[PATCH] drm/bridge: dw-hdmi-qp: Guard clear_audio_infoframe when PHY is down

[PATCH] drm/bridge: dw-hdmi-qp: Guard clear_audio_infoframe when PHY is down

[Frank Zhang]

The following panic was observed during system reboot:

Kernel panic - not syncing: Asynchronous SError Interrupt
CPU: 6 UID: 1000 PID: 2348 Comm: pipewire ... 7.0.5+ #4 PREEMPT(full)
Call trace:
 ...
 regmap_update_bits_base+0x70/0xa8
 dw_hdmi_qp_bridge_clear_audio_infoframe+0x3c/0x58 [dw_hdmi_qp]
 drm_bridge_connector_clear_audio_infoframe+0x2c/0x48 [drm_display_helper]
 ...
 dw_hdmi_qp_audio_disable+0x28/0xa8 [dw_hdmi_qp]
 drm_bridge_connector_audio_shutdown+0x38/0x68 [drm_display_helper]
 drm_connector_hdmi_audio_shutdown+0x28/0x40 [drm_display_helper]
 hdmi_codec_shutdown+0x60/0x90 [snd_soc_hdmi_codec]
 ...
 snd_pcm_release_substream+0xcc/0x120 [snd_pcm]
 snd_pcm_release+0x4c/0xc0 [snd_pcm]
 ...

The root cause is pipewire tries to close the HDMI audio device after
atomic_disable(), which sets tmds_char_rate to 0 and disables the PHY.

In this case, dw_hdmi_qp_audio_disable() will call
dw_hdmi_qp_bridge_clear_audio_infoframe(), accessing register without
checking tmds_char_rate.

Guard the register access in drm_display_helper callback function with
tmds_char_rate check.

Fixes: fd0141d1a8a2 ("drm/bridge: synopsys: Add audio support for dw-hdmi-qp")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Zhang <rmxpzlb@gmail.com>

---
Changes in v2:
- Move drm_atomic_helper_connector_hdmi_clear_audio_infoframe() inside
  the if (hdmi->tmds_char_rate) of dw_hdmi_qp_audio_disable().
- Link to v1: https://lore.kernel.org/all/20260416093150.13853-1-rmxpzlb@gmail.com/

Changes in v3:
- Add a tmds_char_rate guard in clear_audio_infoframe path.
- Decouple write_audio_infoframe from clear_audio_infoframe.
- Balance the PKTSCHED_AMD_TX_EN bit enable/disable.
- Link to v2: https://lore.kernel.org/all/20260418101936.7731-1-rmxpzlb@gmail.com/

Changes in v4:
- Update panic stack on 7.0.5
- Link to v3: https://lore.kernel.org/all/20260423081514.15444-1-rmxpzlb@gmail.com/

Changes in v5:
- Reuse the origin dw_hdmi_qp_bridge_clear_audio_infoframe and add
  tmds_char_rate guard in new callback function.
- Link to v4: https://lore.kernel.org/all/20260512103153.8861-1-rmxpzlb@gmail.com/

diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c
index 1c214a8e6dc2..8729783d4eb6 100644
--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c
@@ -880,7 +880,7 @@ static int dw_hdmi_qp_bridge_clear_spd_infoframe(struct drm_bridge *bridge)
 	return 0;
 }
 
-static int dw_hdmi_qp_bridge_clear_audio_infoframe(struct drm_bridge *bridge)
+static int __dw_hdmi_qp_bridge_clear_audio_infoframe(struct drm_bridge *bridge)
 {
 	struct dw_hdmi_qp *hdmi = bridge->driver_private;
 
@@ -893,6 +893,16 @@ static int dw_hdmi_qp_bridge_clear_audio_infoframe(struct drm_bridge *bridge)
 	return 0;
 }
 
+static int dw_hdmi_qp_bridge_clear_audio_infoframe(struct drm_bridge *bridge)
+{
+	struct dw_hdmi_qp *hdmi = bridge->driver_private;
+
+	if (hdmi->tmds_char_rate > 0)
+		return __dw_hdmi_qp_bridge_clear_audio_infoframe(bridge);
+
+	return 0;
+}
+
 static void dw_hdmi_qp_write_pkt(struct dw_hdmi_qp *hdmi, const u8 *buffer,
 				 size_t start, size_t len, unsigned int reg)
 {
@@ -987,7 +997,7 @@ static int dw_hdmi_qp_bridge_write_audio_infoframe(struct drm_bridge *bridge,
 {
 	struct dw_hdmi_qp *hdmi = bridge->driver_private;
 
-	dw_hdmi_qp_bridge_clear_audio_infoframe(bridge);
+	__dw_hdmi_qp_bridge_clear_audio_infoframe(bridge);
 
 	/*
 	 * AUDI_CONTENTS0: { RSV, HB2, HB1, RSV }
-- 
2.55.0

Re: [PATCH] drm/bridge: dw-hdmi-qp: Guard clear_audio_infoframe when PHY is down

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing synchronization lock between DRM atomic disable and ALSA callbacks leaves a Time-Of-Check to Time-Of-Use (TOCTOU) race condition, failing to fix the kernel panic.
--

commit 41e47d6bcdba49646deba6ac74845c934529f2f4
Author: Frank Zhang <rmxpzlb@gmail.com>

drm/bridge: dw-hdmi-qp: Guard clear_audio_infoframe when PHY is down

This commit attempts to fix a kernel panic caused when an audio server
closes the HDMI audio device concurrently with an atomic_disable. It tries
to guard register accesses in the audio teardown path by checking the
tmds_char_rate state variable.

> diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c
> index cfd1b18c06e62..f0e9324249d66 100644
> --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c
> +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c
[ ... ]
> @@ -893,6 +893,16 @@ static int dw_hdmi_qp_bridge_clear_audio_infoframe(struct drm_bridge *bridge)
>  	return 0;
>  }
>  
> +static int dw_hdmi_qp_bridge_clear_audio_infoframe(struct drm_bridge *bridge)
> +{
> +	struct dw_hdmi_qp *hdmi = bridge->driver_private;
> +
> +	if (hdmi->tmds_char_rate > 0)
> +		return __dw_hdmi_qp_bridge_clear_audio_infoframe(bridge);
> +
> +	return 0;
> +}
> +

[Severity: High]
This isn't a bug introduced by this patch, but does this lockless check
leave an open Time-Of-Check to Time-Of-Use (TOCTOU) race condition?

If a userspace audio server (like pipewire) closes the HDMI audio device at
the same time as a DRM modeset disables the display, the ALSA teardown path
can execute dw_hdmi_qp_bridge_clear_audio_infoframe() and successfully
evaluate this unguarded check.

Concurrently, dw_hdmi_qp_bridge_atomic_disable() can execute:

    hdmi->tmds_char_rate = 0;
    hdmi->phy.ops->disable(hdmi, hdmi->phy.data);

This zeroes the state variable and powers off the PHY without
synchronization. The ALSA thread can then resume and invoke
__dw_hdmi_qp_bridge_clear_audio_infoframe(), writing to the now-disabled
PHY registers and triggering the Asynchronous SError Interrupt panic this
patch is trying to fix.

Additionally, could the same race exist in dw_hdmi_qp_audio_prepare()?

    if (!hdmi->tmds_char_rate)
        return -ENODEV;
    
    // ... further down ...
    dw_hdmi_qp_set_audio_interface(hdmi, fmt, hparms);

This path configures multiple registers after a lockless check, making the
entire preparation sequence vulnerable to the same race condition.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908062708.39437-1-rmxpzlb@gmail.com?part=1

[PATCH] drm/bridge: dw-hdmi-qp: Guard clear_audio_infoframe when PHY is down

[Frank Zhang]

The following panic was observed during system reboot:

Kernel panic - not syncing: Asynchronous SError Interrupt
CPU: 7 UID: 1000 PID: 2637 Comm: pipewire ... 6.19.10-300.fc44.aarch64
Call trace:
 ...
 regmap_update_bits_base+0x5c/0x90
 dw_hdmi_qp_bridge_clear_infoframe+0xb0/0x120 [dw_hdmi_qp]
 drm_bridge_connector_clear_infoframe+0x28/0x48 [drm_display_helper]
 ...
 dw_hdmi_qp_audio_disable+0x24/0xb8 [dw_hdmi_qp]
 drm_bridge_connector_audio_shutdown+0x30/0x60 [drm_display_helper]
 drm_connector_hdmi_audio_shutdown+0x24/0x38 [drm_display_helper]
 hdmi_codec_shutdown+0x60/0x90 [snd_soc_hdmi_codec]
 ...
 snd_pcm_release_substream.part.0+0x44/0xd8 [snd_pcm]
 snd_pcm_release+0x60/0xe8 [snd_pcm]
 ...

The root cause is pipewire tries to close the HDMI audio device after
atomic_disable(), which sets tmds_char_rate to 0 and disable the PHY.

In this case, dw_hdmi_qp_audio_disable() will call
clear_audio_infoframe(), accessing registers without checking
tmds_char_rate.

Add a tmds_char_rate check in dw_hdmi_qp_bridge_clear_audio_infoframe()
to skip the register write when the PHY is inactive.

Signed-off-by: Frank Zhang <rmxpzlb@gmail.com>

diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c
index d649a1cf07f5..f963dff81dc6 100644
--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c
@@ -886,11 +886,12 @@ static int dw_hdmi_qp_bridge_clear_audio_infoframe(struct drm_bridge *bridge)
 {
 	struct dw_hdmi_qp *hdmi = bridge->driver_private;
 
-	dw_hdmi_qp_mod(hdmi, 0,
-		       PKTSCHED_ACR_TX_EN |
-		       PKTSCHED_AUDS_TX_EN |
-		       PKTSCHED_AUDI_TX_EN,
-		       PKTSCHED_PKT_EN);
+	if (hdmi->tmds_char_rate)
+		dw_hdmi_qp_mod(hdmi, 0,
+			       PKTSCHED_ACR_TX_EN |
+			       PKTSCHED_AUDS_TX_EN |
+			       PKTSCHED_AUDI_TX_EN,
+			       PKTSCHED_PKT_EN);
 
 	return 0;
 }
-- 
2.53.0

Re: [PATCH] drm/bridge: dw-hdmi-qp: Guard clear_audio_infoframe when PHY is down

[Detlev Casanova]

Hi Frank,

Please add me to CC if you send a v2.

On 4/16/26 05:31, Frank Zhang wrote:
> The following panic was observed during system reboot:
>
> Kernel panic - not syncing: Asynchronous SError Interrupt
> CPU: 7 UID: 1000 PID: 2637 Comm: pipewire ... 6.19.10-300.fc44.aarch64
> Call trace:
>   ...
>   regmap_update_bits_base+0x5c/0x90
>   dw_hdmi_qp_bridge_clear_infoframe+0xb0/0x120 [dw_hdmi_qp]
>   drm_bridge_connector_clear_infoframe+0x28/0x48 [drm_display_helper]
>   ...
>   dw_hdmi_qp_audio_disable+0x24/0xb8 [dw_hdmi_qp]
>   drm_bridge_connector_audio_shutdown+0x30/0x60 [drm_display_helper]
>   drm_connector_hdmi_audio_shutdown+0x24/0x38 [drm_display_helper]
>   hdmi_codec_shutdown+0x60/0x90 [snd_soc_hdmi_codec]
>   ...
>   snd_pcm_release_substream.part.0+0x44/0xd8 [snd_pcm]
>   snd_pcm_release+0x60/0xe8 [snd_pcm]
>   ...
>
> The root cause is pipewire tries to close the HDMI audio device after
> atomic_disable(), which sets tmds_char_rate to 0 and disable the PHY.
>
> In this case, dw_hdmi_qp_audio_disable() will call
> clear_audio_infoframe(), accessing registers without checking
> tmds_char_rate.
>
> Add a tmds_char_rate check in dw_hdmi_qp_bridge_clear_audio_infoframe()
> to skip the register write when the PHY is inactive.
>
> Signed-off-by: Frank Zhang <rmxpzlb@gmail.com>
Add a "Fixes:" tag so this gets backported were needed.
> diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c
> index d649a1cf07f5..f963dff81dc6 100644
> --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c
> +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c
> @@ -886,11 +886,12 @@ static int dw_hdmi_qp_bridge_clear_audio_infoframe(struct drm_bridge *bridge)
>   {
>   	struct dw_hdmi_qp *hdmi = bridge->driver_private;
>   
> -	dw_hdmi_qp_mod(hdmi, 0,
> -		       PKTSCHED_ACR_TX_EN |
> -		       PKTSCHED_AUDS_TX_EN |
> -		       PKTSCHED_AUDI_TX_EN,
> -		       PKTSCHED_PKT_EN);
> +	if (hdmi->tmds_char_rate)
I'd rather move the call to 
drm_atomic_helper_connector_hdmi_clear_audio_infoframe() inside the if 
(hdmi->tmds_char_rate) of dw_hdmi_qp_audio_disable().
There is no need to check for tmds_char_rate in every 
dw_hdmi_qp_bridge_clear_audio_infoframe() call.
> +		dw_hdmi_qp_mod(hdmi, 0,
> +			       PKTSCHED_ACR_TX_EN |
> +			       PKTSCHED_AUDS_TX_EN |
> +			       PKTSCHED_AUDI_TX_EN,
> +			       PKTSCHED_PKT_EN);
>   
>   	return 0;
>   }

Regards,
Detlev.