[PATCH 0/3] drm/bridge: imx: A few fixes

[PATCH 0/3] drm/bridge: imx: A few fixes

[Liu Ying]

Hi,

This patch series contains 3 bug fixes for i.MX8QXP DRM bridges.
Each patch fixes a NULL pointer dereference issue and stands alone.

Signed-off-by: Liu Ying <victor.liu@nxp.com>
---
Liu Ying (3):
      drm/bridge: imx8qxp-ldb: Fix NULL pointer dereference in imx8qxp_ldb_bridge_destroy()
      drm/bridge: imx8qxp-pxl2dpi: Fix NULL pointer dereference in imx8qxp_pxl2dpi_bridge_destroy()
      drm/bridge: imx8qxp-pixel-combiner: Fix bailout for imx8qxp_pc_bridge_probe()

 drivers/gpu/drm/bridge/imx/imx8qxp-ldb.c            | 7 +++++--
 drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c | 2 +-
 drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c        | 3 +++
 3 files changed, 9 insertions(+), 3 deletions(-)
---
base-commit: e3b32dcb9f23e3c3927ef3eec6a5842a988fb574
change-id: 20260122-imx8qxp-drm-bridge-fixes-dc7cb2564506

Best regards,
-- 
Liu Ying <victor.liu@nxp.com>

[PATCH 1/3] drm/bridge: imx8qxp-ldb: Fix NULL pointer dereference in imx8qxp_ldb_bridge_destroy()

[Liu Ying]

Pointer bridge->driver_private in imx8qxp_ldb_bridge_destroy() is NULL
when a LDB channel is unavailable or imx8qxp_ldb_probe() returns error,
because ldb_add_bridge_helper() is the last function called from
imx8qxp_ldb_probe() and it doesn't initialize bridge->driver_private if
a LDB channel is unavailable.  The NULL pointer would be set to pointer
ldb_ch and then NULL pointer ldb_ch would be dereferenced.  Fix this
by returning early from imx8qxp_ldb_bridge_destroy() if !ldb_ch is true.

Fixes: 32529d384cea ("drm/bridge: imx8qxp-ldb: convert to of_drm_find_and_get_bridge()")
Signed-off-by: Liu Ying <victor.liu@nxp.com>
---
 drivers/gpu/drm/bridge/imx/imx8qxp-ldb.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/bridge/imx/imx8qxp-ldb.c b/drivers/gpu/drm/bridge/imx/imx8qxp-ldb.c
index 43b328cb5314..ada11eed13cf 100644
--- a/drivers/gpu/drm/bridge/imx/imx8qxp-ldb.c
+++ b/drivers/gpu/drm/bridge/imx/imx8qxp-ldb.c
@@ -65,9 +65,12 @@ static inline struct imx8qxp_ldb *base_to_imx8qxp_ldb(struct ldb *base)
 static void imx8qxp_ldb_bridge_destroy(struct drm_bridge *bridge)
 {
 	struct ldb_channel *ldb_ch = bridge->driver_private;
-	struct ldb *ldb = ldb_ch->ldb;
-	struct imx8qxp_ldb *imx8qxp_ldb = base_to_imx8qxp_ldb(ldb);
+	struct imx8qxp_ldb *imx8qxp_ldb;
+
+	if (!ldb_ch)
+		return;
 
+	imx8qxp_ldb = base_to_imx8qxp_ldb(ldb_ch->ldb);
 	drm_bridge_put(imx8qxp_ldb->companion);
 }
 

-- 
2.43.0

Re: [PATCH 1/3] drm/bridge: imx8qxp-ldb: Fix NULL pointer dereference in imx8qxp_ldb_bridge_destroy()

[Frank Li]

On Fri, Jan 23, 2026 at 05:22:15PM +0800, Liu Ying wrote:
> Pointer bridge->driver_private in imx8qxp_ldb_bridge_destroy() is NULL
> when a LDB channel is unavailable or imx8qxp_ldb_probe() returns error,
> because ldb_add_bridge_helper() is the last function called from
> imx8qxp_ldb_probe() and it doesn't initialize bridge->driver_private if
> a LDB channel is unavailable.  The NULL pointer would be set to pointer
> ldb_ch and then NULL pointer ldb_ch would be dereferenced.  Fix this
> by returning early from imx8qxp_ldb_bridge_destroy() if !ldb_ch is true.
>
> Fixes: 32529d384cea ("drm/bridge: imx8qxp-ldb: convert to of_drm_find_and_get_bridge()")
> Signed-off-by: Liu Ying <victor.liu@nxp.com>

Reviewed-by: Frank Li <Frank.Li@nxp.com>
> ---
>  drivers/gpu/drm/bridge/imx/imx8qxp-ldb.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/bridge/imx/imx8qxp-ldb.c b/drivers/gpu/drm/bridge/imx/imx8qxp-ldb.c
> index 43b328cb5314..ada11eed13cf 100644
> --- a/drivers/gpu/drm/bridge/imx/imx8qxp-ldb.c
> +++ b/drivers/gpu/drm/bridge/imx/imx8qxp-ldb.c
> @@ -65,9 +65,12 @@ static inline struct imx8qxp_ldb *base_to_imx8qxp_ldb(struct ldb *base)
>  static void imx8qxp_ldb_bridge_destroy(struct drm_bridge *bridge)
>  {
>  	struct ldb_channel *ldb_ch = bridge->driver_private;
> -	struct ldb *ldb = ldb_ch->ldb;
> -	struct imx8qxp_ldb *imx8qxp_ldb = base_to_imx8qxp_ldb(ldb);
> +	struct imx8qxp_ldb *imx8qxp_ldb;
> +
> +	if (!ldb_ch)
> +		return;
>
> +	imx8qxp_ldb = base_to_imx8qxp_ldb(ldb_ch->ldb);
>  	drm_bridge_put(imx8qxp_ldb->companion);
>  }
>
>
> --
> 2.43.0
>

Re: [PATCH 1/3] drm/bridge: imx8qxp-ldb: Fix NULL pointer dereference in imx8qxp_ldb_bridge_destroy()

[Luca Ceresoli]

On Fri Jan 23, 2026 at 10:22 AM CET, Liu Ying wrote:
> Pointer bridge->driver_private in imx8qxp_ldb_bridge_destroy() is NULL
> when a LDB channel is unavailable or imx8qxp_ldb_probe() returns error,
> because ldb_add_bridge_helper() is the last function called from
> imx8qxp_ldb_probe() and it doesn't initialize bridge->driver_private if
> a LDB channel is unavailable.  The NULL pointer would be set to pointer
> ldb_ch and then NULL pointer ldb_ch would be dereferenced.  Fix this
> by returning early from imx8qxp_ldb_bridge_destroy() if !ldb_ch is true.
>
> Fixes: 32529d384cea ("drm/bridge: imx8qxp-ldb: convert to of_drm_find_and_get_bridge()")
> Signed-off-by: Liu Ying <victor.liu@nxp.com>

Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

[PATCH 2/3] drm/bridge: imx8qxp-pxl2dpi: Fix NULL pointer dereference in imx8qxp_pxl2dpi_bridge_destroy()

[Liu Ying]

Pointer bridge->driver_private in imx8qxp_pxl2dpi_bridge_destroy()
is NULL when imx8qxp_pxl2dpi_bridge_probe() returns error, because
the pointer is initialized only when imx8qxp_pxl2dpi_bridge_probe()
returns 0.  The NULL pointer would be set to pointer p2d and then
NULL pointer p2d would be dereferenced.  Fix this by returning early
from imx8qxp_pxl2dpi_bridge_destroy() if !p2d is true.

Fixes: 900699ba830f ("drm/bridge: imx8qxp-pxl2dpi: get/put the companion bridge")
Signed-off-by: Liu Ying <victor.liu@nxp.com>
---
 drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c b/drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c
index f0814702b641..9dc2b3d2ecef 100644
--- a/drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c
+++ b/drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c
@@ -67,6 +67,9 @@ static void imx8qxp_pxl2dpi_bridge_destroy(struct drm_bridge *bridge)
 {
 	struct imx8qxp_pxl2dpi *p2d = bridge->driver_private;
 
+	if (!p2d)
+		return;
+
 	drm_bridge_put(p2d->companion);
 }
 

-- 
2.43.0

Re: [PATCH 2/3] drm/bridge: imx8qxp-pxl2dpi: Fix NULL pointer dereference in imx8qxp_pxl2dpi_bridge_destroy()

[Frank Li]

On Fri, Jan 23, 2026 at 05:22:16PM +0800, Liu Ying wrote:
> Pointer bridge->driver_private in imx8qxp_pxl2dpi_bridge_destroy()
> is NULL when imx8qxp_pxl2dpi_bridge_probe() returns error, because
> the pointer is initialized only when imx8qxp_pxl2dpi_bridge_probe()
> returns 0.  The NULL pointer would be set to pointer p2d and then
> NULL pointer p2d would be dereferenced.  Fix this by returning early
> from imx8qxp_pxl2dpi_bridge_destroy() if !p2d is true.
>
> Fixes: 900699ba830f ("drm/bridge: imx8qxp-pxl2dpi: get/put the companion bridge")
> Signed-off-by: Liu Ying <victor.liu@nxp.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c b/drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c
> index f0814702b641..9dc2b3d2ecef 100644
> --- a/drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c
> +++ b/drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c
> @@ -67,6 +67,9 @@ static void imx8qxp_pxl2dpi_bridge_destroy(struct drm_bridge *bridge)
>  {
>  	struct imx8qxp_pxl2dpi *p2d = bridge->driver_private;
>
> +	if (!p2d)
> +		return;
> +
>  	drm_bridge_put(p2d->companion);
>  }
>
>
> --
> 2.43.0
>

Re: [PATCH 2/3] drm/bridge: imx8qxp-pxl2dpi: Fix NULL pointer dereference in imx8qxp_pxl2dpi_bridge_destroy()

[Luca Ceresoli]

On Fri Jan 23, 2026 at 10:22 AM CET, Liu Ying wrote:
> Pointer bridge->driver_private in imx8qxp_pxl2dpi_bridge_destroy()
> is NULL when imx8qxp_pxl2dpi_bridge_probe() returns error, because
> the pointer is initialized only when imx8qxp_pxl2dpi_bridge_probe()
> returns 0.  The NULL pointer would be set to pointer p2d and then
> NULL pointer p2d would be dereferenced.  Fix this by returning early
> from imx8qxp_pxl2dpi_bridge_destroy() if !p2d is true.
>
> Fixes: 900699ba830f ("drm/bridge: imx8qxp-pxl2dpi: get/put the companion bridge")
> Signed-off-by: Liu Ying <victor.liu@nxp.com>

Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

[PATCH 3/3] drm/bridge: imx8qxp-pixel-combiner: Fix bailout for imx8qxp_pc_bridge_probe()

[Liu Ying]

In case the channel0 is unavailable and bailing out from free_child is
needed when we fail to add a DRM bridge for the available channel1,
pointer pc->ch[0] in the bailout path would be NULL and it would be
dereferenced as pc->ch[0]->bridge.next_bridge.  Fix this by checking
pc->ch[0] before dereferencing it.

Fixes: ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge")
Fixes: 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API")
Signed-off-by: Liu Ying <victor.liu@nxp.com>
---
 drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c b/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c
index 00dcd273d8ab..27ad66f240cf 100644
--- a/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c
+++ b/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c
@@ -345,7 +345,7 @@ static int imx8qxp_pc_bridge_probe(struct platform_device *pdev)
 free_child:
 	of_node_put(child);
 
-	if (i == 1 && pc->ch[0]->bridge.next_bridge)
+	if (i == 1 && pc->ch[0] && pc->ch[0]->bridge.next_bridge)
 		drm_bridge_remove(&pc->ch[0]->bridge);
 
 	pm_runtime_disable(dev);

-- 
2.43.0

Re: [PATCH 3/3] drm/bridge: imx8qxp-pixel-combiner: Fix bailout for imx8qxp_pc_bridge_probe()

[Frank Li]

On Fri, Jan 23, 2026 at 05:22:17PM +0800, Liu Ying wrote:
> In case the channel0 is unavailable and bailing out from free_child is
> needed when we fail to add a DRM bridge for the available channel1,
> pointer pc->ch[0] in the bailout path would be NULL and it would be
> dereferenced as pc->ch[0]->bridge.next_bridge.  Fix this by checking
> pc->ch[0] before dereferencing it.
>
> Fixes: ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge")
> Fixes: 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API")
> Signed-off-by: Liu Ying <victor.liu@nxp.com>

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> ---
>  drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c b/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c
> index 00dcd273d8ab..27ad66f240cf 100644
> --- a/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c
> +++ b/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c
> @@ -345,7 +345,7 @@ static int imx8qxp_pc_bridge_probe(struct platform_device *pdev)
>  free_child:
>  	of_node_put(child);
>
> -	if (i == 1 && pc->ch[0]->bridge.next_bridge)
> +	if (i == 1 && pc->ch[0] && pc->ch[0]->bridge.next_bridge)
>  		drm_bridge_remove(&pc->ch[0]->bridge);
>
>  	pm_runtime_disable(dev);
>
> --
> 2.43.0
>

Re: [PATCH 3/3] drm/bridge: imx8qxp-pixel-combiner: Fix bailout for imx8qxp_pc_bridge_probe()

[Luca Ceresoli]

On Fri Jan 23, 2026 at 10:22 AM CET, Liu Ying wrote:
> In case the channel0 is unavailable and bailing out from free_child is
> needed when we fail to add a DRM bridge for the available channel1,
> pointer pc->ch[0] in the bailout path would be NULL and it would be
> dereferenced as pc->ch[0]->bridge.next_bridge.  Fix this by checking
> pc->ch[0] before dereferencing it.

Thanks for checking this code and providing fixes! These drivers have a
complex code path so I had a hard time in following the logic without neing
able to test on hardware. Apologies for the issues emerged.

> Fixes: ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge")
> Fixes: 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API")

The bug was introduced by 99764593528f, while ae754f049ce1 is not changing
the bug, so for the sake of precision we can remove the first 'Fixes:'
line.

With that:
 Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [PATCH 3/3] drm/bridge: imx8qxp-pixel-combiner: Fix bailout for imx8qxp_pc_bridge_probe()

[Liu Ying]

On Mon, Jan 26, 2026 at 09:33:38AM +0100, Luca Ceresoli wrote:
> On Fri Jan 23, 2026 at 10:22 AM CET, Liu Ying wrote:
>> In case the channel0 is unavailable and bailing out from free_child is
>> needed when we fail to add a DRM bridge for the available channel1,
>> pointer pc->ch[0] in the bailout path would be NULL and it would be
>> dereferenced as pc->ch[0]->bridge.next_bridge.  Fix this by checking
>> pc->ch[0] before dereferencing it.
> 
> Thanks for checking this code and providing fixes! These drivers have a
> complex code path so I had a hard time in following the logic without neing
> able to test on hardware. Apologies for the issues emerged.

Thanks for your quick review and hard work!

> 
>> Fixes: ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge")
>> Fixes: 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API")
> 
> The bug was introduced by 99764593528f, while ae754f049ce1 is not changing
> the bug, so for the sake of precision we can remove the first 'Fixes:'
> line.

I added Fixes tag for ae754f049ce1 because it is the first commit which
this commit could be applied upon properly.  Maybe this helps some tools
apply this commit or maybe tools are smart enough to find ae754f049ce1
automatically?

> 
> With that:
>  Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>

I hope I can have this R-b.  Please let me know if I need to drop the
Fixes tag for ae754f049ce1.

> 
> --
> Luca Ceresoli, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com/

-- 
Regards,
Liu Ying

Re: [PATCH 3/3] drm/bridge: imx8qxp-pixel-combiner: Fix bailout for imx8qxp_pc_bridge_probe()

[Luca Ceresoli]

On Mon Jan 26, 2026 at 9:47 AM CET, Liu Ying wrote:
>
>
> On Mon, Jan 26, 2026 at 09:33:38AM +0100, Luca Ceresoli wrote:
>> On Fri Jan 23, 2026 at 10:22 AM CET, Liu Ying wrote:
>>> In case the channel0 is unavailable and bailing out from free_child is
>>> needed when we fail to add a DRM bridge for the available channel1,
>>> pointer pc->ch[0] in the bailout path would be NULL and it would be
>>> dereferenced as pc->ch[0]->bridge.next_bridge.  Fix this by checking
>>> pc->ch[0] before dereferencing it.
>>
>> Thanks for checking this code and providing fixes! These drivers have a
>> complex code path so I had a hard time in following the logic without neing
>> able to test on hardware. Apologies for the issues emerged.
>
> Thanks for your quick review and hard work!
>
>>
>>> Fixes: ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge")
>>> Fixes: 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API")
>>
>> The bug was introduced by 99764593528f, while ae754f049ce1 is not changing
>> the bug, so for the sake of precision we can remove the first 'Fixes:'
>> line.
>
> I added Fixes tag for ae754f049ce1 because it is the first commit which
> this commit could be applied upon properly.  Maybe this helps some tools
> apply this commit or maybe tools are smart enough to find ae754f049ce1
> automatically?

Uhm, good point, maybe it can be a useful reference for the stable team to
backport the fix... Well, let's leave both lines then:

Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>

I'm applying this series perhaps tomorrow (if no one does it before).

Luca

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: (subset) [PATCH 0/3] drm/bridge: imx: A few fixes

[Luca Ceresoli]

On Fri, 23 Jan 2026 17:22:14 +0800, Liu Ying wrote:
> This patch series contains 3 bug fixes for i.MX8QXP DRM bridges.
> Each patch fixes a NULL pointer dereference issue and stands alone.
> 
> 

Applied, thanks!

[1/3] drm/bridge: imx8qxp-ldb: Fix NULL pointer dereference in imx8qxp_ldb_bridge_destroy()
      commit: 852c68bf42965ee38b465d2d6f7b965eb0b5dc1d
[2/3] drm/bridge: imx8qxp-pxl2dpi: Fix NULL pointer dereference in imx8qxp_pxl2dpi_bridge_destroy()
      commit: db7e7ea838c916ee4cdf26bee126fd36f58295dc

Best regards,
-- 
Luca Ceresoli <luca.ceresoli@bootlin.com>

Re: (subset) [PATCH 0/3] drm/bridge: imx: A few fixes

[Liu Ying]

Hi Luca,

On Tue, Jan 27, 2026 at 12:35:47PM +0100, Luca Ceresoli wrote:
> 
> On Fri, 23 Jan 2026 17:22:14 +0800, Liu Ying wrote:
>> This patch series contains 3 bug fixes for i.MX8QXP DRM bridges.
>> Each patch fixes a NULL pointer dereference issue and stands alone.
>>
>>
> 
> Applied, thanks!
> 
> [1/3] drm/bridge: imx8qxp-ldb: Fix NULL pointer dereference in imx8qxp_ldb_bridge_destroy()
>       commit: 852c68bf42965ee38b465d2d6f7b965eb0b5dc1d
> [2/3] drm/bridge: imx8qxp-pxl2dpi: Fix NULL pointer dereference in imx8qxp_pxl2dpi_bridge_destroy()
>       commit: db7e7ea838c916ee4cdf26bee126fd36f58295dc

Any reason why patch 3/3 is not applied?

> 
> Best regards,

-- 
Regards,
Liu Ying

Re: (subset) [PATCH 0/3] drm/bridge: imx: A few fixes

[Luca Ceresoli]

Hello Liu,

On Wed Jan 28, 2026 at 2:50 AM CET, Liu Ying wrote:
> Hi Luca,
>
> On Tue, Jan 27, 2026 at 12:35:47PM +0100, Luca Ceresoli wrote:
>>
>> On Fri, 23 Jan 2026 17:22:14 +0800, Liu Ying wrote:
>>> This patch series contains 3 bug fixes for i.MX8QXP DRM bridges.
>>> Each patch fixes a NULL pointer dereference issue and stands alone.
>>>
>>>
>>
>> Applied, thanks!
>>
>> [1/3] drm/bridge: imx8qxp-ldb: Fix NULL pointer dereference in imx8qxp_ldb_bridge_destroy()
>>       commit: 852c68bf42965ee38b465d2d6f7b965eb0b5dc1d
>> [2/3] drm/bridge: imx8qxp-pxl2dpi: Fix NULL pointer dereference in imx8qxp_pxl2dpi_bridge_destroy()
>>       commit: db7e7ea838c916ee4cdf26bee126fd36f58295dc
>
> Any reason why patch 3/3 is not applied?

Yes, the reason is there's a patch conflict and I still have to find out
how to handle it.

Patch 3 by the rules [0] should go to drm-misc-fixes because the bug (added
by [1]) is already on Linus' master tree (since v6.17), but it does not
apply there due to a conflict with an unrelated change [2] currently on
drm-misc-next.

Note that [1] and [2] are the two commits mentioned in your 'Fixes: 'tags.

I had a chat with Maxime on #dir-devel about how to handle this situation
but still haven't got a final answer.

I guess the correct way is:

 1. apply patch 3 on drm-misc-next, where it applies cleanly
 2. send a modified patch for drm-misc-fixes, to fix ASAP the master branch

Would you send the patch as in item 2, so it can be applied to
drm-misc-fixes and have master fixed ASAP? Note iit should not mention [2]
in the Fixes: tag because [2] is not yet on master. I can send it of course
but you can test on hardware so that would be the best option (and I'm a
bit overloaded at the moment).

[0] https://drm.pages.freedesktop.org/maintainer-tools/committer/committer-drm-misc.html
[1] commit 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API")
[2] commit ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge")

Luca

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: (subset) [PATCH 0/3] drm/bridge: imx: A few fixes

[Luca Ceresoli]

Hello Liu,

On Wed Jan 28, 2026 at 4:26 PM CET, Luca Ceresoli wrote:
>> Any reason why patch 3/3 is not applied?
>
> Yes, the reason is there's a patch conflict and I still have to find out
> how to handle it.
>
> Patch 3 by the rules [0] should go to drm-misc-fixes because the bug (added
> by [1]) is already on Linus' master tree (since v6.17), but it does not
> apply there due to a conflict with an unrelated change [2] currently on
> drm-misc-next.
>
> Note that [1] and [2] are the two commits mentioned in your 'Fixes: 'tags.
>
> I had a chat with Maxime on #dir-devel about how to handle this situation
> but still haven't got a final answer.
>
> I guess the correct way is:
>
>  1. apply patch 3 on drm-misc-next, where it applies cleanly
>  2. send a modified patch for drm-misc-fixes, to fix ASAP the master branch
>
> Would you send the patch as in item 2, so it can be applied to
> drm-misc-fixes and have master fixed ASAP? Note iit should not mention [2]
> in the Fixes: tag because [2] is not yet on master. I can send it of course
> but you can test on hardware so that would be the best option (and I'm a
> bit overloaded at the moment).

Nevermind, I've just sent it:
https://lore.kernel.org/lkml/20260128-drm-bridge-fix-imx8qxp-pixel-combiner-null-deref-v1-0-2138d0933cf1@bootlin.com/

Luca

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: (subset) [PATCH 0/3] drm/bridge: imx: A few fixes

[Liu Ying]

On Wed, Jan 28, 2026 at 04:26:22PM +0100, Luca Ceresoli wrote:
> Hello Liu,

Hello Luca,

> 
> On Wed Jan 28, 2026 at 2:50 AM CET, Liu Ying wrote:
>> Hi Luca,
>>
>> On Tue, Jan 27, 2026 at 12:35:47PM +0100, Luca Ceresoli wrote:
>>>
>>> On Fri, 23 Jan 2026 17:22:14 +0800, Liu Ying wrote:
>>>> This patch series contains 3 bug fixes for i.MX8QXP DRM bridges.
>>>> Each patch fixes a NULL pointer dereference issue and stands alone.
>>>>
>>>>
>>>
>>> Applied, thanks!
>>>
>>> [1/3] drm/bridge: imx8qxp-ldb: Fix NULL pointer dereference in imx8qxp_ldb_bridge_destroy()
>>>       commit: 852c68bf42965ee38b465d2d6f7b965eb0b5dc1d
>>> [2/3] drm/bridge: imx8qxp-pxl2dpi: Fix NULL pointer dereference in imx8qxp_pxl2dpi_bridge_destroy()
>>>       commit: db7e7ea838c916ee4cdf26bee126fd36f58295dc
>>
>> Any reason why patch 3/3 is not applied?
> 
> Yes, the reason is there's a patch conflict and I still have to find out
> how to handle it.
> 
> Patch 3 by the rules [0] should go to drm-misc-fixes because the bug (added
> by [1]) is already on Linus' master tree (since v6.17), but it does not
> apply there due to a conflict with an unrelated change [2] currently on
> drm-misc-next.
> 
> Note that [1] and [2] are the two commits mentioned in your 'Fixes: 'tags.
> 
> I had a chat with Maxime on #dir-devel about how to handle this situation
> but still haven't got a final answer.
> 
> I guess the correct way is:
> 
>  1. apply patch 3 on drm-misc-next, where it applies cleanly
>  2. send a modified patch for drm-misc-fixes, to fix ASAP the master branch

The conflict between the modified patch and commit [2] still needs to
be addressed in the future, right?  Not sure if there is any proper
process to address that.

I think it's acceptable to wait for a while and apply 3/3 after commit [2]
shows up in the master branch, because i.MX8QXP pixel combiner is not
added to device tree yet, that is, no one uses it for now.

> 
> Would you send the patch as in item 2, so it can be applied to
> drm-misc-fixes and have master fixed ASAP? Note iit should not mention [2]
> in the Fixes: tag because [2] is not yet on master. I can send it of course
> but you can test on hardware so that would be the best option (and I'm a
> bit overloaded at the moment).
> 
> [0] https://drm.pages.freedesktop.org/maintainer-tools/committer/committer-drm-misc.html
> [1] commit 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API")
> [2] commit ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge")
> 
> Luca
> 
> --
> Luca Ceresoli, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com/

-- 
Regards,
Liu Ying

Re: [PATCH 0/3] drm/bridge: imx: A few fixes

[Luca Ceresoli]

On Fri, 23 Jan 2026 17:22:14 +0800, Liu Ying wrote:
> This patch series contains 3 bug fixes for i.MX8QXP DRM bridges.
> Each patch fixes a NULL pointer dereference issue and stands alone.
> 
> 

Applied, thanks!

[1/3] drm/bridge: imx8qxp-ldb: Fix NULL pointer dereference in imx8qxp_ldb_bridge_destroy()
      (no commit info)
[2/3] drm/bridge: imx8qxp-pxl2dpi: Fix NULL pointer dereference in imx8qxp_pxl2dpi_bridge_destroy()
      (no commit info)
[3/3] drm/bridge: imx8qxp-pixel-combiner: Fix bailout for imx8qxp_pc_bridge_probe()
      commit: fe6d29b082d49df336ebb92226a3c004ae9e3222

Best regards,
-- 
Luca Ceresoli <luca.ceresoli@bootlin.com>