Merge tag 'drm-misc-next-fixes-2026-01-29' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

Two fixes for NULL pointer dereference in imx8 following the bridge
refcounting conversions, and one for the bridge connector following the
HDMI audio reworks.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <mripard@redhat.com>
Link: https://patch.msgid.link/20260129-efficient-jerboa-of-ecstasy-822832@houat

Author: airlied

drivers/gpu/drm/bridge/imx/imx8qxp-ldb.c

@@ -65,9 +65,12 @@ static inline struct imx8qxp_ldb *base_to_imx8qxp_ldb(struct ldb *base)
 static void imx8qxp_ldb_bridge_destroy(struct drm_bridge *bridge)
 {
 	struct ldb_channel *ldb_ch = bridge->driver_private;
-	struct ldb *ldb = ldb_ch->ldb;
-	struct imx8qxp_ldb *imx8qxp_ldb = base_to_imx8qxp_ldb(ldb);
+	struct imx8qxp_ldb *imx8qxp_ldb;
+
+	if (!ldb_ch)
+		return;
 
+	imx8qxp_ldb = base_to_imx8qxp_ldb(ldb_ch->ldb);
 	drm_bridge_put(imx8qxp_ldb->companion);
 }
 

drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c

@@ -67,6 +67,9 @@ static void imx8qxp_pxl2dpi_bridge_destroy(struct drm_bridge *bridge)
 {
 	struct imx8qxp_pxl2dpi *p2d = bridge->driver_private;
 
+	if (!p2d)
+		return;
+
 	drm_bridge_put(p2d->companion);
 }
 

drivers/gpu/drm/display/drm_bridge_connector.c

@@ -851,6 +851,11 @@ struct drm_connector *drm_bridge_connector_init(struct drm_device *drm,
 			    !bridge->funcs->hdmi_clear_hdmi_infoframe)
 				return ERR_PTR(-EINVAL);
 
+			if (bridge->ops & DRM_BRIDGE_OP_HDMI_AUDIO &&
+			    (!bridge->funcs->hdmi_write_audio_infoframe ||
+			     !bridge->funcs->hdmi_clear_audio_infoframe))
+				return ERR_PTR(-EINVAL);
+
 			if (bridge->ops & DRM_BRIDGE_OP_HDMI_HDR_DRM_INFOFRAME &&
 			    (!bridge->funcs->hdmi_write_hdr_drm_infoframe ||
 			     !bridge->funcs->hdmi_clear_hdr_drm_infoframe))
@@ -880,9 +885,7 @@ struct drm_connector *drm_bridge_connector_init(struct drm_device *drm,
 			    !bridge->hdmi_audio_spdif_playback)
 				return ERR_PTR(-EINVAL);
 
-			if (!bridge->funcs->hdmi_write_audio_infoframe ||
-			    !bridge->funcs->hdmi_clear_audio_infoframe ||
-			    !bridge->funcs->hdmi_audio_prepare ||
+			if (!bridge->funcs->hdmi_audio_prepare ||
 			    !bridge->funcs->hdmi_audio_shutdown)
 				return ERR_PTR(-EINVAL);