Re: [PATCH v7 18/35] drm/msm/dp: introduce dp_mst_drm module

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/msm/dpu: NULL pointer dereference in dpu_kms_destroy() during error paths
--

commit a4f8ebdb83ba4326d66366d808a6aed47be384e3
Author: Yongxing Mou <yongxing.mou@oss.qualcomm.com>

drm/msm/dp: introduce dp_mst_drm module

This commit adds the dp_mst_drm module and the core MST manager data
structures. It introduces the MST manager object, per-stream encoder state,
and the registration hooks used to initialize and destroy the MST manager
during DP device setup.

> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
> index da3556eb6ecc2..7ee4e7e4d34a3 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
[ ... ]
> @@ -905,6 +915,8 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms)
>  static void dpu_kms_destroy(struct msm_kms *kms)
>  {
>  	struct dpu_kms *dpu_kms;
> +	struct msm_drm_private *priv;
> +	int i;
>  
>  	if (!kms) {
>  		DPU_ERROR("invalid kms\n");
> @@ -912,6 +924,11 @@ static void dpu_kms_destroy(struct msm_kms *kms)
>  	}
>  
>  	dpu_kms = to_dpu_kms(kms);
> +	priv = dpu_kms->dev->dev_private;
> +
> +	for (i = 0; i < ARRAY_SIZE(priv->kms->dp); i++)

[Severity: High]
Does this cause a NULL pointer dereference if initialization fails early?

If msm_kms_init() fails (e.g., if alloc_ordered_workqueue() fails and
returns -ENOMEM), it populates kms->funcs before failure. The failure
propagates up to msm_drm_init(), which then triggers the err_msm_uninit error
path calling msm_drm_kms_uninit().

Because kms->funcs is set, kms->funcs->destroy() (which maps to
dpu_kms_destroy()) is executed. However, dpu_kms->dev is only assigned
after a successful msm_kms_init(), so it remains NULL.

Unconditionally dereferencing dpu_kms->dev to access dev_private here appears
to cause a kernel panic on driver probe error paths.

> +		if (priv->kms->dp[i])
> +			msm_dp_mst_unregister(priv->kms->dp[i]);
>  
>  	_dpu_kms_hw_destroy(dpu_kms);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929-msm-dp-mst-v7-0-4b81473185e7@oss.qualcomm.com?part=18