From nobody Tue Apr 7 20:09:00 2026 Received: from mx07-00376f01.pphosted.com (mx07-00376f01.pphosted.com [185.132.180.163]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2C06D23E334 for ; Fri, 27 Feb 2026 14:13:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.132.180.163 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772201594; cv=none; b=ZrdV7NoFv8sn5Uejv6rXd2X9lFWbsxkxTgS0Q8p+kGO5hcFEYJT7nu0dQiWyCgK9OLX13z1CaUJrd4viy6yN8Cze6sZLVq0stHt+C6KEzySeRljIt2SNsrbYSSY8oTi6l6f8D80Il+slPHIdOQfh2LgkZxn+FTddwsFhw3CL8G8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772201594; c=relaxed/simple; bh=jBgKnCq+YL3th6PRa1/ELKZ0oCwTC2bVWQAhD/mwuOA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=m0vqqbO1D+UuT4fTZybUOucxit8WlF0oxYk8z7V/tgIGyuBBKg8Uf4xmQd2zVv7gtAWHYUidjJrllayO2P3KmWst1Fhx2Vno9YAADcHDH1gmflgSRsYzl598b5moXSJOE3i8F4Ndtj0GTBBJD4Rl496ZGbLX2q6DbiRTlWo3x+g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=imgtec.com; spf=pass smtp.mailfrom=imgtec.com; dkim=pass (2048-bit key) header.d=imgtec.com header.i=@imgtec.com header.b=MFvErwEG; arc=none smtp.client-ip=185.132.180.163 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=imgtec.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=imgtec.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=imgtec.com header.i=@imgtec.com header.b="MFvErwEG" Received: from pps.filterd (m0168889.ppops.net [127.0.0.1]) by mx07-00376f01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 61R5SXmR3478147; Fri, 27 Feb 2026 14:12:56 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=imgtec.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=dk201812; bh=W nzD+Mqz10RbIBjtNxU1/ZOP6fPHxGt3wm8hxVeHwq8=; b=MFvErwEGIMSFnDRfq vblweF0ARZeFtogZh+dbYvHSKr365/cELom8ShED2lsPH8TRouOQ+DM283kt6C3D K8zH4flh64839Ke685AM6omEBpc4/KVVkO/nt0GMNMpledPB/iCNPYO0hBNrbrfc G2tBWpLoWBfdsqlWaXEfGEgTfEop+mErBKNPVSs94/pmaWQjBfLWqrTdmyeESNsJ 7O0UWZDWAua1j7dqRUPO/ow4ZXy1in15jmD3pVidTIF/vRZVmyVYGEXcnrE7RVJr XzEKZF4N2QvNMv56iDXNwMkg7rZzPCTh+L6lCwWe8a4PEQxc63hJfOmQ4Kh5TJft /CExQ== Received: from hhmail01.hh.imgtec.org (83-244-153-141.cust-83.exponential-e.net [83.244.153.141]) by mx07-00376f01.pphosted.com (PPS) with ESMTPS id 4cjdvv9c6p-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 27 Feb 2026 14:12:56 +0000 (GMT) Received: from 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa (172.25.6.240) by HHMAIL01.hh.imgtec.org (10.100.10.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.37; Fri, 27 Feb 2026 14:12:55 +0000 From: Matt Coster Date: Fri, 27 Feb 2026 14:12:47 +0000 Subject: [PATCH 1/3] drm/imagination: Check for NULL struct dev_pm_domain_list Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260227-single-domain-power-fixes-v1-1-d37ba0825f7c@imgtec.com> References: <20260227-single-domain-power-fixes-v1-0-d37ba0825f7c@imgtec.com> In-Reply-To: <20260227-single-domain-power-fixes-v1-0-d37ba0825f7c@imgtec.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter CC: Mark Brown , Geert Uytterhoeven , Frank Binns , Alessio Belle , Brajesh Gupta , Alexandru Dadu , , , "Matt Coster" X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=2010; i=matt.coster@imgtec.com; h=from:subject:message-id; bh=jBgKnCq+YL3th6PRa1/ELKZ0oCwTC2bVWQAhD/mwuOA=; b=owGbwMvMwCFWuUfy8817WRsYT6slMWQuXJbmyBhhPt+3V6xhvsMh9n3OpRXyXw6WF8jc5j/UL 54wa6JdRykLgxgHg6yYIsuOFZYr1P6oaUnc+FUMM4eVCWQIAxenAEzk8haGf1pFR584MyzzyU4p lo1YttfNpq3Gfe2+P0+y7F82p6966sTIsPOaAmuv7Cz39MzHrVKOPen3rx9L/3kg1ftYsIPTxWv 7mQE= X-Developer-Key: i=matt.coster@imgtec.com; a=openpgp; fpr=05A40CFCE7269D61D97100A1747F0A9036F90DFA X-Authority-Analysis: v=2.4 cv=CL0nnBrD c=1 sm=1 tr=0 ts=69a1a668 cx=c_pps a=AKOq//PuzOIrVTIF9yBwbA==:117 a=AKOq//PuzOIrVTIF9yBwbA==:17 a=N16aOacbDtMA:10 a=IkcTkHD0fZMA:10 a=HzLeVaNsDn8A:10 a=VkNPw1HP01LnGYTKEx00:22 a=kQ-hrUj2-E3RCbRHssb7:22 a=7RYWX5rxfSByPNLylY2M:22 a=VwQbUJbxAAAA:8 a=qNABUOcEAAAA:8 a=r_1tXGB3AAAA:8 a=nMjM23kXYAJxtPFA7vEA:9 a=QEXdDO2ut3YA:10 a=Ytm653ucTKQjCvbzLygB:22 a=t8nPyN_e6usw4ciXM-Pk:22 X-Proofpoint-GUID: yoOM3qXgbwvCmRiZ-6E3GQ7H8FxApYHk X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMjI3MDEyNSBTYWx0ZWRfX5MHVgQesMRWe fjFBFpHWNgnVRe+U2qSaObrdyhBvsJGjzdiKuYnxAsyIO92/USQ+V8JAbNUZAu0tK0X860wbhv0 rvGmFWT5s93VMk5WJK1UnvAYHhlYNtQB+qUiQXNiV6frBSlsZkgLev0Uu7y7fNY4mKBrs6efWyO ufJ4er1FNsLdgSYF+iY3U1VBgeUgiV8Wt61iKjGXjx89c3ZmiVMNs8pDid+GmnU7mcKArD+Jr+K it8YPzjDjLQxr62fLfGiDc9bZqs+KqfPJ1G2JOAeYjbdZAuqUK72kibUzPf0MhFVIC8pkqZ0D69 /jYlL7Q7pD+BflUQGAKIzw9yggsmJ8MfoO+O+mz4hOu0um0PRylPIb3EH4t0+286o5G2qZIErJk mg2dE7cuW+qRWReDNBplCC2+yyrAMjjZMIaWEEXIqkYlSj56NjksUJJnYRTme9ImFLiCHEz28YL ixGd7rsFULCC/bRcKmA== X-Proofpoint-ORIG-GUID: yoOM3qXgbwvCmRiZ-6E3GQ7H8FxApYHk While dev_pm_domain_detach_list() itself contains the necessary NULL check, the access to struct dev_pm_domain_list->num_pds does not and thus faults on devices with <=3D1 power domains (where the struct dev_pm_domain_list machinery is skipped for simplicity). This can be reproduced on AM625, which produces the following log[1]: [ 10.820056] powervr fd00000.gpu: Direct firmware load for powervr/rogue_= 33.15.11.3_v1.fw failed with error -2 [ 10.831903] powervr fd00000.gpu: [drm] *ERROR* failed to load firmware p= owervr/rogue_33.15.11.3_v1.fw (err=3D-2) ... [ 10.844023] Unable to handle kernel NULL pointer dereference at virtual = address 0000000000000018 ... [ 11.090162] Call trace: [ 11.092600] pvr_power_domains_fini+0x18/0xa0 [powervr] (P) [ 11.098218] pvr_probe+0x100/0x14c [powervr] [ 11.102505] platform_probe+0x5c/0xa4 Fixes: e19cc5ab347e3 ("drm/imagination: Use dev_pm_domain_attach_list()") Reported-by: Mark Brown Closes: https://lore.kernel.org/r/c353fdef-9ccd-4a11-a527-ab4a792d8e70@sire= na.org.uk/ [1] Signed-off-by: Matt Coster Tested-by: Mark Brown --- drivers/gpu/drm/imagination/pvr_power.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/imagination/pvr_power.c b/drivers/gpu/drm/imag= ination/pvr_power.c index 006a72ed5064..be8018085b2d 100644 --- a/drivers/gpu/drm/imagination/pvr_power.c +++ b/drivers/gpu/drm/imagination/pvr_power.c @@ -668,14 +668,16 @@ void pvr_power_domains_fini(struct pvr_device *pvr_de= v) { struct pvr_device_power *pvr_power =3D &pvr_dev->power; =20 - int i =3D (int)pvr_power->domains->num_pds - 1; + if (!pvr_power->domains) + goto out; =20 - while (--i >=3D 0) + for (int i =3D (int)pvr_power->domains->num_pds - 2; i >=3D 0; --i) device_link_del(pvr_power->domain_links[i]); =20 dev_pm_domain_detach_list(pvr_power->domains); =20 kfree(pvr_power->domain_links); =20 +out: *pvr_power =3D (struct pvr_device_power){ 0 }; } --=20 2.53.0