Re: [PATCH v4 11/13] drm/atomic-uapi: Add DRM_MODE_ATOMIC_RESET flag

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/atomic: TOCTOU race leading to NULL pointer dereference in DRM_MODE_ATOMIC_RESET
--

commit 03ae8ccf607b3a82a4b17b4343d5b86063dc861c
Author: Sebastian Wick <sebastian.wick@redhat.com>
Date:   Fri Sep 18 14:18:00 2026 +0000

    drm/atomic-uapi: Add DRM_MODE_ATOMIC_RESET flag

    This commit introduces the DRM_MODE_ATOMIC_RESET flag for the atomic ioctl.
    When set, it resets all KMS object states to their defaults by dynamically
    allocating and setting default states before applying user properties.

> diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
> index 1eebcf6f5e05b..237c7ff823523 100644
> --- a/drivers/gpu/drm/drm_atomic_uapi.c
> +++ b/drivers/gpu/drm/drm_atomic_uapi.c

[ ... ]

> @@ -1688,6 +1695,17 @@ int drm_mode_atomic_ioctl(struct drm_device *dev,
>  	fence_state = NULL;
>  	num_fences = 0;
>  
> +	if (arg->flags & DRM_MODE_ATOMIC_RESET) {
> +		if (!drm_atomic_implements_create_state(dev)) {
> +			ret = -EOPNOTSUPP;
> +			goto out;
> +		}
> +
> +		ret = drm_atomic_commit_fill_with_defaults(state);

[Severity: High]
Could this lockless check introduce a Time-Of-Check to Time-Of-Use (TOCTOU) race
condition?

The initial validation in drm_atomic_implements_create_state() iterates over the
dynamic connector list without locks. If a hardware hotplug event (such as DP
MST) occurs right after this check returns true, the MST workqueue might
asynchronously add a new connector that lacks the .atomic_create_state hook
(like mst_connector_funcs) without taking connection_mutex.

When drm_atomic_commit_fill_with_defaults(state) is subsequently called, it
will encounter the newly added connector and unconditionally dereference the
missing function pointer:

drivers/gpu/drm/drm_atomic.c:drm_atomic_commit_fill_with_defaults() {
    ...
    drm_for_each_connector_iter(connector, &conn_iter) {
        ...
        connector_state = connector->funcs->atomic_create_state(connector);
        ...
    }
}

Is there a way to protect the connector list during validation, or safely handle
the missing hook during the fill operation to prevent a NULL pointer
dereference?

> +		if (ret)
> +			goto out;
> +	}
> +
>  	for (i = 0; i < arg->count_objs; i++) {
>  		uint32_t obj_id, count_props;
>  		struct drm_mode_object *obj;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918-drm-reset-state-flag-v4-0-5ad106370f05@kernel.org?part=11