diff mbox series

drm/sun4i: backend: fix error pointer dereference

Message ID 20260217014801.60760-1-ethantidmore06@gmail.com (mailing list archive)
State New
Headers
Series drm/sun4i: backend: fix error pointer dereference |

Commit Message

Ethan Tidmore Feb. 17, 2026, 1:48 a.m. UTC 
The function drm_atomic_get_plane_state() can return an error pointer
and is not checked for it. Add error pointer check.

Detected by Smatch:
drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error:
'plane_state' dereferencing possible ERR_PTR()

Fixes: 96180dde23b79 ("drm/sun4i: backend: Add a custom atomic_check for the frontend")
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
---
 drivers/gpu/drm/sun4i/sun4i_backend.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Chen-Yu Tsai Feb. 17, 2026, 7:53 a.m. UTC | #1 
On Tue, Feb 17, 2026 at 9:48 AM Ethan Tidmore <ethantidmore06@gmail.com> wrote:
>
> The function drm_atomic_get_plane_state() can return an error pointer
> and is not checked for it. Add error pointer check.
>
> Detected by Smatch:
> drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error:
> 'plane_state' dereferencing possible ERR_PTR()
>
> Fixes: 96180dde23b79 ("drm/sun4i: backend: Add a custom atomic_check for the frontend")
> Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>

Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Chen-Yu Tsai Feb. 24, 2026, 5:57 p.m. UTC | #2 
On Mon, 16 Feb 2026 19:48:01 -0600, Ethan Tidmore wrote:
> The function drm_atomic_get_plane_state() can return an error pointer
> and is not checked for it. Add error pointer check.
> 
> Detected by Smatch:
> drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error:
> 'plane_state' dereferencing possible ERR_PTR()
> 
> [...]

Applied to drm-misc-next in drm-misc, thanks!

[1/1] drm/sun4i: backend: fix error pointer dereference
      commit: 06277983eca4a31d3c2114fa33d99a6e82484b11

Best regards,
diff mbox series

Patch

diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
index 40405a52a073..6391bdc94a5c 100644
--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
@@ -491,6 +491,9 @@  static int sun4i_backend_atomic_check(struct sunxi_engine *engine,
 	drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) {
 		struct drm_plane_state *plane_state =
 			drm_atomic_get_plane_state(state, plane);
+		if (IS_ERR(plane_state))
+			return PTR_ERR(plane_state);
+
 		struct sun4i_layer_state *layer_state =
 			state_to_sun4i_layer_state(plane_state);
 		struct drm_framebuffer *fb = plane_state->fb;