[REGRESSION] drm/panel/panel-simple v6.17 WARNING regression

[REGRESSION] drm/panel/panel-simple v6.17 WARNING regression

[Ernest Van Hoecke]

Hello everyone,

Commit 94d50c1a2ca3 ("drm/bridge: get/put the bridge reference in drm_bridge_attach/detach()")
introduced a regression with the below warning dure probe with panel
dpi described in the device tree.

[    9.160074] ------------[ cut here ]------------
[    9.160092] WARNING: CPU: 0 PID: 66 at /usr/src/kernel/lib/refcount.c:25 drm_bridge_attach+0x2c/0x1dc
[    9.160138] refcount_t: addition on 0; use-after-free.
[    9.160147] Modules linked in: coda_vpu(+) snd_soc_fsl_asrc snd_compress v4l2_jpeg pwm_imx27 imx_vdoa spi_imx imx6_media(C) imx_media_common(C) videobuf2_dma_contig etnaviv snd_soc_fsl_ssi v4l2_mem2mem imx_pcm_dma panel_simple gpio_keys gpu_sched pwm_bl loop fuse ipv6 autofs4
[    9.160423] CPU: 0 UID: 0 PID: 66 Comm: kworker/u10:2 Tainted: G         C          6.17.0-rc5-0.0.0-devel #1 PREEMPT 
[    9.160459] Tainted: [C]=CRAP
[    9.160476] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[    9.160497] Workqueue: events_unbound deferred_probe_work_func
[    9.160535] Call trace: 
[    9.160546]  unwind_backtrace from show_stack+0x10/0x14
[    9.160603]  show_stack from dump_stack_lvl+0x54/0x68
[    9.160637]  dump_stack_lvl from __warn+0x7c/0xd4
[    9.160672]  __warn from warn_slowpath_fmt+0x130/0x1c4
[    9.160726]  warn_slowpath_fmt from drm_bridge_attach+0x2c/0x1dc
[    9.160780]  drm_bridge_attach from imx_pd_bind+0x74/0xa0
[    9.160836]  imx_pd_bind from component_bind_all+0xfc/0x254
[    9.160881]  component_bind_all from imx_drm_bind+0xa8/0x154
[    9.160903]  imx_drm_bind from try_to_bring_up_aggregate_device+0x1f8/0x2b0
[    9.160959]  try_to_bring_up_aggregate_device from __component_add+0x9c/0x160
[    9.161003]  __component_add from imx_pd_probe+0xa8/0x160
[    9.161042]  imx_pd_probe from platform_probe+0x5c/0x90
[    9.161066]  platform_probe from really_probe+0xd0/0x3a4
[    9.161093]  really_probe from __driver_probe_device+0x8c/0x1d4
[    9.161144]  __driver_probe_device from driver_probe_device+0x34/0xd0
[    9.161195]  driver_probe_device from __device_attach_driver+0xa4/0x134
[    9.161248]  __device_attach_driver from bus_for_each_drv+0x90/0xe4
[    9.161299]  bus_for_each_drv from __device_attach+0xa4/0x1cc
[    9.161328]  __device_attach from bus_probe_device+0x84/0x88
[    9.161354]  bus_probe_device from deferred_probe_work_func+0x8c/0xcc
[    9.161395]  deferred_probe_work_func from process_one_work+0x158/0x2e0
[    9.161434]  process_one_work from worker_thread+0x254/0x3fc
[    9.161449]  worker_thread from kthread+0x128/0x24c
[    9.161473]  kthread from ret_from_fork+0x14/0x28
[    9.161494] Exception stack(0xe0aa1fb0 to 0xe0aa1ff8)
[    9.161505] 1fa0:                                     00000000 00000000 00000000 00000000
[    9.161517] 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    9.161529] 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[    9.161539] ---[ end trace 0000000000000000 ]---

Note that this commit was added to branch 'drm-next-2025-07-30',
which did not contain an already mainlined fix for another regression [1].
Without that fix [2], this new regression is masked.

Reverting 94d50c1a2ca3 on top of
commit 260f6f4fda93 ("Merge tag 'drm-next-2025-07-30' of https://gitlab.freedesktop.org/drm/kernel")
fixes the issue. At that point, [1] was fixed in mainline, and the new
regression reported here was merged in. v6.17-rc1 to v6.17-rc7 are in
this state.

However, later on, another regression seems to be introduced by
commit 8fa5909400f3 ("drm/bridge: get the bridge returned by drm_bridge_chain_get_first_bridge()")
so reverting 94d50c1a2ca3 on top of drm-misc-next does not solve
everything. This was tested by rebasing drm-misc-next onto (260f6f4fda93
plus the revert of 94d50c1a2ca3) and then bisecting.

So in v6.18-rc1, both regressions are present.

There, I get the following additional warnings:

[    9.732278] ------------[ cut here ]------------
[    9.732336] WARNING: CPU: 0 PID: 38 at lib/refcount.c:22 drm_bridge_get+0x10/0x18
[    9.744608] refcount_t: saturated; leaking memory.
[    9.749634] Modules linked in: nvmem_snvs_lpgpr phy_mxs_usb coda_vpu v4l2_jpeg spi_imx imx_vdoa imx6_media(C) pwm_imx27 snd_soc_fsl_asrc snd_soc_fsl_ssi snd_compress 4
[    9.776972] CPU: 0 UID: 0 PID: 38 Comm: kworker/u8:3 Tainted: G        WC          6.18.0-rc1-00214-g1226cd7c7686 #138 PREEMPT 
[    9.788476] Tainted: [W]=WARN, [C]=CRAP
[    9.792320] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[    9.798858] Workqueue: events_unbound deferred_probe_work_func
[    9.804729] Call trace: 
[    9.804744]  unwind_backtrace from show_stack+0x10/0x14
[    9.812532]  show_stack from dump_stack_lvl+0x68/0x74
[    9.817614]  dump_stack_lvl from __warn+0x7c/0xe0
[    9.822355]  __warn from warn_slowpath_fmt+0x130/0x1c0
[    9.827526]  warn_slowpath_fmt from drm_bridge_get+0x10/0x18
[    9.833218]  drm_bridge_get from drm_bridge_connector_init+0xc8/0x72c
[    9.839685]  drm_bridge_connector_init from imx_pd_bind+0x80/0xa0
[    9.845809]  imx_pd_bind from component_bind_all+0xf4/0x254
[    9.851422]  component_bind_all from imx_drm_bind+0x98/0x128
[    9.857109]  imx_drm_bind from try_to_bring_up_aggregate_device+0x1d0/0x29c
[    9.864097]  try_to_bring_up_aggregate_device from __component_add+0xa0/0x164
[    9.871263]  __component_add from imx_pd_probe+0xa8/0x164
[    9.876690]  imx_pd_probe from platform_probe+0x5c/0x90
[    9.881940]  platform_probe from really_probe+0xd0/0x3a4
[    9.887280]  really_probe from __driver_probe_device+0x8c/0x1d4
[    9.893227]  __driver_probe_device from driver_probe_device+0x30/0xc0
[    9.899694]  driver_probe_device from __device_attach_driver+0x98/0x10c
[    9.906337]  __device_attach_driver from bus_for_each_drv+0x90/0xe4
[    9.912634]  bus_for_each_drv from __device_attach+0xa8/0x1c8
[    9.918409]  __device_attach from bus_probe_device+0x88/0x8c
[    9.924097]  bus_probe_device from deferred_probe_work_func+0x8c/0xcc
[    9.930563]  deferred_probe_work_func from process_one_work+0x154/0x2dc
[    9.937205]  process_one_work from worker_thread+0x250/0x3f0
[    9.942883]  worker_thread from kthread+0x12c/0x24c
[    9.947787]  kthread from ret_from_fork+0x14/0x28
[    9.952513] Exception stack(0xe0961fb0 to 0xe0961ff8)
[    9.957575] 1fa0:                                     00000000 00000000 00000000 00000000
[    9.965762] 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    9.973948] 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[    9.981052] ---[ end trace 0000000000000000 ]---

[    9.985782] ------------[ cut here ]------------
[    9.985835] WARNING: CPU: 0 PID: 38 at lib/refcount.c:28 drm_bridge_connector_init+0x328/0x72c
[    9.999210] refcount_t: underflow; use-after-free.
[   10.004119] Modules linked in: mux_core error nvmem_snvs_lpgpr phy_mxs_usb coda_vpu v4l2_jpeg spi_imx imx_vdoa imx6_media(C) pwm_imx27 snd_soc_fsl_asrc snd_soc_fsl_ss4
[   10.032757] CPU: 0 UID: 0 PID: 38 Comm: kworker/u8:3 Tainted: G        WC          6.18.0-rc1-00214-g1226cd7c7686 #138 PREEMPT 
[   10.044260] Tainted: [W]=WARN, [C]=CRAP
[   10.048104] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[   10.054642] Workqueue: events_unbound deferred_probe_work_func
[   10.060511] Call trace: 
[   10.060523]  unwind_backtrace from show_stack+0x10/0x14
[   10.068309]  show_stack from dump_stack_lvl+0x68/0x74
[   10.073390]  dump_stack_lvl from __warn+0x7c/0xe0
[   10.078127]  __warn from warn_slowpath_fmt+0x130/0x1c0
[   10.083296]  warn_slowpath_fmt from drm_bridge_connector_init+0x328/0x72c
[   10.090115]  drm_bridge_connector_init from imx_pd_bind+0x80/0xa0
[   10.096238]  imx_pd_bind from component_bind_all+0xf4/0x254
[   10.101843]  component_bind_all from imx_drm_bind+0x98/0x128
[   10.107525]  imx_drm_bind from try_to_bring_up_aggregate_device+0x1d0/0x29c
[   10.114512]  try_to_bring_up_aggregate_device from __component_add+0xa0/0x164
[   10.121676]  __component_add from imx_pd_probe+0xa8/0x164
[   10.127101]  imx_pd_probe from platform_probe+0x5c/0x90
[   10.132348]  platform_probe from really_probe+0xd0/0x3a4
[   10.137683]  really_probe from __driver_probe_device+0x8c/0x1d4
[   10.143632]  __driver_probe_device from driver_probe_device+0x30/0xc0
[   10.150099]  driver_probe_device from __device_attach_driver+0x98/0x10c
[   10.156742]  __device_attach_driver from bus_for_each_drv+0x90/0xe4
[   10.163035]  bus_for_each_drv from __device_attach+0xa8/0x1c8
[   10.168804]  __device_attach from bus_probe_device+0x88/0x8c
[   10.174490]  bus_probe_device from deferred_probe_work_func+0x8c/0xcc
[   10.180955]  deferred_probe_work_func from process_one_work+0x154/0x2dc
[   10.187595]  process_one_work from worker_thread+0x250/0x3f0
[   10.193270]  worker_thread from kthread+0x12c/0x24c
[   10.198172]  kthread from ret_from_fork+0x14/0x28
[   10.202895] Exception stack(0xe0961fb0 to 0xe0961ff8)
[   10.207956] 1fa0:                                     00000000 00000000 00000000 00000000
[   10.216145] 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   10.224330] 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[   10.231448] ---[ end trace 0000000000000000 ]---


[1]: https://lore.kernel.org/all/20250612081834.GA248237@francesco-nb/
[2]: https://lore.kernel.org/all/20250626-drm-panel-simple-fixes-v2-0-5afcaa608bdc@kernel.org/

#regzbot ^introduced: 94d50c1a2ca31d80f12d9c2bdbc41437751e320c
#regzbot ^introduced: 8fa5909400f377351836419223c33f1131f0f7d3

Does this ring a bell for anyone?

Kind regards,
Ernest

Re: [REGRESSION] drm/panel/panel-simple v6.17 WARNING regression

[Luca Ceresoli]

Hello Ernest,

thanks for your detailed analysis and report!

On Tue Oct 14, 2025 at 10:13 AM CEST, Ernest Van Hoecke wrote:
> Hello everyone,
>
> Commit 94d50c1a2ca3 ("drm/bridge: get/put the bridge reference in drm_bridge_attach/detach()")
> introduced a regression with the below warning dure probe with panel
> dpi described in the device tree.
>
> [    9.160074] ------------[ cut here ]------------
> [    9.160092] WARNING: CPU: 0 PID: 66 at /usr/src/kernel/lib/refcount.c:25 drm_bridge_attach+0x2c/0x1dc
> [    9.160138] refcount_t: addition on 0; use-after-free.
> [    9.160147] Modules linked in: coda_vpu(+) snd_soc_fsl_asrc snd_compress v4l2_jpeg pwm_imx27 imx_vdoa spi_imx imx6_media(C) imx_media_common(C) videobuf2_dma_contig etnaviv snd_soc_fsl_ssi v4l2_mem2mem imx_pcm_dma panel_simple gpio_keys gpu_sched pwm_bl loop fuse ipv6 autofs4
> [    9.160423] CPU: 0 UID: 0 PID: 66 Comm: kworker/u10:2 Tainted: G         C          6.17.0-rc5-0.0.0-devel #1 PREEMPT
> [    9.160459] Tainted: [C]=CRAP
> [    9.160476] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
> [    9.160497] Workqueue: events_unbound deferred_probe_work_func
> [    9.160535] Call trace:
> [    9.160546]  unwind_backtrace from show_stack+0x10/0x14
> [    9.160603]  show_stack from dump_stack_lvl+0x54/0x68
> [    9.160637]  dump_stack_lvl from __warn+0x7c/0xd4
> [    9.160672]  __warn from warn_slowpath_fmt+0x130/0x1c4
> [    9.160726]  warn_slowpath_fmt from drm_bridge_attach+0x2c/0x1dc
> [    9.160780]  drm_bridge_attach from imx_pd_bind+0x74/0xa0
> [    9.160836]  imx_pd_bind from component_bind_all+0xfc/0x254
> [    9.160881]  component_bind_all from imx_drm_bind+0xa8/0x154
> [    9.160903]  imx_drm_bind from try_to_bring_up_aggregate_device+0x1f8/0x2b0
> [    9.160959]  try_to_bring_up_aggregate_device from __component_add+0x9c/0x160
> [    9.161003]  __component_add from imx_pd_probe+0xa8/0x160
> [    9.161042]  imx_pd_probe from platform_probe+0x5c/0x90
> [    9.161066]  platform_probe from really_probe+0xd0/0x3a4
> [    9.161093]  really_probe from __driver_probe_device+0x8c/0x1d4
> [    9.161144]  __driver_probe_device from driver_probe_device+0x34/0xd0
> [    9.161195]  driver_probe_device from __device_attach_driver+0xa4/0x134
> [    9.161248]  __device_attach_driver from bus_for_each_drv+0x90/0xe4
> [    9.161299]  bus_for_each_drv from __device_attach+0xa4/0x1cc
> [    9.161328]  __device_attach from bus_probe_device+0x84/0x88
> [    9.161354]  bus_probe_device from deferred_probe_work_func+0x8c/0xcc
> [    9.161395]  deferred_probe_work_func from process_one_work+0x158/0x2e0
> [    9.161434]  process_one_work from worker_thread+0x254/0x3fc
> [    9.161449]  worker_thread from kthread+0x128/0x24c
> [    9.161473]  kthread from ret_from_fork+0x14/0x28
> [    9.161494] Exception stack(0xe0aa1fb0 to 0xe0aa1ff8)
> [    9.161505] 1fa0:                                     00000000 00000000 00000000 00000000
> [    9.161517] 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> [    9.161529] 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000
> [    9.161539] ---[ end trace 0000000000000000 ]---
>
> Note that this commit was added to branch 'drm-next-2025-07-30',
> which did not contain an already mainlined fix for another regression [1].
> Without that fix [2], this new regression is masked.
>
> Reverting 94d50c1a2ca3 on top of
> commit 260f6f4fda93 ("Merge tag 'drm-next-2025-07-30' of https://gitlab.freedesktop.org/drm/kernel")
> fixes the issue. At that point, [1] was fixed in mainline, and the new
> regression reported here was merged in. v6.17-rc1 to v6.17-rc7 are in
> this state.

This is because the DRM_IMX has not been converted to the new
devm_drm_bridge_alloc() [0] DRM bridge allocation API, which is now
mandatory.

I converted all the bridges, except for a few which I missed because my
search was based on looking for drm_bridge_add() calls, and this driver
does not call it.

I recently sent a series proposing to make drm_bridge_add() mandatory
before drm_bridge_attach() in the docs and warn if that is violated [1]. If
you apply patch 4 of that series you should see the warning.

Let me have a look at the DRM_IMX driver, I'll try to send a series
converting it to the new API within today.

[0] https://elixir.bootlin.com/linux/v6.17.1/source/include/drm/drm_bridge.h#L1282
[1] https://lore.kernel.org/lkml/20251003-b4-drm-bridge-alloc-add-before-attach-v1-0-92fb40d27704@bootlin.com/#t

> However, later on, another regression seems to be introduced by
> commit 8fa5909400f3 ("drm/bridge: get the bridge returned by drm_bridge_chain_get_first_bridge()")
> so reverting 94d50c1a2ca3 on top of drm-misc-next does not solve
> everything. This was tested by rebasing drm-misc-next onto (260f6f4fda93
> plus the revert of 94d50c1a2ca3) and then bisecting.
>
> So in v6.18-rc1, both regressions are present.
>
> There, I get the following additional warnings:
>
> [    9.732278] ------------[ cut here ]------------
> [    9.732336] WARNING: CPU: 0 PID: 38 at lib/refcount.c:22 drm_bridge_get+0x10/0x18
> [    9.744608] refcount_t: saturated; leaking memory.

Not sure here, but it may well be another symptom of the same bug: the
refcount was not initialized correctly, so it is found inconsistent later
when trying to increase it. Let's fix the known issue and then we'll see.

Best regards,
Luca

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [REGRESSION] drm/panel/panel-simple v6.17 WARNING regression

[Ernest Van Hoecke]

Hi Luca,

Thanks for your fast reply and all your work here.

On Tue, Oct 14, 2025 at 12:31:35PM +0200, Luca Ceresoli wrote:
> Let me have a look at the DRM_IMX driver, I'll try to send a series
> converting it to the new API within today.

I will gladly test, thanks!

> I recently sent a series proposing to make drm_bridge_add() mandatory
> before drm_bridge_attach() in the docs and warn if that is violated [1]. If
> you apply patch 4 of that series you should see the warning.

I gave it a quick try and did not see the warning. Some printk debugging
told me that `list_empty(&bridge->list)`, inside drm_bridge_attach, is
returning 0. 

> > However, later on, another regression seems to be introduced by
> > commit 8fa5909400f3 ("drm/bridge: get the bridge returned by drm_bridge_chain_get_first_bridge()")
> > so reverting 94d50c1a2ca3 on top of drm-misc-next does not solve
> > everything. This was tested by rebasing drm-misc-next onto (260f6f4fda93
> > plus the revert of 94d50c1a2ca3) and then bisecting.
> >
> > So in v6.18-rc1, both regressions are present.
> >
> > There, I get the following additional warnings:
> >
> > [    9.732278] ------------[ cut here ]------------
> > [    9.732336] WARNING: CPU: 0 PID: 38 at lib/refcount.c:22 drm_bridge_get+0x10/0x18
> > [    9.744608] refcount_t: saturated; leaking memory.
> 
> Not sure here, but it may well be another symptom of the same bug: the
> refcount was not initialized correctly, so it is found inconsistent later
> when trying to increase it. Let's fix the known issue and then we'll see.

Makes sense to me.

Kind regards,
Ernest

Re: [REGRESSION] drm/panel/panel-simple v6.17 WARNING regression

[Luca Ceresoli]

Hello Ernest,

On Tue Oct 14, 2025 at 1:25 PM CEST, Ernest Van Hoecke wrote:
> Hi Luca,
>
> Thanks for your fast reply and all your work here.
>
> On Tue, Oct 14, 2025 at 12:31:35PM +0200, Luca Ceresoli wrote:
>> Let me have a look at the DRM_IMX driver, I'll try to send a series
>> converting it to the new API within today.
>
> I will gladly test, thanks!

Just sent:
https://lore.kernel.org/all/20251014-drm-bridge-alloc-imx-ipuv3-v1-0-a1bb1dcbff50@bootlin.com/

>> I recently sent a series proposing to make drm_bridge_add() mandatory
>> before drm_bridge_attach() in the docs and warn if that is violated [1]. If
>> you apply patch 4 of that series you should see the warning.
>
> I gave it a quick try and did not see the warning. Some printk debugging
> told me that `list_empty(&bridge->list)`, inside drm_bridge_attach, is
> returning 0.

Ouch, I think this is because without using devm_drm_bridge_alloc() even
the list is uninitialized, and so list_empty will do:

static inline int list_empty(const struct list_head *head)
{
	return READ_ONCE(head->next) == head;
	                        ^         ^
                NULL (bridge->list      valid pointer
                zeroed by kzalloc)      to bridge->list
}

So it returns false. I guess that means the series to make drm_bridge_add()
mandatory before drm_bridge_attach() [0] will need a better check to
trigger the warning.

[0] https://lore.kernel.org/lkml/20251003-b4-drm-bridge-alloc-add-before-attach-v1-0-92fb40d27704@bootlin.com/

>> > However, later on, another regression seems to be introduced by
>> > commit 8fa5909400f3 ("drm/bridge: get the bridge returned by drm_bridge_chain_get_first_bridge()")
>> > so reverting 94d50c1a2ca3 on top of drm-misc-next does not solve
>> > everything. This was tested by rebasing drm-misc-next onto (260f6f4fda93
>> > plus the revert of 94d50c1a2ca3) and then bisecting.
>> >
>> > So in v6.18-rc1, both regressions are present.
>> >
>> > There, I get the following additional warnings:
>> >
>> > [    9.732278] ------------[ cut here ]------------
>> > [    9.732336] WARNING: CPU: 0 PID: 38 at lib/refcount.c:22 drm_bridge_get+0x10/0x18
>> > [    9.744608] refcount_t: saturated; leaking memory.
>>
>> Not sure here, but it may well be another symptom of the same bug: the
>> refcount was not initialized correctly, so it is found inconsistent later
>> when trying to increase it. Let's fix the known issue and then we'll see.
>
> Makes sense to me.

Alright. Let me know whether the series I've sent fixes 0, 1 or both
warnings.

Best regards,
Luca

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [REGRESSION] drm/panel/panel-simple v6.17 WARNING regression

[Ernest Van Hoecke]

On Tue, Oct 14, 2025 at 01:43:21PM +0200, Luca Ceresoli wrote:
> Alright. Let me know whether the series I've sent fixes 0, 1 or both
> warnings.

Hi Luca,

Just replying to have the info in this thread as well, the series fixed
all warnings I saw, thanks!

Kind regards,
Ernest