Re: [PATCH 46/60] drm/mediatek: Convert to atomic_create_state

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing NULL check in `mtk_plane_duplicate_state` leads to a kernel panic if state allocation fails during reset.
--

--- Patch [46]: [PATCH 46/60] drm/mediatek: Convert to atomic_create_state ---
commit 867713cd832a2d719c2c0ff993878555b5315739
Author: Maxime Ripard <mripard@kernel.org>

drm/mediatek: Convert to atomic_create_state

The plane reset implementation creates a custom state subclass, but only
initializes a pristine state without resetting any hardware. This is
equivalent to what atomic_create_state expects. Convert to it.

> diff --git a/drivers/gpu/drm/mediatek/mtk_plane.c b/drivers/gpu/drm/mediatek/mtk_plane.c
> index 2598c8edb443d..2a40d72d241e0 100644
> --- a/drivers/gpu/drm/mediatek/mtk_plane.c
> +++ b/drivers/gpu/drm/mediatek/mtk_plane.c
> @@ -25,26 +25,20 @@ static const u64 modifiers[] = {
>  	DRM_FORMAT_MOD_INVALID,
>  };
>  
> -static void mtk_plane_reset(struct drm_plane *plane)
> +static struct drm_plane_state *mtk_plane_create_state(struct drm_plane *plane)
>  {
>  	struct mtk_plane_state *state;
> +	state = kzalloc_obj(*state);
> +	if (!state)
> +		return ERR_PTR(-ENOMEM);

[Severity: High]
This is a pre-existing issue, but if mtk_plane_create_state() fails here
during drm_mode_config_reset(), plane->state is left as NULL.

When userspace later performs an atomic commit, does this lead to a NULL
pointer dereference in mtk_plane_duplicate_state()?

If we look at mtk_plane_duplicate_state() in the same file:

	struct mtk_plane_state *old_state = to_mtk_plane_state(plane->state);
	...
	state->pending = old_state->pending;

Since old_state is NULL, it looks like this will cause a kernel panic. Should
a NULL check be added to mtk_plane_duplicate_state() to handle this case?

>  
> -	if (plane->state) {
> -		__drm_atomic_helper_plane_destroy_state(plane->state);
> -
> -		state = to_mtk_plane_state(plane->state);
> -		memset(state, 0, sizeof(*state));
> -	} else {
> -		state = kzalloc_obj(*state);
> -		if (!state)
> -			return;
> -	}
> -
> -	__drm_atomic_helper_plane_reset(plane, &state->base);
> +	__drm_atomic_helper_plane_state_init(&state->base, plane);
>  
>  	state->base.plane = plane;
>  	state->pending.format = DRM_FORMAT_RGB565;
>  	state->pending.modifier = DRM_FORMAT_MOD_LINEAR;
> +
> +	return &state->base;
>  }

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709-drm-no-more-plane-reset-v1-0-302d986fe5f0@kernel.org?part=46