linux-kernel - Re: [REGRESSION] drm/panel/panel-simple v6.17 WARNING regression

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <DDI0OEMAGBI3.2WFIP0O7M73LB@bootlin.com>
Date: Tue, 14 Oct 2025 13:43:21 +0200
From: "Luca Ceresoli" <luca.ceresoli@...tlin.com>
To: "Ernest Van Hoecke" <ernestvanhoecke@...il.com>
Cc: "Anusha Srivatsa" <asrivats@...hat.com>, "Maxime Ripard"
 <mripard@...nel.org>, "Neil Armstrong" <neil.armstrong@...aro.org>,
 "Andrzej Hajda" <andrzej.hajda@...el.com>, "Jessica Zhang"
 <quic_jesszhan@...cinc.com>, "Robert Foss" <rfoss@...nel.org>, "Laurent
 Pinchart" <Laurent.pinchart@...asonboard.com>, "Maarten Lankhorst"
 <maarten.lankhorst@...ux.intel.com>, "Thomas Zimmermann"
 <tzimmermann@...e.de>, "Thomas Petazzoni" <thomas.petazzoni@...tlin.com>,
 "David Airlie" <airlied@...il.com>, "Simona Vetter" <simona@...ll.ch>, "Hui
 Pu" <Hui.Pu@...ealthcare.com>, "Dmitry Baryshkov"
 <dmitry.baryshkov@....qualcomm.com>, <dri-devel@...ts.freedesktop.org>,
 <linux-kernel@...r.kernel.org>, <imx@...ts.linux.dev>,
 <regressions@...ts.linux.dev>
Subject: Re: [REGRESSION] drm/panel/panel-simple v6.17 WARNING regression

Hello Ernest,

On Tue Oct 14, 2025 at 1:25 PM CEST, Ernest Van Hoecke wrote:
> Hi Luca,
>
> Thanks for your fast reply and all your work here.
>
> On Tue, Oct 14, 2025 at 12:31:35PM +0200, Luca Ceresoli wrote:
>> Let me have a look at the DRM_IMX driver, I'll try to send a series
>> converting it to the new API within today.
>
> I will gladly test, thanks!

Just sent:
https://lore.kernel.org/all/20251014-drm-bridge-alloc-imx-ipuv3-v1-0-a1bb1dcbff50@bootlin.com/

>> I recently sent a series proposing to make drm_bridge_add() mandatory
>> before drm_bridge_attach() in the docs and warn if that is violated [1]. If
>> you apply patch 4 of that series you should see the warning.
>
> I gave it a quick try and did not see the warning. Some printk debugging
> told me that `list_empty(&bridge->list)`, inside drm_bridge_attach, is
> returning 0.

Ouch, I think this is because without using devm_drm_bridge_alloc() even
the list is uninitialized, and so list_empty will do:

static inline int list_empty(const struct list_head *head)
{
	return READ_ONCE(head->next) == head;
	                        ^         ^
                NULL (bridge->list      valid pointer
                zeroed by kzalloc)      to bridge->list
}

So it returns false. I guess that means the series to make drm_bridge_add()
mandatory before drm_bridge_attach() [0] will need a better check to
trigger the warning.

[0] https://lore.kernel.org/lkml/20251003-b4-drm-bridge-alloc-add-before-attach-v1-0-92fb40d27704@bootlin.com/

>> > However, later on, another regression seems to be introduced by
>> > commit 8fa5909400f3 ("drm/bridge: get the bridge returned by drm_bridge_chain_get_first_bridge()")
>> > so reverting 94d50c1a2ca3 on top of drm-misc-next does not solve
>> > everything. This was tested by rebasing drm-misc-next onto (260f6f4fda93
>> > plus the revert of 94d50c1a2ca3) and then bisecting.
>> >
>> > So in v6.18-rc1, both regressions are present.
>> >
>> > There, I get the following additional warnings:
>> >
>> > [    9.732278] ------------[ cut here ]------------
>> > [    9.732336] WARNING: CPU: 0 PID: 38 at lib/refcount.c:22 drm_bridge_get+0x10/0x18
>> > [    9.744608] refcount_t: saturated; leaking memory.
>>
>> Not sure here, but it may well be another symptom of the same bug: the
>> refcount was not initialized correctly, so it is found inconsistent later
>> when trying to increase it. Let's fix the known issue and then we'll see.
>
> Makes sense to me.

Alright. Let me know whether the series I've sent fixes 0, 1 or both
warnings.

Best regards,
Luca

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com