[PATCH v3] drm/ingenic: fix bridge allocation

[PATCH v3] drm/ingenic: fix bridge allocation

[H. Nikolaus Schaller]

Bridge allocation API has changed and ingenic/drm was broken
leading to

[   54.997593] dw-hdmi-ingenic 10180000.hdmi: Detected HDMI \X controller v1.31a with HDCP (DWC HDMI 3D TX PHY)
[   55.491338] dw-hdmi-ingenic 10180000.hdmi: registered DesignWare HDMI I2C bus driver
[   55.899132] [drm] DRM bridge corrupted or not allocated by devm_drm_bridge_alloc()
[   55.904136] ------------[ cut here ]------------
[   55.908753] WARNING: lib/refcount.c:25 at drm_bridge_get+0x58/0x6c [drm], CPU#0: kworker/u4:2/36
[   55.917538] refcount_t: addition on 0; use-after-free.
...
[   56.354928] [<c04898b8>] drm_bridge_attach+0x80/0x208 [drm]
...

Fixes: 9347f2fbb0183b0 ("drm/bridge: add warning for bridges using neither devm_drm_bridge_alloc() nor drm_bridge_add()")
Tested-by: Waldemar Brodkorb <wbx@openadk.org> (on CI20 with HDMI)
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Cc: Waldemar Brodkorb <wbx@openadk.org>
Cc: stable@vger.kernel.org
---

Notes:
    v3: fixed a malformed diff
    
    v2: removed ib->bridge->ops = DRM_BRIDGE_OP_EDID | DRM_BRIDGE_OP_DETECT as suggested by Sashiko-reviews
        https://sashiko.dev/#/patchset/400ba2fe0d4f76484e929d2efaa32f67a940163a.1787477392.git.hns@goldelico.com?part=1

 drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
index 42c86f195c66b3..8d7979a7859332 100644
--- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
+++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
@@ -122,7 +122,7 @@ struct ingenic_drm {
 
 struct ingenic_drm_bridge {
 	struct drm_encoder encoder;
-	struct drm_bridge bridge, *next_bridge;
+	struct drm_bridge *bridge, *next_bridge;
 
 	struct drm_bus_cfg bus_cfg;
 };
@@ -802,7 +802,7 @@ static int ingenic_drm_bridge_attach(struct drm_bridge *bridge,
 	struct ingenic_drm_bridge *ib = to_ingenic_drm_bridge(encoder);
 
 	return drm_bridge_attach(encoder, ib->next_bridge,
-				 &ib->bridge, flags);
+				 bridge, flags);
 }
 
 static int ingenic_drm_bridge_atomic_check(struct drm_bridge *bridge,
@@ -1314,10 +1314,25 @@ static int ingenic_drm_bind(struct device *dev, bool has_components)
 
 		drm_encoder_helper_add(encoder, &ingenic_drm_encoder_helper_funcs);
 
-		ib->bridge.funcs = &ingenic_drm_bridge_funcs;
+		ib->bridge = devm_drm_bridge_alloc(priv->dev, struct drm_bridge,
+						   base, &ingenic_drm_bridge_funcs);
+		if (IS_ERR(ib->bridge)) {
+			ret = PTR_ERR(ib->bridge);
+			goto err_drvdata;
+		}
+
+		ib->bridge->of_node = priv->dev->of_node;
 		ib->next_bridge = bridge;
 
-		ret = drm_bridge_attach(encoder, &ib->bridge, NULL,
+		ib->bridge->interlace_allowed = true;
+
+		ret = devm_drm_bridge_add(priv->dev, ib->bridge);
+		if (ret) {
+			dev_err(dev, "Failed to register DRM bridge: %d\n", ret);
+			goto err_drvdata;
+		}
+
+		ret = drm_bridge_attach(encoder, ib->bridge, NULL,
 					DRM_BRIDGE_ATTACH_NO_CONNECTOR);
 		if (ret) {
 			dev_err(dev, "Unable to attach bridge\n");
-- 
2.55.0

Re: [PATCH v3] drm/ingenic: fix bridge allocation

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but there is a missing IS_ERR() check on the return value of devm_drm_panel_bridge_add_typed() which leads to an error pointer dereference.
--

--- Patch [1]: [PATCH v3] drm/ingenic: fix bridge allocation ---
commit 4187db84355de6d4a1d09fa81233bcc5ab620c4b
Author: H. Nikolaus Schaller <hns@goldelico.com>
Subject: drm/ingenic: fix bridge allocation

This patch updates the ingenic/drm driver to use the new
devm_drm_bridge_alloc() API for bridge allocation. It fixes an issue where
the bridge was corrupted or not allocated properly under the new API,
causing use-after-free warnings.

> diff --git a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
> index 738a80b2550ff..d1321a9c0f0b0 100644
> --- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
> +++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
[ ... ]
> @@ -1316,10 +1316,25 @@ static int ingenic_drm_bind(struct device *dev, bool has_components)
>  
>  		drm_encoder_helper_add(encoder, &ingenic_drm_encoder_helper_funcs);
>  
> -		ib->bridge.funcs = &ingenic_drm_bridge_funcs;
> +		ib->bridge = devm_drm_bridge_alloc(priv->dev, struct drm_bridge,
> +						   base, &ingenic_drm_bridge_funcs);
> +		if (IS_ERR(ib->bridge)) {
> +			ret = PTR_ERR(ib->bridge);
> +			goto err_drvdata;
> +		}
> +
> +		ib->bridge->of_node = priv->dev->of_node;
>  		ib->next_bridge = bridge;

[Severity: High]
This isn't a bug introduced by this patch, but if
devm_drm_panel_bridge_add_typed() fails earlier in ingenic_drm_bind(), it
returns an ERR_PTR.

Does this assignment store that unvalidated error pointer into
ib->next_bridge without an IS_ERR() check?

When the bridge attach callback executes:

static int ingenic_drm_bridge_attach(...)
{
    ...
    return drm_bridge_attach(encoder, ib->next_bridge,
                             bridge, flags);
}

Would this pass the ERR_PTR as the bridge argument to drm_bridge_attach(),
which bypasses the NULL check and dereferences it?

int drm_bridge_attach(..., struct drm_bridge *bridge, ...)
{
    if (!encoder || !bridge)
        return -EINVAL;

    if (!bridge->container)
        ...
}

Could this lead to a kernel panic from an invalid memory access?

> -		ret = drm_bridge_attach(encoder, &ib->bridge, NULL,
> +		ib->bridge->interlace_allowed = true;
> +
> +		ret = devm_drm_bridge_add(priv->dev, ib->bridge);
> +		if (ret) {
> +			dev_err(dev, "Failed to register DRM bridge: %d\n", ret);
> +			goto err_drvdata;
> +		}
> +
> +		ret = drm_bridge_attach(encoder, ib->bridge, NULL,
>  					DRM_BRIDGE_ATTACH_NO_CONNECTOR);
>  		if (ret) {
>  			dev_err(dev, "Unable to attach bridge\n");

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/a3b64245250cd092776cf23cddffe18318b48995.1787494377.git.hns@goldelico.com?part=1

Re: [PATCH v3] drm/ingenic: fix bridge allocation

[Paul Cercueil]

Hi Nikolaus,

Le dimanche 23 août 2026 à 16:12 +0200, H. Nikolaus Schaller a écrit :
> Bridge allocation API has changed and ingenic/drm was broken
> leading to
> 
> [   54.997593] dw-hdmi-ingenic 10180000.hdmi: Detected HDMI \X
> controller v1.31a with HDCP (DWC HDMI 3D TX PHY)
> [   55.491338] dw-hdmi-ingenic 10180000.hdmi: registered DesignWare
> HDMI I2C bus driver
> [   55.899132] [drm] DRM bridge corrupted or not allocated by
> devm_drm_bridge_alloc()
> [   55.904136] ------------[ cut here ]------------
> [   55.908753] WARNING: lib/refcount.c:25 at drm_bridge_get+0x58/0x6c
> [drm], CPU#0: kworker/u4:2/36
> [   55.917538] refcount_t: addition on 0; use-after-free.
> ...
> [   56.354928] [<c04898b8>] drm_bridge_attach+0x80/0x208 [drm]
> ...
> 
> Fixes: 9347f2fbb0183b0 ("drm/bridge: add warning for bridges using
> neither devm_drm_bridge_alloc() nor drm_bridge_add()")
> Tested-by: Waldemar Brodkorb <wbx@openadk.org> (on CI20 with HDMI)
> Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
> Cc: Waldemar Brodkorb <wbx@openadk.org>
> Cc: stable@vger.kernel.org
> ---
> 
> Notes:
>     v3: fixed a malformed diff
>     
>     v2: removed ib->bridge->ops = DRM_BRIDGE_OP_EDID |
> DRM_BRIDGE_OP_DETECT as suggested by Sashiko-reviews
>        
> https://sashiko.dev/#/patchset/400ba2fe0d4f76484e929d2efaa32f67a940163a.1787477392.git.hns@goldelico.com?part=1
> 
>  drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 23 +++++++++++++++++++--
> --
>  1 file changed, 19 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
> b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
> index 42c86f195c66b3..8d7979a7859332 100644
> --- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
> +++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
> @@ -122,7 +122,7 @@ struct ingenic_drm {
>  
>  struct ingenic_drm_bridge {
>  	struct drm_encoder encoder;
> -	struct drm_bridge bridge, *next_bridge;
> +	struct drm_bridge *bridge, *next_bridge;
>  
>  	struct drm_bus_cfg bus_cfg;
>  };
> @@ -802,7 +802,7 @@ static int ingenic_drm_bridge_attach(struct
> drm_bridge *bridge,
>  	struct ingenic_drm_bridge *ib =
> to_ingenic_drm_bridge(encoder);
>  
>  	return drm_bridge_attach(encoder, ib->next_bridge,
> -				 &ib->bridge, flags);
> +				 bridge, flags);
>  }
>  
>  static int ingenic_drm_bridge_atomic_check(struct drm_bridge
> *bridge,
> @@ -1314,10 +1314,25 @@ static int ingenic_drm_bind(struct device
> *dev, bool has_components)
>  
>  		drm_encoder_helper_add(encoder,
> &ingenic_drm_encoder_helper_funcs);
>  
> -		ib->bridge.funcs = &ingenic_drm_bridge_funcs;
> +		ib->bridge = devm_drm_bridge_alloc(priv->dev, struct
> drm_bridge,
> +						   base,
> &ingenic_drm_bridge_funcs);
> +		if (IS_ERR(ib->bridge)) {
> +			ret = PTR_ERR(ib->bridge);
> +			goto err_drvdata;
> +		}
> +
> +		ib->bridge->of_node = priv->dev->of_node;
>  		ib->next_bridge = bridge;
>  
> -		ret = drm_bridge_attach(encoder, &ib->bridge, NULL,
> +		ib->bridge->interlace_allowed = true;

That one line feels like it doesn't belong here, but in its own patch.

Cheers,
-Paul

> +
> +		ret = devm_drm_bridge_add(priv->dev, ib->bridge);
> +		if (ret) {
> +			dev_err(dev, "Failed to register DRM bridge:
> %d\n", ret);
> +			goto err_drvdata;
> +		}
> +
> +		ret = drm_bridge_attach(encoder, ib->bridge, NULL,
>  					DRM_BRIDGE_ATTACH_NO_CONNECT
> OR);
>  		if (ret) {
>  			dev_err(dev, "Unable to attach bridge\n");

Re: [PATCH v3] drm/ingenic: fix bridge allocation

[H. Nikolaus Schaller]

Hi Paul,

> Am 24.08.2026 um 11:56 schrieb Paul Cercueil <paul@crapouillou.net>:
> 
> Hi Nikolaus,
> 
> Le dimanche 23 août 2026 à 16:12 +0200, H. Nikolaus Schaller a écrit :
>> Bridge allocation API has changed and ingenic/drm was broken
>> leading to
>> 
>> [   54.997593] dw-hdmi-ingenic 10180000.hdmi: Detected HDMI \X
>> controller v1.31a with HDCP (DWC HDMI 3D TX PHY)
>> [   55.491338] dw-hdmi-ingenic 10180000.hdmi: registered DesignWare
>> HDMI I2C bus driver
>> [   55.899132] [drm] DRM bridge corrupted or not allocated by
>> devm_drm_bridge_alloc()
>> [   55.904136] ------------[ cut here ]------------
>> [   55.908753] WARNING: lib/refcount.c:25 at drm_bridge_get+0x58/0x6c
>> [drm], CPU#0: kworker/u4:2/36
>> [   55.917538] refcount_t: addition on 0; use-after-free.
>> ...
>> [   56.354928] [<c04898b8>] drm_bridge_attach+0x80/0x208 [drm]
>> ...
>> 
>> Fixes: 9347f2fbb0183b0 ("drm/bridge: add warning for bridges using
>> neither devm_drm_bridge_alloc() nor drm_bridge_add()")
>> Tested-by: Waldemar Brodkorb <wbx@openadk.org> (on CI20 with HDMI)
>> Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
>> Cc: Waldemar Brodkorb <wbx@openadk.org>
>> Cc: stable@vger.kernel.org
>> ---
>> 
>> Notes:
>>     v3: fixed a malformed diff
>>     
>>     v2: removed ib->bridge->ops = DRM_BRIDGE_OP_EDID |
>> DRM_BRIDGE_OP_DETECT as suggested by Sashiko-reviews
>>        
>> https://sashiko.dev/#/patchset/400ba2fe0d4f76484e929d2efaa32f67a940163a.1787477392.git.hns@goldelico.com?part=1
>> 
>>  drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 23 +++++++++++++++++++--
>> --
>>  1 file changed, 19 insertions(+), 4 deletions(-)
>> 
>> diff --git a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
>> b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
>> index 42c86f195c66b3..8d7979a7859332 100644
>> --- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
>> +++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
>> @@ -122,7 +122,7 @@ struct ingenic_drm {
>>  
>>  
>> - ret = drm_bridge_attach(encoder, &ib->bridge, NULL,
>> + ib->bridge->interlace_allowed = true;
> 
> That one line feels like it doesn't belong here, but in its own patch.

You are right, it is not a fix but adds a feature.

I'll send a v4 asap.

> 
> Cheers,
> -Paul

BR,
Nikolaus