+WbMUjll8yp VCat2m9yWQRBtBO/IebG2njy7jfYa8B30zxBTw3khcaCe/ZQqV8Y2aoiQKZLkso+6B fjQ7gGCnavuBP+4XqExdhIai0DqfCQGnyHih70BTHcLhD4h2cGrTodPmgOHp5Ql/H/ hOUH8pBl3Vdow== Received: from localhost (unknown [100.64.0.241]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange secp256r1 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: cristicc) by bali.collaboradmins.com (Postfix) with ESMTPSA id ADF5117E361B; Tue, 01 Sep 2026 20:50:50 +0200 (CEST) From: Cristian Ciocaltea Date: Tue, 01 Sep 2026 21:50:37 +0300 Subject: [PATCH v11 13/74] drm/bridge: Fix NULL deref in drm_bridge_add() for legacy bridges Precedence: bulk X-Mailing-List: linux-sunxi@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20260901-dw-hdmi-qp-scramb-v11-13-bc12954a0688@collabora.com> References: <20260901-dw-hdmi-qp-scramb-v11-0-bc12954a0688@collabora.com> In-Reply-To: <20260901-dw-hdmi-qp-scramb-v11-0-bc12954a0688@collabora.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dave Stevenson , Dmitry Baryshkov , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Luca Ceresoli , Chen-Yu Tsai , Samuel Holland , =?utf-8?q?Ma=C3=ADra_Canal?= , Raspberry Pi Kernel Maintenance , Raphael Gallais-Pou , Sandy Huang , =?utf-8?q?Heiko_St=C3=BCbner?= , Andy Yan , Algea Cao , Daniel Stone , Liu Ying , Phong LE , Helge Deller Cc: kernel@collabora.com, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-rockchip@lists.infradead.org, linux-fbdev@vger.kernel.org, Sashiko X-Mailer: b4 0.15.2 X-MORS-Enabled: yes X-MORS-DOMAIN: patchwork.local X-MORS-HOSTING: hosting172546 X-MORS-USER: hosting172546 X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= Legacy bridge drivers that embed struct drm_bridge in a zero-initialized allocation, rather than obtaining it from devm_drm_bridge_alloc(), never run INIT_LIST_HEAD() on bridge->list, leaving next and prev NULL. list_empty() compares next against &bridge->list, so it reports such a list head as non-empty. list_del_init() therefore runs and dereferences the NULL pointers, panicking the kernel during probe. Only builds with CONFIG_DEBUG_LIST survive, with a list corruption report. This affects rk3066_hdmi and the i.MX8 LDB bridges, which still embed a bridge in a devm_kzalloc()'d struct. Initialize the list head when it is found to be NULL, so that the bridge ends up with a valid empty list head and list_del_init() is only reached for bridges that can actually be linked. Fixes: 17805a15d175 ("drm/bridge: add list of removed refcounted bridges") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260731175016.C5D591F00AC4@smtp.kernel.org/ Signed-off-by: Cristian Ciocaltea --- drivers/gpu/drm/drm_bridge.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c index 2c457ad74f3b..a8b6df5c13ea 100644 --- a/drivers/gpu/drm/drm_bridge.c +++ b/drivers/gpu/drm/drm_bridge.c @@ -453,9 +453,16 @@ void drm_bridge_add(struct drm_bridge *bridge) * If the bridge was previously added and then removed, it is now * in bridge_lingering_list. Remove it or bridge_lingering_list will be * corrupted when adding this bridge to bridge_list below. + * + * Legacy drivers that allocate the bridge with kzalloc() rather than + * devm_drm_bridge_alloc() leave list.next NULL. Such a bridge cannot + * be on any list, and list_del_init() would dereference NULL, so + * initialize the list head first. */ mutex_lock(&bridge_lock); - if (!list_empty(&bridge->list)) + if (!bridge->list.next) + INIT_LIST_HEAD(&bridge->list); + else if (!list_empty(&bridge->list)) list_del_init(&bridge->list); mutex_unlock(&bridge_lock);