When external bridges are attached with DRM_BRIDGE_ATTACH_NO_CONNECTOR,
the panel bridge may also get the same flag, but in the .attach()
callback for the panel bridge a device link is added only when this
flag is not present; To make things worse, the .detach() callback
tries to delete the device link unconditionally and without checking
if it was created in the first place, crashing the kernel with a NULL
pointer kernel panic upon calling panel_bridge_detach().
Fix that by moving the device_link_add() call before checking if the
DRM_BRIDGE_ATTACH_NO_CONNECTOR flag is present.
Fixes: 199cf07ebd2b ("drm/bridge: panel: Add a device link between drm device and panel device")
Signed-off-by: AngeloGioacchino Del Regno <[email protected]>
---
Changes in v2:
- Added device_link_del() for (!bridge->encoder) error condition
drivers/gpu/drm/bridge/panel.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c
index e00d2e94c751..e48823a4f1ed 100644
--- a/drivers/gpu/drm/bridge/panel.c
+++ b/drivers/gpu/drm/bridge/panel.c
@@ -67,14 +67,6 @@ static int panel_bridge_attach(struct drm_bridge *bridge,
struct drm_device *drm_dev = bridge->dev;
int ret;
- if (flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR)
- return 0;
-
- if (!bridge->encoder) {
- DRM_ERROR("Missing encoder\n");
- return -ENODEV;
- }
-
panel_bridge->link = device_link_add(drm_dev->dev, panel->dev,
DL_FLAG_STATELESS);
if (!panel_bridge->link) {
@@ -83,6 +75,15 @@ static int panel_bridge_attach(struct drm_bridge *bridge,
return -EINVAL;
}
+ if (flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR)
+ return 0;
+
+ if (!bridge->encoder) {
+ DRM_ERROR("Missing encoder\n");
+ device_link_del(panel_bridge->link);
+ return -ENODEV;
+ }
+
drm_connector_helper_add(connector,
&panel_bridge_connector_helper_funcs);
--
2.42.0
Hi,
On Wed, 20 Sep 2023 10:27:27 +0200, AngeloGioacchino Del Regno wrote:
> When external bridges are attached with DRM_BRIDGE_ATTACH_NO_CONNECTOR,
> the panel bridge may also get the same flag, but in the .attach()
> callback for the panel bridge a device link is added only when this
> flag is not present; To make things worse, the .detach() callback
> tries to delete the device link unconditionally and without checking
> if it was created in the first place, crashing the kernel with a NULL
> pointer kernel panic upon calling panel_bridge_detach().
>
> [...]
Thanks, Applied to https://anongit.freedesktop.org/git/drm/drm-misc.git (drm-misc-next)
[1/1] drm/bridge: panel: Fix device link for DRM_BRIDGE_ATTACH_NO_CONNECTOR
https://cgit.freedesktop.org/drm/drm-misc/commit/?id=887878014534186cc50dbd16a62e744ad217b4b1
--
Neil
On Wednesday, September 20, 2023 4:27 PM AngeloGioacchino Del Regno <[email protected]> wrote:
> When external bridges are attached with
> DRM_BRIDGE_ATTACH_NO_CONNECTOR,
> the panel bridge may also get the same flag, but in the .attach()
> callback for the panel bridge a device link is added only when this
> flag is not present; To make things worse, the .detach() callback
> tries to delete the device link unconditionally and without checking
> if it was created in the first place, crashing the kernel with a NULL
> pointer kernel panic upon calling panel_bridge_detach().
>
> Fix that by moving the device_link_add() call before checking if the
> DRM_BRIDGE_ATTACH_NO_CONNECTOR flag is present.
>
> Fixes: 199cf07ebd2b ("drm/bridge: panel: Add a device link between drm
> device and panel device")
> Signed-off-by: AngeloGioacchino Del Regno
> <[email protected]>
> ---
>
> Changes in v2:
> - Added device_link_del() for (!bridge->encoder) error condition
>
> drivers/gpu/drm/bridge/panel.c | 17 +++++++++--------
> 1 file changed, 9 insertions(+), 8 deletions(-)
Reviewed-by: Liu Ying <[email protected]>