The lt8912b driver, in its bridge detach function, calls
drm_connector_unregister() and drm_connector_cleanup().
drm_connector_unregister() should be called only for connectors
explicitly registered with drm_connector_register(), which is not the
case in lt8912b.
The driver's drm_connector_funcs.destroy hook is set to
drm_connector_cleanup().
Thus the driver should not call either drm_connector_unregister() nor
drm_connector_cleanup() in its lt8912_bridge_detach(), as they cause a
crash on bridge detach:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000000858f3000
[0000000000000000] pgd=0800000085918003, p4d=0800000085918003, pud=0800000085431003, pmd=0000000000000000
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in: tidss(-) display_connector lontium_lt8912b tc358768 panel_lvds panel_simple drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks
CPU: 3 PID: 462 Comm: rmmod Tainted: G W 6.5.0-rc2+ #2
Hardware name: Toradex Verdin AM62 on Verdin Development Board (DT)
pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : drm_connector_cleanup+0x78/0x2d4 [drm]
lr : lt8912_bridge_detach+0x54/0x6c [lontium_lt8912b]
sp : ffff800082ed3a90
x29: ffff800082ed3a90 x28: ffff0000040c1940 x27: 0000000000000000
x26: 0000000000000000 x25: dead000000000122 x24: dead000000000122
x23: dead000000000100 x22: ffff000003fb6388 x21: 0000000000000000
x20: 0000000000000000 x19: ffff000003fb6260 x18: fffffffffffe56e8
x17: 0000000000000000 x16: 0010000000000000 x15: 0000000000000038
x14: 0000000000000000 x13: ffff800081914b48 x12: 000000000000040e
x11: 000000000000015a x10: ffff80008196ebb8 x9 : ffff800081914b48
x8 : 00000000ffffefff x7 : ffff0000040c1940 x6 : ffff80007aa649d0
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80008159e008
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
drm_connector_cleanup+0x78/0x2d4 [drm]
lt8912_bridge_detach+0x54/0x6c [lontium_lt8912b]
drm_bridge_detach+0x44/0x84 [drm]
drm_encoder_cleanup+0x40/0xb8 [drm]
drmm_encoder_alloc_release+0x1c/0x30 [drm]
drm_managed_release+0xac/0x148 [drm]
drm_dev_put.part.0+0x88/0xb8 [drm]
devm_drm_dev_init_release+0x14/0x24 [drm]
devm_action_release+0x14/0x20
release_nodes+0x5c/0x90
devres_release_all+0x8c/0xe0
device_unbind_cleanup+0x18/0x68
device_release_driver_internal+0x208/0x23c
driver_detach+0x4c/0x94
bus_remove_driver+0x70/0xf4
driver_unregister+0x30/0x60
platform_driver_unregister+0x14/0x20
tidss_platform_driver_exit+0x18/0xb2c [tidss]
__arm64_sys_delete_module+0x1a0/0x2b4
invoke_syscall+0x48/0x110
el0_svc_common.constprop.0+0x60/0x10c
do_el0_svc_compat+0x1c/0x40
el0_svc_compat+0x40/0xac
el0t_32_sync_handler+0xb0/0x138
el0t_32_sync+0x194/0x198
Code: 9104a276 f2fbd5b7 aa0203e1 91008af8 (f85c0420)
Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
Signed-off-by: Tomi Valkeinen <[email protected]>
---
drivers/gpu/drm/bridge/lontium-lt8912b.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
index 0e581f6e3c88..2d752e083433 100644
--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
+++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
@@ -589,9 +589,6 @@ static void lt8912_bridge_detach(struct drm_bridge *bridge)
if (lt->hdmi_port->ops & DRM_BRIDGE_OP_HPD)
drm_bridge_hpd_disable(lt->hdmi_port);
-
- drm_connector_unregister(<->connector);
- drm_connector_cleanup(<->connector);
}
static enum drm_connector_status
--
2.34.1
On Fri, Aug 4, 2023 at 12:48 PM Tomi Valkeinen
<[email protected]> wrote:
>
> The lt8912b driver, in its bridge detach function, calls
> drm_connector_unregister() and drm_connector_cleanup().
>
> drm_connector_unregister() should be called only for connectors
> explicitly registered with drm_connector_register(), which is not the
> case in lt8912b.
>
> The driver's drm_connector_funcs.destroy hook is set to
> drm_connector_cleanup().
>
> Thus the driver should not call either drm_connector_unregister() nor
> drm_connector_cleanup() in its lt8912_bridge_detach(), as they cause a
> crash on bridge detach:
>
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
> Mem abort info:
> ESR = 0x0000000096000006
> EC = 0x25: DABT (current EL), IL = 32 bits
> SET = 0, FnV = 0
> EA = 0, S1PTW = 0
> FSC = 0x06: level 2 translation fault
> Data abort info:
> ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
> CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> user pgtable: 4k pages, 48-bit VAs, pgdp=00000000858f3000
> [0000000000000000] pgd=0800000085918003, p4d=0800000085918003, pud=0800000085431003, pmd=0000000000000000
> Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
> Modules linked in: tidss(-) display_connector lontium_lt8912b tc358768 panel_lvds panel_simple drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks
> CPU: 3 PID: 462 Comm: rmmod Tainted: G W 6.5.0-rc2+ #2
> Hardware name: Toradex Verdin AM62 on Verdin Development Board (DT)
> pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : drm_connector_cleanup+0x78/0x2d4 [drm]
> lr : lt8912_bridge_detach+0x54/0x6c [lontium_lt8912b]
> sp : ffff800082ed3a90
> x29: ffff800082ed3a90 x28: ffff0000040c1940 x27: 0000000000000000
> x26: 0000000000000000 x25: dead000000000122 x24: dead000000000122
> x23: dead000000000100 x22: ffff000003fb6388 x21: 0000000000000000
> x20: 0000000000000000 x19: ffff000003fb6260 x18: fffffffffffe56e8
> x17: 0000000000000000 x16: 0010000000000000 x15: 0000000000000038
> x14: 0000000000000000 x13: ffff800081914b48 x12: 000000000000040e
> x11: 000000000000015a x10: ffff80008196ebb8 x9 : ffff800081914b48
> x8 : 00000000ffffefff x7 : ffff0000040c1940 x6 : ffff80007aa649d0
> x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80008159e008
> x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
> Call trace:
> drm_connector_cleanup+0x78/0x2d4 [drm]
> lt8912_bridge_detach+0x54/0x6c [lontium_lt8912b]
> drm_bridge_detach+0x44/0x84 [drm]
> drm_encoder_cleanup+0x40/0xb8 [drm]
> drmm_encoder_alloc_release+0x1c/0x30 [drm]
> drm_managed_release+0xac/0x148 [drm]
> drm_dev_put.part.0+0x88/0xb8 [drm]
> devm_drm_dev_init_release+0x14/0x24 [drm]
> devm_action_release+0x14/0x20
> release_nodes+0x5c/0x90
> devres_release_all+0x8c/0xe0
> device_unbind_cleanup+0x18/0x68
> device_release_driver_internal+0x208/0x23c
> driver_detach+0x4c/0x94
> bus_remove_driver+0x70/0xf4
> driver_unregister+0x30/0x60
> platform_driver_unregister+0x14/0x20
> tidss_platform_driver_exit+0x18/0xb2c [tidss]
> __arm64_sys_delete_module+0x1a0/0x2b4
> invoke_syscall+0x48/0x110
> el0_svc_common.constprop.0+0x60/0x10c
> do_el0_svc_compat+0x1c/0x40
> el0_svc_compat+0x40/0xac
> el0t_32_sync_handler+0xb0/0x138
> el0t_32_sync+0x194/0x198
> Code: 9104a276 f2fbd5b7 aa0203e1 91008af8 (f85c0420)
>
> Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
> Signed-off-by: Tomi Valkeinen <[email protected]>
> ---
> drivers/gpu/drm/bridge/lontium-lt8912b.c | 3 ---
> 1 file changed, 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
> index 0e581f6e3c88..2d752e083433 100644
> --- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
> +++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
> @@ -589,9 +589,6 @@ static void lt8912_bridge_detach(struct drm_bridge *bridge)
>
> if (lt->hdmi_port->ops & DRM_BRIDGE_OP_HPD)
> drm_bridge_hpd_disable(lt->hdmi_port);
> -
> - drm_connector_unregister(<->connector);
> - drm_connector_cleanup(<->connector);
> }
>
> static enum drm_connector_status
>
> --
> 2.34.1
>
Reviewed-by: Robert Foss <[email protected]>