From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=210.118.77.12 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793876062; b=YkvKKhsyJPDU1dZIj+ycx4DLIUslO7NiyMjH4kXo15FwFjnSu7nXu5HRchC/HGHmnw6J +uWZWZgNF+KQqvjSnoKw3dR+OAq0VhPO7us+9vcB4Ul+ld0ZGoWrXakf9/nGekD/gKh01 hEINnJJpaz6+AcarUUBbtA0zG6tH9c8mKqzwkEbOhZVE9aEaz2GfLxP9e2W0XgtcOP63K H3zymUci15madrDENIiLAOtRX6FOyB9apsEnSU3ac5sxkiq55d2Wcf590hFh24HpMYwt+ vwplBNqOrIUW2gARGG/Rc1tV2DYjxQeTEtUW2wYncRbGakOTFJCG/FYy76J+NLl2xEQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793876062; h=DMARC-Filter:Received:DKIM-Filter:DKIM-Signature:Received:Received: Message-ID:Date:MIME-Version:User-Agent:Subject:To:Cc: Content-Language:From:In-Reply-To:Content-Transfer-Encoding: X-CMS-MailID:X-Msg-Generator:Content-Type:X-RootMTR:X-EPHeader: X-CMS-RootMailID:References; bh=8U+WQmu8jFLJh5cbm79ZPqM5GeKacWcEkDyhOz912oU=; b=SjMctE5ScClD6XNG0v+ugLEBfks/5vag7Vo03wZwkRpw+miep8HfVa7nT/8sGn35MjSQ moJun12bMy/DbfgfkY9I+N+qbRpqrB19FzToC5RgnbKB90h8bjrdW9u+eBaNTm8VIN0nS shGvMCruuK86MTJpL8gflXxJ6dHiVOGh2N1G2EbL5Espbdk103tI0afXcTNm1LOMCNaZp 5ZjsBE3JgKKbFY5FdkK8tOpCs7V7HUBxm3WUZbxs6RqvOGKZ4KMSJ/ByHB+t909L40+Oq duROOfpsJfPpluu0shXj9uOr2KfiIpKPxDJrYYaQ5YQjwkvmMbA+kEOuffqFmgC7RNg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=samsung.com; spf=pass smtp.mailfrom=samsung.com; dkim=pass header.d=samsung.com header.i=@samsung.com header.a=rsa-sha256 header.s=mail20170921 header.b=NcjEQpYM; arc=none smtp.remote-ip=210.118.77.12 Received: from mailout2.w1.samsung.com (mailout2.w1.samsung.com [210.118.77.12]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B594C606A332; Thu, 5 Nov 2026 10:54:20 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org B594C606A332 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=samsung.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=samsung.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=samsung.com header.i=@samsung.com header.a=rsa-sha256 header.s=mail20170921 header.b=NcjEQpYM Received: from eucas1p2.samsung.com (unknown [182.198.249.207]) by mailout2.w1.samsung.com (KnoxPortal) with ESMTP id 20261105105412euoutp0221de3a5b7a4048d78194fc0f7afe1c16~lIMP-HPlY3044430444euoutp02C; Thu, 5 Nov 2026 10:54:12 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout2.w1.samsung.com 20261105105412euoutp0221de3a5b7a4048d78194fc0f7afe1c16~lIMP-HPlY3044430444euoutp02C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1793876052; bh=8U+WQmu8jFLJh5cbm79ZPqM5GeKacWcEkDyhOz912oU=; h=Date:Subject:To:Cc:From:In-Reply-To:References:From; b=NcjEQpYMRbxhXBgzKnZDjzO9LLwfDGOaaIfPmI2qnt8v3BjyjGfN95aIsbRJ5WcAe pMYGKFT8Id4k/8Q0czZ/74nGUvslfN7Kw9FJOU7LmEuNez+Hz47vdPfnIMzS747B6m sW7Jr++9LwO+aS1wGDZxc4S00WHnS1MZnDI6ngsg= Received: from eusmtip1.samsung.com (unknown [203.254.199.221]) by eucas1p1.samsung.com (KnoxPortal) with ESMTPA id 20261105105412eucas1p171b6bde174fb0b6700cc78deee9d7edf~lIMPucvWX2329723297eucas1p12; Thu, 5 Nov 2026 10:54:12 +0000 (GMT) Received: from [192.168.1.44] (unknown [106.210.136.40]) by eusmtip1.samsung.com (KnoxPortal) with ESMTPA id 20261105105410eusmtip15133e9a84efd244fc2a8fcab25cfa49a~lIMOGw1ty2761527615eusmtip1a; Thu, 5 Nov 2026 10:54:10 +0000 (GMT) Message-ID: <204d333a-6f09-4498-b776-b2daee8d94b8@samsung.com> Date: Thu, 5 Nov 2026 11:54:10 +0100 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v6 02/18] drm/bridge: inno-hdmi: Don't dereference a NULL drm_device on hotplug To: Heiko Stuebner , Neil Armstrong , Rob Herring , Krzysztof Kozlowski , Andrzej Hajda , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Luca Ceresoli , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Philipp Zabel , Emil Renner Berthing , Hal Feng , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Dominique Belhachemi , Andy Yan , David Airlie , Simona Vetter , Yakir Yang , Dmitry Baryshkov , Conor Dooley , William Qiu , Xingyu Wu , Sandy Huang , Manivannan Sadhasivam Cc: devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-rockchip@lists.infradead.org, linux-riscv@lists.infradead.org, Marek Szyprowski , Maud Spierings , Graham Markall , Icenowy Zheng , Chaoyi Chen , Joshua Peisach , =?UTF-8?Q?Uwe_Kleine-K=C3=B6nig?= Content-Language: en-US From: Michal Wilczynski In-Reply-To: <2261991.3Lj2Plt8kZ@phil> Content-Transfer-Encoding: 8bit X-CMS-MailID: 20261105105412eucas1p171b6bde174fb0b6700cc78deee9d7edf X-Msg-Generator: CA Content-Type: text/plain; charset="utf-8" X-RootMTR: 20261030174510eucas1p2f85c6d82738ce34b17bdcab27f914ac1 X-EPHeader: CA X-CMS-RootMailID: 20261030174510eucas1p2f85c6d82738ce34b17bdcab27f914ac1 References: <20261029-jh7110-clean-send-v6-0-759594e43acf@samsung.com> <20261029-jh7110-clean-send-v6-2-759594e43acf@samsung.com> <1844578.vCJZsxu672@phil> <2261991.3Lj2Plt8kZ@phil> On 10/30/26 18:44, Heiko Stuebner wrote: > Am Freitag, 30. Oktober 2026, 18:43:47 Mitteleuropäische Normalzeit schrieb Heiko Stuebner: >> Am Donnerstag, 29. Oktober 2026, 08:53:36 Mitteleuropäische Normalzeit schrieb Michal Wilczynski: >>> inno_hdmi_irq() passes hdmi->bridge.dev to drm_helper_hpd_irq_event(), >>> which dereferences it in its first statement: >>> >>> if (!dev->mode_config.poll_enabled) >>> >>> bridge.dev is assigned only by drm_bridge_attach(), but inno_hdmi_bind() >>> unmutes the hotplug interrupt in inno_hdmi_init_hw() and installs the >>> handler well before it attaches the bridge: >>> >>> inno_hdmi_init_hw(hdmi); /* unmutes hotplug */ >>> devm_request_threaded_irq(...); /* handler goes live */ >>> ... >>> hdmi->bridge.ddc = inno_hdmi_i2c_adapter(hdmi); >>> devm_drm_bridge_add(dev, &hdmi->bridge); >>> drm_bridge_attach(...); /* bridge.dev set here */ >>> >>> The bridge is allocated by devm_drm_bridge_alloc(), which kzalloc()s it, >>> so bridge.dev is NULL for all of that window, and a hotplug event >>> arriving in it enters drm_helper_hpd_irq_event(NULL). >>> >>> Before the conversion to a bridge the ordering was safe: >>> inno_hdmi_register() called drmm_connector_hdmi_init(), which set >>> connector.dev, before the interrupt was requested. >>> >>> Drop hotplug events that arrive before the bridge is attached. >>> >>> Fixes: 969325a2597e ("drm/rockchip: inno-hdmi: Convert to drm bridge") >>> Signed-off-by: Michal Wilczynski >>> --- >>> drivers/gpu/drm/bridge/inno-hdmi.c | 8 +++++++- >>> 1 file changed, 7 insertions(+), 1 deletion(-) >>> >>> diff --git a/drivers/gpu/drm/bridge/inno-hdmi.c b/drivers/gpu/drm/bridge/inno-hdmi.c >>> index d7c33b92e2ddf4ced84d17304463f44be52270b8..d29832249b942dec84fb9d07a0b21ee751fc0486 100644 >>> --- a/drivers/gpu/drm/bridge/inno-hdmi.c >>> +++ b/drivers/gpu/drm/bridge/inno-hdmi.c >>> @@ -929,7 +929,13 @@ static irqreturn_t inno_hdmi_irq(int irq, void *dev_id) >>> { >>> struct inno_hdmi *hdmi = dev_id; >>> >>> - drm_helper_hpd_irq_event(hdmi->bridge.dev); >>> + /* >>> + * The interrupt is requested before the bridge is attached, and >>> + * bridge.dev is only set by drm_bridge_attach(). Drop hotplug events >>> + * that arrive before then rather than dereference a NULL drm_device. >>> + */ > > nit: I don't think that huge comment is necessary for that Thanks, I'll trim the comment in v7 > > >>> + if (hdmi->bridge.dev) >>> + drm_helper_hpd_irq_event(hdmi->bridge.dev); >> >> Reviewed-by: Heiko Stuebner >> >> Most other callers of drm_helper_hpd_irq_event() also do exactly this. >> >> >> Heiko >> > > > > > Best regards, -- Michal Wilczynski