Re: [PATCH v2 05/13] drm/tilcdc: Switch to drm_atomic_helper_crtc_create_state

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unconditional dereference of potentially NULL crtc->helper_private pointer when checking for the hw_reset hook.
--

commit 64d66423bd9e9cda8a92c70fb8fec4016d121ea0
Author: Maxime Ripard <mripard@kernel.org>

drm/tilcdc: Switch to drm_atomic_helper_crtc_create_state

The tilcdc crtc implementation uses the deprecated
drm_atomic_helper_crtc_reset() as its reset hook.

Switch to drm_atomic_helper_crtc_create_state() instead.

> diff --git a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
> index b299d73ce3856..f619b7a6e70d9 100644
> --- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
> +++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
> @@ -714,7 +714,7 @@ static void tilcdc_crtc_hw_reset(struct drm_crtc *crtc)
>  static const struct drm_crtc_funcs tilcdc_crtc_funcs = {
>  	.set_config     = drm_atomic_helper_set_config,
>  	.page_flip      = drm_atomic_helper_page_flip,
> -	.reset		= drm_atomic_helper_crtc_reset,
> +	.atomic_create_state = drm_atomic_helper_crtc_create_state,

[Severity: High]
Does this change expose a NULL pointer dereference in the core DRM API?

By switching to .atomic_create_state, drm_mode_config_reset() will now call
drm_mode_config_crtc_reset_with_create_state() during driver probe or
system resume.

Looking at drm_mode_config_crtc_reset_with_create_state() in
drivers/gpu/drm/drm_mode_config.c:

drm_mode_config_crtc_reset_with_create_state() {
	const struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
	...
	if (crtc_funcs->hw_reset)
		crtc_funcs->hw_reset(crtc);

	return 0;
}

The crtc_funcs pointer is dereferenced here without a preceding NULL guard. 
If a driver does not use CRTC helpers, crtc->helper_private will be NULL. 
Wouldn't this unconditional dereference to check for hw_reset lead to a 
crash for any driver leaving helper_private unpopulated?

>  	.atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state,
>  	.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
>  	.enable_vblank	= tilcdc_crtc_enable_vblank,
>  	.disable_vblank	= tilcdc_crtc_disable_vblank,
>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-drm-no-more-crtc-reset-v2-0-4500d49a337f@kernel.org?part=5