On Tue, Sep 01, 2026 at 09:50:37PM +0300, Cristian Ciocaltea wrote: > Legacy bridge drivers that embed struct drm_bridge in a zero-initialized > allocation, rather than obtaining it from devm_drm_bridge_alloc(), never > run INIT_LIST_HEAD() on bridge->list, leaving next and prev NULL. > list_empty() compares next against &bridge->list, so it reports such a > list head as non-empty. list_del_init() therefore runs and dereferences > the NULL pointers, panicking the kernel during probe. Only builds with > CONFIG_DEBUG_LIST survive, with a list corruption report. > > This affects rk3066_hdmi and the i.MX8 LDB bridges, which still embed a > bridge in a devm_kzalloc()'d struct. > > Initialize the list head when it is found to be NULL, so that the bridge > ends up with a valid empty list head and list_del_init() is only reached > for bridges that can actually be linked. > > Fixes: 17805a15d175 ("drm/bridge: add list of removed refcounted bridges") > Reported-by: Sashiko > Closes: https://lore.kernel.org/all/20260731175016.C5D591F00AC4@smtp.kernel.org/ > Signed-off-by: Cristian Ciocaltea > --- > drivers/gpu/drm/drm_bridge.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c > index 2c457ad74f3b..a8b6df5c13ea 100644 > --- a/drivers/gpu/drm/drm_bridge.c > +++ b/drivers/gpu/drm/drm_bridge.c > @@ -453,9 +453,16 @@ void drm_bridge_add(struct drm_bridge *bridge) > * If the bridge was previously added and then removed, it is now > * in bridge_lingering_list. Remove it or bridge_lingering_list will be > * corrupted when adding this bridge to bridge_list below. > + * > + * Legacy drivers that allocate the bridge with kzalloc() rather than > + * devm_drm_bridge_alloc() leave list.next NULL. Such a bridge cannot > + * be on any list, and list_del_init() would dereference NULL, so > + * initialize the list head first. "legacy" bridges are ambigous and was also used for non-atomic bridges. That being said, it's now *required* that bridges use devm_drm_bridge_alloc() instead of kzalloc, and we warn in drm_bridge_add if it hasn't. So I don't think we should merge this patch. Maxime