* [PATCH] drm/imx: Fix ipu_plane_duplicate_state() OOM handling
@ 2026-07-06 14:02 Osama Abdelkader
2026-07-08 20:21 ` [PATCH v2] " Osama Abdelkader
0 siblings, 1 reply; 2+ messages in thread
From: Osama Abdelkader @ 2026-07-06 14:02 UTC (permalink / raw)
To: Philipp Zabel, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Frank Li,
Sascha Hauer, Pengutronix Kernel Team, Fabio Estevam, dri-devel,
imx, linux-arm-kernel, linux-kernel
Cc: Osama Abdelkader
If kmalloc fails, with state == NULL &state->base dereference NULL
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
---
drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c
index c7ec09e557c1..67f2da7f2b65 100644
--- a/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c
@@ -323,9 +323,10 @@ ipu_plane_duplicate_state(struct drm_plane *plane)
return NULL;
state = kmalloc_obj(*state);
- if (state)
- __drm_atomic_helper_plane_duplicate_state(plane, &state->base);
+ if (!state)
+ return NULL;
+ __drm_atomic_helper_plane_duplicate_state(plane, &state->base);
return &state->base;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [PATCH v2] drm/imx: Fix ipu_plane_duplicate_state() OOM handling
2026-07-06 14:02 [PATCH] drm/imx: Fix ipu_plane_duplicate_state() OOM handling Osama Abdelkader
@ 2026-07-08 20:21 ` Osama Abdelkader
0 siblings, 0 replies; 2+ messages in thread
From: Osama Abdelkader @ 2026-07-08 20:21 UTC (permalink / raw)
To: Philipp Zabel, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Frank Li,
Sascha Hauer, Pengutronix Kernel Team, Fabio Estevam, Lucas Stach,
dri-devel, imx, linux-arm-kernel, linux-kernel
Cc: Osama Abdelkader, stable
ipu_plane_duplicate_state() could dereference NULL when kmalloc() fails
by returning &state->base unconditionally.
Return NULL on allocation failure, as the CRTC duplicate helper does.
Fixes: 00514e859335 ("drm/imx: use PRG/PRE when possible")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
---
v2:
- add Fixes and Cc tags
---
drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c
index c7ec09e557c1..67f2da7f2b65 100644
--- a/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c
@@ -323,9 +323,10 @@ ipu_plane_duplicate_state(struct drm_plane *plane)
return NULL;
state = kmalloc_obj(*state);
- if (state)
- __drm_atomic_helper_plane_duplicate_state(plane, &state->base);
+ if (!state)
+ return NULL;
+ __drm_atomic_helper_plane_duplicate_state(plane, &state->base);
return &state->base;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-07-08 20:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-06 14:02 [PATCH] drm/imx: Fix ipu_plane_duplicate_state() OOM handling Osama Abdelkader
2026-07-08 20:21 ` [PATCH v2] " Osama Abdelkader
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox