[PATCH v11 13/74] drm/bridge: Fix NULL deref in drm_bridge_add() for legacy bridges

[Maxime Ripard]

On Tue, Sep 01, 2026 at 09:50:37PM +0300, Cristian Ciocaltea wrote:
> Legacy bridge drivers that embed struct drm_bridge in a zero-initialized
> allocation, rather than obtaining it from devm_drm_bridge_alloc(), never
> run INIT_LIST_HEAD() on bridge->list, leaving next and prev NULL.
> list_empty() compares next against &bridge->list, so it reports such a
> list head as non-empty.  list_del_init() therefore runs and dereferences
> the NULL pointers, panicking the kernel during probe.  Only builds with
> CONFIG_DEBUG_LIST survive, with a list corruption report.
> 
> This affects rk3066_hdmi and the i.MX8 LDB bridges, which still embed a
> bridge in a devm_kzalloc()'d struct.
> 
> Initialize the list head when it is found to be NULL, so that the bridge
> ends up with a valid empty list head and list_del_init() is only reached
> for bridges that can actually be linked.
> 
> Fixes: 17805a15d175 ("drm/bridge: add list of removed refcounted bridges")
> Reported-by: Sashiko <sashiko-bot at kernel.org>
> Closes: https://lore.kernel.org/all/20260731175016.C5D591F00AC4@smtp.kernel.org/
> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea at collabora.com>
> ---
>  drivers/gpu/drm/drm_bridge.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c
> index 2c457ad74f3b..a8b6df5c13ea 100644
> --- a/drivers/gpu/drm/drm_bridge.c
> +++ b/drivers/gpu/drm/drm_bridge.c
> @@ -453,9 +453,16 @@ void drm_bridge_add(struct drm_bridge *bridge)
>  	 * If the bridge was previously added and then removed, it is now
>  	 * in bridge_lingering_list. Remove it or bridge_lingering_list will be
>  	 * corrupted when adding this bridge to bridge_list below.
> +	 *
> +	 * Legacy drivers that allocate the bridge with kzalloc() rather than
> +	 * devm_drm_bridge_alloc() leave list.next NULL. Such a bridge cannot
> +	 * be on any list, and list_del_init() would dereference NULL, so
> +	 * initialize the list head first.

"legacy" bridges are ambigous and was also used for non-atomic bridges.
That being said, it's now *required* that bridges use
devm_drm_bridge_alloc() instead of kzalloc, and we warn in
drm_bridge_add if it hasn't.

So I don't think we should merge this patch.

Maxime
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 273 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-rockchip/attachments/20260908/9b317624/attachment.sig>