Re: [PATCH v3 05/40] drm/fsl-dcu: Convert to atomic_create_state

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] NULL pointer dereference in fsl_dcu_drm_primary_create_plane() error path.
--

commit 9167a24528f8ea634b64f0e356c2b60880610b79
Author: Maxime Ripard <mripard@kernel.org>

drm/fsl-dcu: Convert to atomic_create_state

This commit uses a Coccinelle semantic patch to rename the .reset hook in
drm_plane_funcs to .atomic_create_state, aligning with standard DRM state
creation expectations.

> diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
> index b34f880c1e098..92794b337512c 100644
> --- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
> +++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
> @@ -177,7 +177,7 @@ static const struct drm_plane_funcs fsl_dcu_drm_plane_funcs = {
>  	.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
>  	.destroy = drm_plane_helper_destroy,
>  	.disable_plane = drm_atomic_helper_disable_plane,
> -	.reset = drm_atomic_helper_plane_reset,
> +	.atomic_create_state = drm_atomic_helper_plane_create_state,
>  	.update_plane = drm_atomic_helper_update_plane,
>  };

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing the changes 
to fsl_dcu_drm_plane_funcs, I noticed a pre-existing issue in the same file.

Can this lead to a NULL pointer dereference in the error path of
fsl_dcu_drm_primary_create_plane()?

If drm_universal_plane_init() fails, primary is freed and set to NULL,
but the execution then proceeds to call drm_plane_helper_add() with the
NULL primary pointer:

drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c:fsl_dcu_drm_primary_create_plane() {
	...
	ret = drm_universal_plane_init(dev, primary, 0,
				       &fsl_dcu_drm_plane_funcs,
				       ...
				       NULL, DRM_PLANE_TYPE_PRIMARY, NULL);
	if (ret) {
		kfree(primary);
		primary = NULL;
	}
	drm_plane_helper_add(primary, &fsl_dcu_drm_plane_helper_funcs);
	...
}

Would it be better to return NULL immediately after freeing primary?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-drm-no-more-plane-reset-v3-0-1877c7aa57b3@kernel.org?part=5