[PATCH] drm/panthor: Fix NULL pointer dereference in sync signal cleanup

[PATCH] drm/panthor: Fix NULL pointer dereference in sync signal cleanup

[Tuo Li]

In panthor_submit_ctx_add_sync_signal(), drm_syncobj_find() may return
NULL. The function then jumps to err_free_sig_sync, where
panthor_sync_signal_free() unconditionally calls drm_syncobj_put() on
the NULL pointer, causing a NULL pointer dereference.

Check sig_sync->syncobj before calling drm_syncobj_put() to avoid the
NULL pointer dereference.

Fixes: 4bdca1150792 ("drm/panthor: Add the driver frontend block")
Signed-off-by: Tuo Li <islituo@gmail.com>
---
 drivers/gpu/drm/panthor/panthor_drv.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panthor/panthor_drv.c b/drivers/gpu/drm/panthor/panthor_drv.c
index dc8d0191aef4..8d73956530a8 100644
--- a/drivers/gpu/drm/panthor/panthor_drv.c
+++ b/drivers/gpu/drm/panthor/panthor_drv.c
@@ -364,7 +364,9 @@ panthor_sync_signal_free(struct panthor_sync_signal *sig_sync)
 	if (!sig_sync)
 		return;
 
-	drm_syncobj_put(sig_sync->syncobj);
+	if (sig_sync->syncobj)
+		drm_syncobj_put(sig_sync->syncobj);
+
 	dma_fence_chain_free(sig_sync->chain);
 	dma_fence_put(sig_sync->fence);
 	kfree(sig_sync);
-- 
2.43.0

Re: [PATCH] drm/panthor: Fix NULL pointer dereference in sync signal cleanup

[Boris Brezillon]

On Fri, 13 Nov 2026 17:44:56 +0800
Tuo Li <islituo@gmail.com> wrote:

> In panthor_submit_ctx_add_sync_signal(), drm_syncobj_find() may return
> NULL. The function then jumps to err_free_sig_sync, where
> panthor_sync_signal_free() unconditionally calls drm_syncobj_put() on
> the NULL pointer, causing a NULL pointer dereference.
> 
> Check sig_sync->syncobj before calling drm_syncobj_put() to avoid the
> NULL pointer dereference.

I really wish we had consistent behavior on those _put() helpers. Most
of them check for NULL before calling kref_put(), but some don't,
unfortunately...

> 
> Fixes: 4bdca1150792 ("drm/panthor: Add the driver frontend block")
> Signed-off-by: Tuo Li <islituo@gmail.com>

Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>

> ---
>  drivers/gpu/drm/panthor/panthor_drv.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/panthor/panthor_drv.c b/drivers/gpu/drm/panthor/panthor_drv.c
> index dc8d0191aef4..8d73956530a8 100644
> --- a/drivers/gpu/drm/panthor/panthor_drv.c
> +++ b/drivers/gpu/drm/panthor/panthor_drv.c
> @@ -364,7 +364,9 @@ panthor_sync_signal_free(struct panthor_sync_signal *sig_sync)
>  	if (!sig_sync)
>  		return;
>  
> -	drm_syncobj_put(sig_sync->syncobj);
> +	if (sig_sync->syncobj)
> +		drm_syncobj_put(sig_sync->syncobj);
> +
>  	dma_fence_chain_free(sig_sync->chain);
>  	dma_fence_put(sig_sync->fence);
>  	kfree(sig_sync);