* [PATCH] drm/client: Do not destroy NULL modes
@ 2026-02-24 22:12 Jonathan Cavitt
2026-02-25 7:52 ` Ville Syrjälä
0 siblings, 1 reply; 2+ messages in thread
From: Jonathan Cavitt @ 2026-02-24 22:12 UTC (permalink / raw)
To: dri-devel; +Cc: saurabhg.gupta, alex.zuo, jonathan.cavitt, ville.syrjala
'modes' in drm_client_modeset_probe may fail to kcalloc. If this
occurs, we jump to 'out', calling modes_destroy on it, which
dereferences it. This may result in a NULL pointer dereference in the
error case. Prevent that.
Fixes: 3039cc0c0653 ("drm/client: Make copies of modes")
Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
---
drivers/gpu/drm/drm_client_modeset.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c
index 262b1b8773c5..bb49b8361271 100644
--- a/drivers/gpu/drm/drm_client_modeset.c
+++ b/drivers/gpu/drm/drm_client_modeset.c
@@ -930,7 +930,8 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width,
mutex_unlock(&client->modeset_mutex);
out:
kfree(crtcs);
- modes_destroy(dev, modes, connector_count);
+ if (modes)
+ modes_destroy(dev, modes, connector_count);
kfree(modes);
kfree(offsets);
kfree(enabled);
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] drm/client: Do not destroy NULL modes
2026-02-24 22:12 [PATCH] drm/client: Do not destroy NULL modes Jonathan Cavitt
@ 2026-02-25 7:52 ` Ville Syrjälä
0 siblings, 0 replies; 2+ messages in thread
From: Ville Syrjälä @ 2026-02-25 7:52 UTC (permalink / raw)
To: Jonathan Cavitt; +Cc: dri-devel, saurabhg.gupta, alex.zuo
On Tue, Feb 24, 2026 at 10:12:28PM +0000, Jonathan Cavitt wrote:
> 'modes' in drm_client_modeset_probe may fail to kcalloc. If this
> occurs, we jump to 'out', calling modes_destroy on it, which
> dereferences it. This may result in a NULL pointer dereference in the
> error case. Prevent that.
>
> Fixes: 3039cc0c0653 ("drm/client: Make copies of modes")
> Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Thanks. Pushed to drm-misc-fixes.
> ---
> drivers/gpu/drm/drm_client_modeset.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c
> index 262b1b8773c5..bb49b8361271 100644
> --- a/drivers/gpu/drm/drm_client_modeset.c
> +++ b/drivers/gpu/drm/drm_client_modeset.c
> @@ -930,7 +930,8 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width,
> mutex_unlock(&client->modeset_mutex);
> out:
> kfree(crtcs);
> - modes_destroy(dev, modes, connector_count);
> + if (modes)
> + modes_destroy(dev, modes, connector_count);
> kfree(modes);
> kfree(offsets);
> kfree(enabled);
> --
> 2.43.0
--
Ville Syrjälä
Intel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-02-25 7:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-24 22:12 [PATCH] drm/client: Do not destroy NULL modes Jonathan Cavitt
2026-02-25 7:52 ` Ville Syrjälä
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.