From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, Daniel Thompson <danielt@kernel.org>,
Jingoo Han <jingoohan1@gmail.com>, Helge Deller <deller@gmx.de>,
Subbaraman Narayanamurthy <quic_subbaram@quicinc.com>,
Kiran Gunda <quic_kgunda@quicinc.com>,
linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org,
linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org, David Heidelberg <david@ixit.cz>,
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Subject: [PATCH 5/6] backlight: qcom-wled: Check for auto-detection callback in wled_ovp_irq_handler()
Date: Wed, 4 Nov 2026 18:39:06 +0000 [thread overview]
Message-ID: <20261104183935.1214630-6-lee@kernel.org> (raw)
In-Reply-To: <20261104183935.1214630-1-lee@kernel.org>
The wled_auto_detection_required callback is only populated for WLED4
and WLED5 hardware, remaining NULL on WLED3 (where automatic string
detection is not supported).
However, wled_configure_ovp_irq() still registers wled_ovp_irq_handler()
on WLED3 when an "ovp" interrupt is present in the Device Tree. If an
OVP fault interrupt fires on WLED3, wled_ovp_irq_handler()
unconditionally invokes wled->wled_auto_detection_required(), causing a
NULL pointer dereference.
Verify that wled->wled_auto_detection_required is non-NULL before
invoking it in wled_ovp_irq_handler().
Fixes: f16899a6a7d4 ("backlight: qcom-wled: Add callback functions")
Closes: https://sashiko.dev/#/bug/linux-d3eba287-2af9-43fb-851f-78ab3df0f35b
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
Cc: David Heidelberg <david@ixit.cz>
Cc: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
drivers/video/backlight/qcom-wled.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
index 8d4d7fe5e84d..06300d403f8f 100644
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -917,7 +917,8 @@ static irqreturn_t wled_ovp_irq_handler(int irq, void *_wled)
int_sts, fault_sts);
if (fault_sts & WLED3_CTRL_REG_OVP_FAULT_BIT) {
- if (wled->wled_auto_detection_required(wled)) {
+ if (wled->wled_auto_detection_required &&
+ wled->wled_auto_detection_required(wled)) {
mutex_lock(&wled->lock);
wled_auto_string_detection(wled);
mutex_unlock(&wled->lock);
--
2.56.0.385.gac671c819a-goog
next prev parent reply other threads:[~2026-11-04 18:40 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-04 18:39 [PATCH 0/6] backlight: Fix Critical and High issues reported by Sashiko Lee Jones
2026-11-04 18:39 ` [PATCH 1/6] backlight: lm3630a: Request PWM device before registering backlight Lee Jones
2026-11-04 18:39 ` [PATCH 2/6] backlight: aat2870: Initialise driver data " Lee Jones
2026-11-04 18:39 ` [PATCH 3/6] backlight: qcom-wled: Cancel delayed work on probe failure Lee Jones
2026-11-04 18:39 ` [PATCH 4/6] backlight: qcom-wled: Manage teardown via devres and remove wled_remove() Lee Jones
2026-11-04 18:39 ` Lee Jones [this message]
2026-11-04 18:39 ` [PATCH 6/6] backlight: qcom-wled: Avoid AB-BA deadlock in wled_module_enable() Lee Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261104183935.1214630-6-lee@kernel.org \
--to=lee@kernel.org \
--cc=danielt@kernel.org \
--cc=david@ixit.cz \
--cc=deller@gmx.de \
--cc=dri-devel@lists.freedesktop.org \
--cc=jingoohan1@gmail.com \
--cc=konrad.dybcio@oss.qualcomm.com \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-fbdev@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=quic_kgunda@quicinc.com \
--cc=quic_subbaram@quicinc.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox