On Fri, Jul 18, 2025 at 04:41:56PM +0200, Luca Ceresoli wrote:
> Hi Dmitry,
>
> On Sat, 17 May 2025 04:59:44 +0300
> Dmitry Baryshkov <dmitry.barysh...@oss.qualcomm.com> wrote:
>
> > Allow HDMI DRM bridges to create CEC notifier. Physical address is
> > handled automatically by drm_atomic_helper_connector_hdmi_hotplug()
> > being called from .detect() path.
> >
> > Signed-off-by: Dmitry Baryshkov <dmitry.barysh...@linaro.org>
> > Reviewed-by: Maxime Ripard <mrip...@kernel.org>
> > Signed-off-by: Dmitry Baryshkov <dmitry.barysh...@oss.qualcomm.com>
>
> While working on drm_bridge_connector_init() for unrelated changes I
> stumbled upon something in this patch (now committed) which at a
> cursory look appears wrong to me. Even though I still haven't analyzed
> in depth I'm reporting it ASAP so you are aware and can either correct
> me or confirm there is a bug.
>
> > @@ -662,6 +670,13 @@ struct drm_connector *drm_bridge_connector_init(struct
> > drm_device *drm,
> > bridge_connector->bridge_dp_audio = bridge;
> > }
> >
> > + if (bridge->ops & DRM_BRIDGE_OP_HDMI_CEC_NOTIFIER) {
> > + if (bridge_connector->bridge_hdmi_cec)
> > + return ERR_PTR(-EBUSY);
> > +
> > + bridge_connector->bridge_hdmi_cec = bridge;
> > + }
> > +
> > if (!drm_bridge_get_next_bridge(bridge))
> > connector_type = bridge->type;
> >
> > @@ -724,6 +739,15 @@ struct drm_connector *drm_bridge_connector_init(struct
> > drm_device *drm,
> > return ERR_PTR(ret);
> > }
> >
> > + if (bridge_connector->bridge_hdmi_cec &&
> > + bridge_connector->bridge_hdmi_cec->ops &
> > DRM_BRIDGE_OP_HDMI_CEC_NOTIFIER) {
You are right, here it should be:
bridge = bridge_connector->bridge_hdmi_cec;
(and a similar change in the next if).
I'll send a patch.
> > + ret = drmm_connector_hdmi_cec_notifier_register(connector,
> > + NULL,
> > +
> > bridge->hdmi_cec_dev);
>
> Here you are using the 'bridge' pointer, which is the variable used by
> the long drm_for_each_bridge_in_chain() loop at the function top. The
> same happens in the following patch. I am not sure this is what was
> intended, but I don't understand all the details of your series.
>
> In an older patch [0] you had added a similar change, dereferencing the
> same 'bridge' variable after the drm_for_each_bridge_in_chain() loop.
> That was a bug fixed by a later patch [1].
>
> Superficially this change (as well as patch 9) appears equally wrong.
>
> Basically the value of 'bridge' here could be NULL or
> bridge_connector->bridge_hdmi, depending on the
> bridge_connector->bridge_hdmi value.
>
> Is this the what you'd expect?
>
> And if it is, what is the correct fix? Maybe:
>
> ret = drmm_connector_hdmi_cec_notifier_register(connector,
> NULL,
> - bridge->hdmi_cec_dev);
> +
> bridge_connector->bridge_hdmi_cec->hdmi_cec_dev);
>
> ?
>
[skipped]
>
> [0] https://cgit.freedesktop.org/drm-misc/commit/?id=231adeda9f67
> -> hunk @@ -641,11 +705,16 @@
> [1]
> https://cgit.freedesktop.org/drm-misc/commit/?id=10357824151262636fda879845f8b64553541106
>
> Best regards,
> Luca
>
> --
> Luca Ceresoli, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com
--
With best wishes
Dmitry
