[PATCH] drm/i915/display: fix error handling in intel_display_driver_probe_noirq

[PATCH] drm/i915/display: fix error handling in intel_display_driver_probe_noirq

[yaolu]

From: Lu Yao <yaolu@kylinos.cn>

Fix two bugs in the probe error path:

1. intel_dmc_fini() was called on workqueue alloc failed paths but
   intel_dmc_init() had been invoked.  Move the dmc init call advance.

2. If intel_mode_config_init() succeeded, after intel_xxx_init()
   failed leaked the resources allocated by drm_mode_config_init().
   Add a cleanup_mode_config label.

Signed-off-by: Lu Yao <yaolu@kylinos.cn>
---
 .../drm/i915/display/intel_display_driver.c    | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/i915/display/intel_display_driver.c b/drivers/gpu/drm/i915/display/intel_display_driver.c
index d0729936f681..d69bdfb19efe 100644
--- a/drivers/gpu/drm/i915/display/intel_display_driver.c
+++ b/drivers/gpu/drm/i915/display/intel_display_driver.c
@@ -223,6 +223,8 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
 	if (!HAS_DISPLAY(display))
 		return 0;
 
+	intel_dmc_init(display);
+
 	display->hotplug.dp_wq = alloc_ordered_workqueue("intel-dp", 0);
 	if (!display->hotplug.dp_wq) {
 		ret = -ENOMEM;
@@ -254,33 +256,31 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
 		goto cleanup_wq_cleanup;
 	}
 
-	intel_dmc_init(display);
-
 	intel_mode_config_init(display);
 
 	ret = intel_cdclk_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_color_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_dbuf_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_dbuf_bw_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_bw_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_pmdemand_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	intel_init_quirks(display);
 
@@ -288,6 +288,8 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
 
 	return 0;
 
+cleanup_mode_config:
+	intel_mode_config_cleanup(display);
 cleanup_wq_unordered:
 	destroy_workqueue(display->wq.unordered);
 cleanup_wq_cleanup:
-- 
2.25.1

Re: [PATCH] drm/i915/display: fix error handling in intel_display_driver_probe_noirq

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Moving `intel_dmc_init()` before workqueue allocations causes a deterministic NULL pointer dereference in `queue_work()` during device probe.
--

commit ae307def86c4a6f405ddfe4fec9bd326757af84d
Author: Lu Yao <yaolu@kylinos.cn>
Subject: drm/i915/display: fix error handling in intel_display_driver_probe_noirq

This commit modifies the error handling path during display driver probe by
moving the intel_dmc_init call earlier and introducing a cleanup label for
intel_mode_config_init.

> diff --git a/drivers/gpu/drm/i915/display/intel_display_driver.c b/drivers/gpu/drm/i915/display/intel_display_driver.c
> index d0729936f6816..d69bdfb19efe5 100644
> --- a/drivers/gpu/drm/i915/display/intel_display_driver.c
> +++ b/drivers/gpu/drm/i915/display/intel_display_driver.c
> @@ -223,6 +223,8 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
>  	if (!HAS_DISPLAY(display))
>  		return 0;
>  
> +	intel_dmc_init(display);
> +

[Severity: High]
Does this cause a NULL pointer dereference during device probe?

Looking at intel_dmc_init() in intel_dmc.c, it attempts to queue work on the
unordered workqueue:

void intel_dmc_init(struct intel_display *display)
{
    ...
    queue_work(display->wq.unordered, &dmc->work);
    ...
}

However, display->wq.unordered is allocated further down in this function,
so it appears it will be NULL when intel_dmc_init() is called here.

>  	display->hotplug.dp_wq = alloc_ordered_workqueue("intel-dp", 0);
>  	if (!display->hotplug.dp_wq) {
>  		ret = -ENOMEM;
[ ... ]
> @@ -254,33 +256,31 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
>  		goto cleanup_wq_cleanup;
>  	}
>  
> -	intel_dmc_init(display);
> -
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630031652.67747-1-yaolu@kylinos.cn?part=1

Re: [PATCH] drm/i915/display: fix error handling in intel_display_driver_probe_noirq

[Jani Nikula]

On Tue, 30 Jun 2026, yaolu@kylinos.cn wrote:
> From: Lu Yao <yaolu@kylinos.cn>
>
> Fix two bugs in the probe error path:
>
> 1. intel_dmc_fini() was called on workqueue alloc failed paths but
>    intel_dmc_init() had been invoked.  Move the dmc init call advance.

You can't move intel_dmc_init() before the wq allocation.

BR,
Jani.

>
> 2. If intel_mode_config_init() succeeded, after intel_xxx_init()
>    failed leaked the resources allocated by drm_mode_config_init().
>    Add a cleanup_mode_config label.
>
> Signed-off-by: Lu Yao <yaolu@kylinos.cn>
> ---
>  .../drm/i915/display/intel_display_driver.c    | 18 ++++++++++--------
>  1 file changed, 10 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_display_driver.c b/drivers/gpu/drm/i915/display/intel_display_driver.c
> index d0729936f681..d69bdfb19efe 100644
> --- a/drivers/gpu/drm/i915/display/intel_display_driver.c
> +++ b/drivers/gpu/drm/i915/display/intel_display_driver.c
> @@ -223,6 +223,8 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
>  	if (!HAS_DISPLAY(display))
>  		return 0;
>  
> +	intel_dmc_init(display);
> +
>  	display->hotplug.dp_wq = alloc_ordered_workqueue("intel-dp", 0);
>  	if (!display->hotplug.dp_wq) {
>  		ret = -ENOMEM;
> @@ -254,33 +256,31 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
>  		goto cleanup_wq_cleanup;
>  	}
>  
> -	intel_dmc_init(display);
> -
>  	intel_mode_config_init(display);
>  
>  	ret = intel_cdclk_init(display);
>  	if (ret)
> -		goto cleanup_wq_unordered;
> +		goto cleanup_mode_config;
>  
>  	ret = intel_color_init(display);
>  	if (ret)
> -		goto cleanup_wq_unordered;
> +		goto cleanup_mode_config;
>  
>  	ret = intel_dbuf_init(display);
>  	if (ret)
> -		goto cleanup_wq_unordered;
> +		goto cleanup_mode_config;
>  
>  	ret = intel_dbuf_bw_init(display);
>  	if (ret)
> -		goto cleanup_wq_unordered;
> +		goto cleanup_mode_config;
>  
>  	ret = intel_bw_init(display);
>  	if (ret)
> -		goto cleanup_wq_unordered;
> +		goto cleanup_mode_config;
>  
>  	ret = intel_pmdemand_init(display);
>  	if (ret)
> -		goto cleanup_wq_unordered;
> +		goto cleanup_mode_config;
>  
>  	intel_init_quirks(display);
>  
> @@ -288,6 +288,8 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
>  
>  	return 0;
>  
> +cleanup_mode_config:
> +	intel_mode_config_cleanup(display);
>  cleanup_wq_unordered:
>  	destroy_workqueue(display->wq.unordered);
>  cleanup_wq_cleanup:

-- 
Jani Nikula, Intel

[PATCH v2] drm/i915/display: fix error handling in intel_display_driver_probe_noirq

[yaolu]

From: Lu Yao <yaolu@kylinos.cn>

Fix two bugs in the probe error path:

1. If intel_mode_config_init() succeeded, after intel_xxx_init()
   failed leaked the resources allocated by drm_mode_config_init().
   Add a cleanup_mode_config label.

2. intel_dmc_fini() was called on workqueue alloc failed paths but
   intel_dmc_init() don't been invoked.  Move the dmc fini call in
   cleanup_mode_config label.

Signed-off-by: Lu Yao <yaolu@kylinos.cn>
---
v1->v2: don't move intel_dmc_init() advance
  chencked by Sashiko AI and Jani
  Link: https://lore.kernel.org/all/20260630032254.05B511F000E9@smtp.kernel.org/
  Link: https://lore.kernel.org/all/677fb92771df1f9f491226bf006c157a007c16dc@intel.com/

 .../drm/i915/display/intel_display_driver.c   | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/i915/display/intel_display_driver.c b/drivers/gpu/drm/i915/display/intel_display_driver.c
index d0729936f681..01770847fbdf 100644
--- a/drivers/gpu/drm/i915/display/intel_display_driver.c
+++ b/drivers/gpu/drm/i915/display/intel_display_driver.c
@@ -226,7 +226,7 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
 	display->hotplug.dp_wq = alloc_ordered_workqueue("intel-dp", 0);
 	if (!display->hotplug.dp_wq) {
 		ret = -ENOMEM;
-		goto cleanup_pw_domain_dmc;
+		goto cleanup_pw_domain;
 	}
 
 	display->wq.modeset = alloc_ordered_workqueue("i915_modeset", 0);
@@ -260,27 +260,27 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
 
 	ret = intel_cdclk_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_color_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_dbuf_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_dbuf_bw_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_bw_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_pmdemand_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	intel_init_quirks(display);
 
@@ -288,6 +288,9 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
 
 	return 0;
 
+cleanup_mode_config:
+	intel_mode_config_cleanup(display);
+	intel_dmc_fini(display);
 cleanup_wq_unordered:
 	destroy_workqueue(display->wq.unordered);
 cleanup_wq_cleanup:
@@ -298,8 +301,7 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
 	destroy_workqueue(display->wq.modeset);
 cleanup_wq_dp:
 	destroy_workqueue(display->hotplug.dp_wq);
-cleanup_pw_domain_dmc:
-	intel_dmc_fini(display);
+cleanup_pw_domain:
 	intel_display_power_driver_remove(display);
 cleanup_bios:
 	intel_bios_driver_remove(display);
-- 
2.25.1

[PATCH v3] drm/i915/display: fix error handling in intel_display_driver_probe_noirq

[yaolu]

From: Lu Yao <yaolu@kylinos.cn>

Fix two bugs in the probe error path:

1. If intel_mode_config_init() succeeded, after intel_xxx_init()
   failed leaked the resources allocated by drm_mode_config_init().
   Add a cleanup_mode_config label.

2. intel_dmc_fini() was called on workqueue alloc failed paths but
   intel_dmc_init() don't been invoked.  Move the dmc fini call in
   cleanup_mode_config label.

Signed-off-by: Lu Yao <yaolu@kylinos.cn>
---
v2->v3: rm unused label checked by CI
  Link: https://lore.kernel.org/all/178294904225.140838.18311548714090230092@6beec6c84f66/

v1->v2: don't move intel_dmc_init() advance chencked by Sashiko AI and Jani
  Link: https://lore.kernel.org/all/20260630032254.05B511F000E9@smtp.kernel.org/
  Link: https://lore.kernel.org/all/677fb92771df1f9f491226bf006c157a007c16dc@intel.com/

 .../drm/i915/display/intel_display_driver.c   | 21 ++++++++++---------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/i915/display/intel_display_driver.c b/drivers/gpu/drm/i915/display/intel_display_driver.c
index d0729936f681..4af2324f5252 100644
--- a/drivers/gpu/drm/i915/display/intel_display_driver.c
+++ b/drivers/gpu/drm/i915/display/intel_display_driver.c
@@ -226,7 +226,7 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
 	display->hotplug.dp_wq = alloc_ordered_workqueue("intel-dp", 0);
 	if (!display->hotplug.dp_wq) {
 		ret = -ENOMEM;
-		goto cleanup_pw_domain_dmc;
+		goto cleanup_pw_domain;
 	}
 
 	display->wq.modeset = alloc_ordered_workqueue("i915_modeset", 0);
@@ -260,27 +260,27 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
 
 	ret = intel_cdclk_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_color_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_dbuf_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_dbuf_bw_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_bw_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	ret = intel_pmdemand_init(display);
 	if (ret)
-		goto cleanup_wq_unordered;
+		goto cleanup_mode_config;
 
 	intel_init_quirks(display);
 
@@ -288,7 +288,9 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
 
 	return 0;
 
-cleanup_wq_unordered:
+cleanup_mode_config:
+	intel_mode_config_cleanup(display);
+	intel_dmc_fini(display);
 	destroy_workqueue(display->wq.unordered);
 cleanup_wq_cleanup:
 	destroy_workqueue(display->wq.cleanup);
@@ -298,8 +300,7 @@ int intel_display_driver_probe_noirq(struct intel_display *display)
 	destroy_workqueue(display->wq.modeset);
 cleanup_wq_dp:
 	destroy_workqueue(display->hotplug.dp_wq);
-cleanup_pw_domain_dmc:
-	intel_dmc_fini(display);
+cleanup_pw_domain:
 	intel_display_power_driver_remove(display);
 cleanup_bios:
 	intel_bios_driver_remove(display);
-- 
2.25.1