Linux Framebuffer Layer development
 help / color / mirror / Atom feed
From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, Daniel Thompson <danielt@kernel.org>,
	Jingoo Han <jingoohan1@gmail.com>, Helge Deller <deller@gmx.de>,
	Subbaraman Narayanamurthy <quic_subbaram@quicinc.com>,
	Kiran Gunda <quic_kgunda@quicinc.com>,
	linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org,
	linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org, David Heidelberg <david@ixit.cz>,
	Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Subject: [PATCH 5/6] backlight: qcom-wled: Check for auto-detection callback in wled_ovp_irq_handler()
Date: Wed,  4 Nov 2026 18:39:06 +0000	[thread overview]
Message-ID: <20261104183935.1214630-6-lee@kernel.org> (raw)
In-Reply-To: <20261104183935.1214630-1-lee@kernel.org>

The wled_auto_detection_required callback is only populated for WLED4
and WLED5 hardware, remaining NULL on WLED3 (where automatic string
detection is not supported).

However, wled_configure_ovp_irq() still registers wled_ovp_irq_handler()
on WLED3 when an "ovp" interrupt is present in the Device Tree.  If an
OVP fault interrupt fires on WLED3, wled_ovp_irq_handler()
unconditionally invokes wled->wled_auto_detection_required(), causing a
NULL pointer dereference.

Verify that wled->wled_auto_detection_required is non-NULL before
invoking it in wled_ovp_irq_handler().

Fixes: f16899a6a7d4 ("backlight: qcom-wled: Add callback functions")
Closes: https://sashiko.dev/#/bug/linux-d3eba287-2af9-43fb-851f-78ab3df0f35b
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
Cc: David Heidelberg <david@ixit.cz>
Cc: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

 drivers/video/backlight/qcom-wled.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
index 8d4d7fe5e84d..06300d403f8f 100644
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -917,7 +917,8 @@ static irqreturn_t wled_ovp_irq_handler(int irq, void *_wled)
 			int_sts, fault_sts);
 
 	if (fault_sts & WLED3_CTRL_REG_OVP_FAULT_BIT) {
-		if (wled->wled_auto_detection_required(wled)) {
+		if (wled->wled_auto_detection_required &&
+		    wled->wled_auto_detection_required(wled)) {
 			mutex_lock(&wled->lock);
 			wled_auto_string_detection(wled);
 			mutex_unlock(&wled->lock);
-- 
2.56.0.385.gac671c819a-goog


  parent reply	other threads:[~2026-11-04 18:40 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-04 18:39 [PATCH 0/6] backlight: Fix Critical and High issues reported by Sashiko Lee Jones
2026-11-04 18:39 ` [PATCH 1/6] backlight: lm3630a: Request PWM device before registering backlight Lee Jones
2026-11-04 18:39 ` [PATCH 2/6] backlight: aat2870: Initialise driver data " Lee Jones
2026-11-04 18:39 ` [PATCH 3/6] backlight: qcom-wled: Cancel delayed work on probe failure Lee Jones
2026-11-04 18:39 ` [PATCH 4/6] backlight: qcom-wled: Manage teardown via devres and remove wled_remove() Lee Jones
2026-11-04 18:39 ` Lee Jones [this message]
2026-11-04 18:39 ` [PATCH 6/6] backlight: qcom-wled: Avoid AB-BA deadlock in wled_module_enable() Lee Jones

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261104183935.1214630-6-lee@kernel.org \
    --to=lee@kernel.org \
    --cc=danielt@kernel.org \
    --cc=david@ixit.cz \
    --cc=deller@gmx.de \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=jingoohan1@gmail.com \
    --cc=konrad.dybcio@oss.qualcomm.com \
    --cc=linux-arm-msm@vger.kernel.org \
    --cc=linux-fbdev@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=quic_kgunda@quicinc.com \
    --cc=quic_subbaram@quicinc.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox