From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [linux-next:master 5767/6121] drivers/gpu/drm/gud/gud_pipe.c:616 gud_plane_atomic_update() error: we previously assumed 'crtc' could be null (see line 597)
Date: Wed, 14 Jan 2026 21:22:37 +0800 [thread overview]
Message-ID: <202601142159.0v8ilfVs-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Shenghao Yang <me@shenghaoyang.info>
CC: Ruben Wauters <rubenru09@aol.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: b775e489bec70895b7ef6b66927886bbac79598f
commit: dc2d5ddb193e363187bae2ad358245642d2721fb [5767/6121] drm/gud: fix NULL fb and crtc dereferences on USB disconnect
:::::: branch date: 8 hours ago
:::::: commit date: 23 hours ago
config: x86_64-randconfig-161-20260114 (https://download.01.org/0day-ci/archive/20260114/202601142159.0v8ilfVs-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
rustc: rustc 1.88.0 (6b00bc388 2025-06-23)
smatch version: v0.5.0-8985-g2614ff1a
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202601142159.0v8ilfVs-lkp@intel.com/
smatch warnings:
drivers/gpu/drm/gud/gud_pipe.c:616 gud_plane_atomic_update() error: we previously assumed 'crtc' could be null (see line 597)
vim +/crtc +616 drivers/gpu/drm/gud/gud_pipe.c
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 582
73cfd166e04576 Ruben Wauters 2025-08-18 583 void gud_plane_atomic_update(struct drm_plane *plane,
73cfd166e04576 Ruben Wauters 2025-08-18 584 struct drm_atomic_state *atomic_state)
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 585 {
73cfd166e04576 Ruben Wauters 2025-08-18 586 struct drm_device *drm = plane->dev;
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 587 struct gud_device *gdrm = to_gud_device(drm);
73cfd166e04576 Ruben Wauters 2025-08-18 588 struct drm_plane_state *old_state = drm_atomic_get_old_plane_state(atomic_state, plane);
73cfd166e04576 Ruben Wauters 2025-08-18 589 struct drm_plane_state *new_state = drm_atomic_get_new_plane_state(atomic_state, plane);
73cfd166e04576 Ruben Wauters 2025-08-18 590 struct drm_shadow_plane_state *shadow_plane_state = to_drm_shadow_plane_state(new_state);
73cfd166e04576 Ruben Wauters 2025-08-18 591 struct drm_framebuffer *fb = new_state->fb;
73cfd166e04576 Ruben Wauters 2025-08-18 592 struct drm_crtc *crtc = new_state->crtc;
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 593 struct drm_rect damage;
73cfd166e04576 Ruben Wauters 2025-08-18 594 struct drm_atomic_helper_damage_iter iter;
c17d048609bf09 Noralf Trønnes 2022-11-30 595 int ret, idx;
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 596
dc2d5ddb193e36 Shenghao Yang 2025-12-31 @597 if (!crtc || crtc->state->mode_changed || !crtc->state->enable) {
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 598 cancel_work_sync(&gdrm->work);
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 599 mutex_lock(&gdrm->damage_lock);
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 600 if (gdrm->fb) {
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 601 drm_framebuffer_put(gdrm->fb);
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 602 gdrm->fb = NULL;
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 603 }
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 604 gud_clear_damage(gdrm);
c17d048609bf09 Noralf Trønnes 2022-11-30 605 vfree(gdrm->shadow_buf);
c17d048609bf09 Noralf Trønnes 2022-11-30 606 gdrm->shadow_buf = NULL;
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 607 mutex_unlock(&gdrm->damage_lock);
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 608 }
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 609
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 610 if (!drm_dev_enter(drm, &idx))
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 611 return;
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 612
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 613 if (!old_state->fb)
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 614 gud_usb_set_u8(gdrm, GUD_REQ_SET_CONTROLLER_ENABLE, 1);
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 615
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 @616 if (fb && (crtc->state->mode_changed || crtc->state->connectors_changed))
:::::: The code at line 616 was first introduced by commit
:::::: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 drm: Add GUD USB Display driver
:::::: TO: Noralf Trønnes <noralf@tronnes.org>
:::::: CC: Noralf Trønnes <noralf@tronnes.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@linaro.org>
To: oe-kbuild@lists.linux.dev, Shenghao Yang <me@shenghaoyang.info>
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
Ruben Wauters <rubenru09@aol.com>
Subject: [linux-next:master 5767/6121] drivers/gpu/drm/gud/gud_pipe.c:616 gud_plane_atomic_update() error: we previously assumed 'crtc' could be null (see line 597)
Date: Sun, 18 Jan 2026 14:40:24 +0300 [thread overview]
Message-ID: <202601142159.0v8ilfVs-lkp@intel.com> (raw)
Message-ID: <20260118114024.84KmirvBL3PBVRSfoemh5cjr4jZvwsMkA579-eYdVB4@z> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: b775e489bec70895b7ef6b66927886bbac79598f
commit: dc2d5ddb193e363187bae2ad358245642d2721fb [5767/6121] drm/gud: fix NULL fb and crtc dereferences on USB disconnect
config: x86_64-randconfig-161-20260114 (https://download.01.org/0day-ci/archive/20260114/202601142159.0v8ilfVs-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
rustc: rustc 1.88.0 (6b00bc388 2025-06-23)
smatch version: v0.5.0-8985-g2614ff1a
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202601142159.0v8ilfVs-lkp@intel.com/
smatch warnings:
drivers/gpu/drm/gud/gud_pipe.c:616 gud_plane_atomic_update() error: we previously assumed 'crtc' could be null (see line 597)
vim +/crtc +616 drivers/gpu/drm/gud/gud_pipe.c
73cfd166e04576 Ruben Wauters 2025-08-18 583 void gud_plane_atomic_update(struct drm_plane *plane,
73cfd166e04576 Ruben Wauters 2025-08-18 584 struct drm_atomic_state *atomic_state)
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 585 {
73cfd166e04576 Ruben Wauters 2025-08-18 586 struct drm_device *drm = plane->dev;
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 587 struct gud_device *gdrm = to_gud_device(drm);
73cfd166e04576 Ruben Wauters 2025-08-18 588 struct drm_plane_state *old_state = drm_atomic_get_old_plane_state(atomic_state, plane);
73cfd166e04576 Ruben Wauters 2025-08-18 589 struct drm_plane_state *new_state = drm_atomic_get_new_plane_state(atomic_state, plane);
73cfd166e04576 Ruben Wauters 2025-08-18 590 struct drm_shadow_plane_state *shadow_plane_state = to_drm_shadow_plane_state(new_state);
73cfd166e04576 Ruben Wauters 2025-08-18 591 struct drm_framebuffer *fb = new_state->fb;
73cfd166e04576 Ruben Wauters 2025-08-18 592 struct drm_crtc *crtc = new_state->crtc;
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 593 struct drm_rect damage;
73cfd166e04576 Ruben Wauters 2025-08-18 594 struct drm_atomic_helper_damage_iter iter;
c17d048609bf09 Noralf Trønnes 2022-11-30 595 int ret, idx;
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 596
dc2d5ddb193e36 Shenghao Yang 2025-12-31 @597 if (!crtc || crtc->state->mode_changed || !crtc->state->enable) {
^^^^
Check for NULL
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 598 cancel_work_sync(&gdrm->work);
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 599 mutex_lock(&gdrm->damage_lock);
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 600 if (gdrm->fb) {
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 601 drm_framebuffer_put(gdrm->fb);
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 602 gdrm->fb = NULL;
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 603 }
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 604 gud_clear_damage(gdrm);
c17d048609bf09 Noralf Trønnes 2022-11-30 605 vfree(gdrm->shadow_buf);
c17d048609bf09 Noralf Trønnes 2022-11-30 606 gdrm->shadow_buf = NULL;
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 607 mutex_unlock(&gdrm->damage_lock);
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 608 }
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 609
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 610 if (!drm_dev_enter(drm, &idx))
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 611 return;
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 612
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 613 if (!old_state->fb)
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 614 gud_usb_set_u8(gdrm, GUD_REQ_SET_CONTROLLER_ENABLE, 1);
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 615
40e1a70b4aedf2 Noralf Trønnes 2021-03-13 @616 if (fb && (crtc->state->mode_changed || crtc->state->connectors_changed))
^^^^ ^^^^
Unchecked dereferences.
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-01-14 13:22 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-14 13:22 kernel test robot [this message]
2026-01-18 11:40 ` [linux-next:master 5767/6121] drivers/gpu/drm/gud/gud_pipe.c:616 gud_plane_atomic_update() error: we previously assumed 'crtc' could be null (see line 597) Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202601142159.0v8ilfVs-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.