From patchwork Tue Sep 1 18:50:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cristian Ciocaltea X-Patchwork-Id: 3073 Return-Path: X-Original-To: noreply@patchwork.local Delivered-To: noreply@patchwork.local Received: from tor.lore.kernel.org (tor.lore.kernel.org [172.105.105.114]) by mxe881.netcup.net (Postfix) with ESMTPS id B59081C002D for ; Tue, 1 Sep 2026 20:56:20 +0200 (CEST) Authentication-Results: mxe881; dkim=pass header.d=collabora.com; spf=pass (sender IP is 172.105.105.114) smtp.mailfrom=linux-sunxi+bounces-25392-noreply=patchwork.local@lists.linux.dev smtp.helo=tor.lore.kernel.org Received-SPF: pass (mxe881: domain of lists.linux.dev designates 172.105.105.114 as permitted sender) client-ip=172.105.105.114; envelope-from=linux-sunxi+bounces-25392-noreply=patchwork.local@lists.linux.dev; helo=tor.lore.kernel.org; Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id C50A747FE9 for ; Tue, 1 Sep 2026 18:51:10 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 6451A4A0926; Tue, 1 Sep 2026 18:50:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="RVeepdB0" X-Original-To: linux-sunxi@lists.linux.dev Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7662849F139 for ; Tue, 1 Sep 2026 18:50:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788288647; cv=none; b=c93oHqllDWANHswWJziy0V3M6hTUKVtpKgcR8+nanS873Ja5XTqbBiSc1lE7RoFYqmL40rrBYTfh3zUMsowAcEde5y/wYVLJHM+v6/M8Po7rFHDLg8E5B67rH2QuLn7JIFBYDkiDe/oFlslT6VBXtBO9ArsSyBiT20ni1LbnqMI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788288647; c=relaxed/simple; bh=eu1KlSlWXqhbiSpgzVzFIDL33AEwWbq34A898vzWv2U=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=QtrxPxqthYmM4WYRrzrvZpdwQLYAxPW0aaacluAie6kencdDsvNpYnNq9vdGNaAsdIV8Z3qyiefy+aa3fFDln5JlDR6+hy3Tbx6ga7IOTbpuJ1/UnqL7+eool8gSB+D9KnGah4JTXYd89EqACp2rBUQLN06MNlgSlxjC0dFyIAs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=RVeepdB0; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1788288642; bh=eu1KlSlWXqhbiSpgzVzFIDL33AEwWbq34A898vzWv2U=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=RVeepdB0Bcueu2yR6HxUoRZoMXRJ6Wle8Ow5IFxiJnxIwLz75sII6M0a0TUCrYZ7b bOR8K5WmFYV6wb0TIAmyZhGrTEDaKVpDjYCK5VaaNpwaFqEHhgts7SetkZ5cZb0hjA WFZzDxQkpoE+8BIxH+Guem+EVr6+aO8dfmUWfcyM7Wj62odW40iFHqCYdkStdsK4Wq hXCgWTAoNK8OgoeHtZusz0Ns4lAvfKf12e6WXy5tKTyDGRAh5BPk1t5oORQ0G0h1eZ T/l9T8qtD9uRUJs5oskv5BSW/3NNrJvMhls8bVNzmnRGpBttx9M9i8dIWUfILO6nGt rT+hRBkU4rmrA== Received: from localhost (unknown [100.64.0.241]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange secp256r1 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: cristicc) by bali.collaboradmins.com (Postfix) with ESMTPSA id 92CA817E0934; Tue, 01 Sep 2026 20:50:42 +0200 (CEST) From: Cristian Ciocaltea Date: Tue, 01 Sep 2026 21:50:26 +0300 Subject: [PATCH v11 02/74] drm/connector: hdmi: Handle reset() state allocation failure Precedence: bulk X-Mailing-List: linux-sunxi@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20260901-dw-hdmi-qp-scramb-v11-2-bc12954a0688@collabora.com> References: <20260901-dw-hdmi-qp-scramb-v11-0-bc12954a0688@collabora.com> In-Reply-To: <20260901-dw-hdmi-qp-scramb-v11-0-bc12954a0688@collabora.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dave Stevenson , Dmitry Baryshkov , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Luca Ceresoli , Chen-Yu Tsai , Samuel Holland , =?utf-8?q?Ma=C3=ADra_Canal?= , Raspberry Pi Kernel Maintenance , Raphael Gallais-Pou , Sandy Huang , =?utf-8?q?Heiko_St=C3=BCbner?= , Andy Yan , Algea Cao , Daniel Stone , Liu Ying , Phong LE , Helge Deller Cc: kernel@collabora.com, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-rockchip@lists.infradead.org, linux-fbdev@vger.kernel.org, Sashiko X-Mailer: b4 0.15.2 X-Rspamd-Server: rspamd-worker-8404 X-Spamd-Result: default: False [-2.16 / 15.00]; BAYES_HAM(-5.50)[100.00%]; RBL_SENDERSCORE(2.00)[172.105.105.114:from]; SUSPICIOUS_RECIPS(1.50)[]; MAILLIST(-0.15)[generic]; BAD_REP_POLICIES(0.10)[]; MIME_GOOD(-0.10)[text/plain]; HAS_LIST_UNSUB(-0.01)[]; FROM_HAS_DN(0.00)[]; PRECEDENCE_BULK(0.00)[]; R_DKIM_ALLOW(0.00)[collabora.com:s=mail]; TAGGED_RCPT(0.00)[]; DBL_BLOCKED_OPENRESOLVER(0.00)[collabora.com:email,collabora.com:dkim,tor.lore.kernel.org:rdns,tor.lore.kernel.org:helo]; MID_RHS_MATCH_FROM(0.00)[]; FORGED_SENDER_MAILLIST(0.00)[]; RCPT_COUNT_TWELVE(0.00)[35]; RCVD_VIA_SMTP_AUTH(0.00)[]; RCVD_COUNT_FIVE(0.00)[5]; ARC_ALLOW(0.00)[subspace.kernel.org:s=arc-20240116:i=1]; DKIM_TRACE(0.00)[collabora.com:+]; DMARC_POLICY_ALLOW(0.00)[collabora.com,none]; R_SPF_ALLOW(0.00)[+ip4:172.105.105.114:c]; RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER(0.00)[100.64.0.241:received,100.90.174.1:received,148.251.105.195:received]; TO_DN_SOME(0.00)[]; FROM_NEQ_ENVFROM(0.00)[cristian.ciocaltea@collabora.com,linux-sunxi@lists.linux.dev]; FREEMAIL_TO(0.00)[linux.intel.com,kernel.org,suse.de,gmail.com,ffwll.ch,raspberrypi.com,intel.com,linaro.org,ideasonboard.com,kwiboo.se,bootlin.com,sholland.org,igalia.com,rock-chips.com,sntech.de,collabora.com,nxp.com,baylibre.com,gmx.de]; MIME_TRACE(0.00)[0:+]; TAGGED_FROM(0.00)[bounces-25392-noreply=patchwork.local]; FORGED_RECIPIENTS_MAILLIST(0.00)[]; ASN(0.00)[asn:63949, ipnet:172.105.96.0/20, country:SG]; RCVD_TLS_LAST(0.00)[]; RBL_SPAMHAUS_BLOCKED_OPENRESOLVER(0.00)[172.105.105.114:from] X-Rspamd-Queue-Id: B59081C002D X-MORS-Enabled: yes X-MORS-DOMAIN: patchwork.local X-MORS-HOSTING: hosting172546 X-MORS-USER: hosting172546 X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= In drmm_connector_hdmi_init(), if the reset callback fails to allocate memory, e.g. inside drm_atomic_helper_connector_reset(), connector->state will remain NULL. This is unconditionally passed to drm_connector_attach_max_bpc_property(), leading to a NULL pointer dereference. Bail out with -ENOMEM if the reset callback leaves connector->state unset. Fixes: aadb3e16b8f3 ("drm/connector: hdmi: Add output BPC to the connector state") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260723015306.C94241F000E9@smtp.kernel.org/ Link: https://lore.kernel.org/all/20260723015306.C94241F000E9@smtp.kernel.org/ Reviewed-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea --- drivers/gpu/drm/drm_connector.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c index 8b4baed060f3..0e39431e85b2 100644 --- a/drivers/gpu/drm/drm_connector.c +++ b/drivers/gpu/drm/drm_connector.c @@ -628,6 +628,8 @@ int drmm_connector_hdmi_init(struct drm_device *dev, connector->state = state; } else if (connector->funcs->reset) { connector->funcs->reset(connector); + if (!connector->state) + return -ENOMEM; } drm_connector_attach_max_bpc_property(connector, 8, max_bpc);