On Fri Jan 23, 2026 at 10:22 AM CET, Liu Ying wrote:
> In case the channel0 is unavailable and bailing out from free_child is
> needed when we fail to add a DRM bridge for the available channel1,
> pointer pc->ch[0] in the bailout path would be NULL and it would be
> dereferenced as pc->ch[0]->bridge.next_bridge. Fix this by checking
> pc->ch[0] before dereferencing it.
Thanks for checking this code and providing fixes! These drivers have a
complex code path so I had a hard time in following the logic without neing
able to test on hardware. Apologies for the issues emerged.
> Fixes: ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next
> bridge")
> Fixes: 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to
> devm_drm_bridge_alloc() API")
The bug was introduced by 99764593528f, while ae754f049ce1 is not changing
the bug, so for the sake of precision we can remove the first 'Fixes:'
line.
With that:
Reviewed-by: Luca Ceresoli <[email protected]>
--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
