On Mon Sep 21, 2026 at 9:23 AM CEST, Luca Ceresoli wrote:
> On Tue Sep 1, 2026 at 8:50 PM CEST, Cristian Ciocaltea wrote:
>> drm_bridge_attach() inspects bridge->list to warn about bridges being
>> attached without a previous drm_bridge_add() call, but it does so
>> without holding bridge_lock.
>>
>> The list head can be concurrently written by drm_bridge_add(),
>> drm_bridge_remove() and __drm_bridge_free() while they operate on
>> neighbouring entries of bridge_list or bridge_lingering_list, all of
>> them under bridge_lock. Hence the unlocked read is a data race, even
>> though it is unlikely to change the outcome of list_empty() in practice.
>>
>> Perform the check with bridge_lock held.
>>
>> Fixes: 76f1a9711b83 ("drm/bridge: add warning for bridges attached without
>> being added")
>> Signed-off-by: Cristian Ciocaltea <[email protected]>
>
> Reviewed-by: Luca Ceresoli <[email protected]>
And tested with bridge hotplug:
Tested-by: Luca Ceresoli <[email protected]>
--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
