In case the channel0 is unavailable and bailing out from free_child is
needed when we fail to add a DRM bridge for the available channel1,
pointer pc->ch[0] in the bailout path would be NULL and it would be
dereferenced as pc->ch[0]->bridge.next_bridge.  Fix this by checking
pc->ch[0] before dereferencing it.

Fixes: ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge")
Fixes: 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API")
Signed-off-by: Liu Ying <victor.liu@nxp.com>
---
 drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c b/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c
index 00dcd273d8ab..27ad66f240cf 100644
--- a/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c
+++ b/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c
@@ -345,7 +345,7 @@ static int imx8qxp_pc_bridge_probe(struct platform_device *pdev)
 free_child:
 	of_node_put(child);
 
-	if (i == 1 && pc->ch[0]->bridge.next_bridge)
+	if (i == 1 && pc->ch[0] && pc->ch[0]->bridge.next_bridge)
 		drm_bridge_remove(&pc->ch[0]->bridge);
 
 	pm_runtime_disable(dev);

-- 
2.43.0

On Fri Jan 23, 2026 at 10:22 AM CET, Liu Ying wrote:
> In case the channel0 is unavailable and bailing out from free_child is
> needed when we fail to add a DRM bridge for the available channel1,
> pointer pc->ch[0] in the bailout path would be NULL and it would be
> dereferenced as pc->ch[0]->bridge.next_bridge.  Fix this by checking
> pc->ch[0] before dereferencing it.

Thanks for checking this code and providing fixes! These drivers have a
complex code path so I had a hard time in following the logic without neing
able to test on hardware. Apologies for the issues emerged.

> Fixes: ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge")
> Fixes: 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API")

The bug was introduced by 99764593528f, while ae754f049ce1 is not changing
the bug, so for the sake of precision we can remove the first 'Fixes:'
line.

With that:
 Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

On Mon, Jan 26, 2026 at 09:33:38AM +0100, Luca Ceresoli wrote:
> On Fri Jan 23, 2026 at 10:22 AM CET, Liu Ying wrote:
>> In case the channel0 is unavailable and bailing out from free_child is
>> needed when we fail to add a DRM bridge for the available channel1,
>> pointer pc->ch[0] in the bailout path would be NULL and it would be
>> dereferenced as pc->ch[0]->bridge.next_bridge.  Fix this by checking
>> pc->ch[0] before dereferencing it.
> 
> Thanks for checking this code and providing fixes! These drivers have a
> complex code path so I had a hard time in following the logic without neing
> able to test on hardware. Apologies for the issues emerged.

Thanks for your quick review and hard work!

> 
>> Fixes: ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge")
>> Fixes: 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API")
> 
> The bug was introduced by 99764593528f, while ae754f049ce1 is not changing
> the bug, so for the sake of precision we can remove the first 'Fixes:'
> line.

I added Fixes tag for ae754f049ce1 because it is the first commit which
this commit could be applied upon properly.  Maybe this helps some tools
apply this commit or maybe tools are smart enough to find ae754f049ce1
automatically?

> 
> With that:
>  Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>

I hope I can have this R-b.  Please let me know if I need to drop the
Fixes tag for ae754f049ce1.

> 
> --
> Luca Ceresoli, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com/

-- 
Regards,
Liu Ying

On Mon Jan 26, 2026 at 9:47 AM CET, Liu Ying wrote:
>
>
> On Mon, Jan 26, 2026 at 09:33:38AM +0100, Luca Ceresoli wrote:
>> On Fri Jan 23, 2026 at 10:22 AM CET, Liu Ying wrote:
>>> In case the channel0 is unavailable and bailing out from free_child is
>>> needed when we fail to add a DRM bridge for the available channel1,
>>> pointer pc->ch[0] in the bailout path would be NULL and it would be
>>> dereferenced as pc->ch[0]->bridge.next_bridge.  Fix this by checking
>>> pc->ch[0] before dereferencing it.
>>
>> Thanks for checking this code and providing fixes! These drivers have a
>> complex code path so I had a hard time in following the logic without neing
>> able to test on hardware. Apologies for the issues emerged.
>
> Thanks for your quick review and hard work!
>
>>
>>> Fixes: ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge")
>>> Fixes: 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API")
>>
>> The bug was introduced by 99764593528f, while ae754f049ce1 is not changing
>> the bug, so for the sake of precision we can remove the first 'Fixes:'
>> line.
>
> I added Fixes tag for ae754f049ce1 because it is the first commit which
> this commit could be applied upon properly.  Maybe this helps some tools
> apply this commit or maybe tools are smart enough to find ae754f049ce1
> automatically?

Uhm, good point, maybe it can be a useful reference for the stable team to
backport the fix... Well, let's leave both lines then:

Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>

I'm applying this series perhaps tomorrow (if no one does it before).

Luca

--
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

On Fri, Jan 23, 2026 at 05:22:17PM +0800, Liu Ying wrote:
> In case the channel0 is unavailable and bailing out from free_child is
> needed when we fail to add a DRM bridge for the available channel1,
> pointer pc->ch[0] in the bailout path would be NULL and it would be
> dereferenced as pc->ch[0]->bridge.next_bridge.  Fix this by checking
> pc->ch[0] before dereferencing it.
>
> Fixes: ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge")
> Fixes: 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API")
> Signed-off-by: Liu Ying <victor.liu@nxp.com>

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> ---
>  drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c b/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c
> index 00dcd273d8ab..27ad66f240cf 100644
> --- a/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c
> +++ b/drivers/gpu/drm/bridge/imx/imx8qxp-pixel-combiner.c
> @@ -345,7 +345,7 @@ static int imx8qxp_pc_bridge_probe(struct platform_device *pdev)
>  free_child:
>  	of_node_put(child);
>
> -	if (i == 1 && pc->ch[0]->bridge.next_bridge)
> +	if (i == 1 && pc->ch[0] && pc->ch[0]->bridge.next_bridge)
>  		drm_bridge_remove(&pc->ch[0]->bridge);
>
>  	pm_runtime_disable(dev);
>
> --
> 2.43.0
>