On Fri, Jan 10, 2025 at 04:48:20PM +0800, Liu Ying wrote:
> It's ok to pass atomic check successfully if an atomic commit tries to
> disable the display pipeline which the connector belongs to. That is,
> when the crtc or the best_encoder pointers in struct drm_connector_state
> are NULL, drm_atomic_helper_connector_hdmi_check() should return 0.
> Without the check against the NULL pointers, drm_default_rgb_quant_range()
> called by drm_atomic_helper_connector_hdmi_check() would dereference
> the NULL pointer to_match in drm_match_cea_mode().
>
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
> Call trace:
> drm_default_rgb_quant_range+0x0/0x4c (P)
> drm_bridge_connector_atomic_check+0x20/0x2c
> drm_atomic_helper_check_modeset+0x488/0xc78
> drm_atomic_helper_check+0x20/0xa4
> drm_atomic_check_only+0x4b8/0x984
> drm_atomic_commit+0x48/0xc4
> drm_framebuffer_remove+0x44c/0x530
> drm_mode_rmfb_work_fn+0x7c/0xa0
> process_one_work+0x150/0x294
> worker_thread+0x2dc/0x3dc
> kthread+0x130/0x204
> ret_from_fork+0x10/0x20
>
> Fixes: 8ec116ff21a9 ("drm/display: bridge_connector: provide atomic_check for HDMI bridges")
> Fixes: 84e541b1e58e ("drm/sun4i: use drm_atomic_helper_connector_hdmi_check()")
> Fixes: 65548c8ff0ab ("drm/rockchip: inno_hdmi: Switch to HDMI connector")
> Signed-off-by: Liu Ying <victor.liu@xxxxxxx>
> ---
> Tested with i.MX8MP imx-lcdif.
> sun4i and rockchip are not tested due to no HW access.
>
> v2:
> * Trim backtrace in commit message. (Dmitry)
> * Drop timestamps from backtrace commit message. (Dmitry)
> * Move the necessary checks from drm_bridge_connector_atomic_check() to
> drm_atomic_helper_connector_hdmi_check(). (Dmitry)
>
> drivers/gpu/drm/display/drm_hdmi_state_helper.c | 3 +++
> 1 file changed, 3 insertions(+)
>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxx>
--
With best wishes
Dmitry
