From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7675749F13C; Tue, 1 Sep 2026 18:50:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788288647; cv=none; b=c93oHqllDWANHswWJziy0V3M6hTUKVtpKgcR8+nanS873Ja5XTqbBiSc1lE7RoFYqmL40rrBYTfh3zUMsowAcEde5y/wYVLJHM+v6/M8Po7rFHDLg8E5B67rH2QuLn7JIFBYDkiDe/oFlslT6VBXtBO9ArsSyBiT20ni1LbnqMI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788288647; c=relaxed/simple; bh=eu1KlSlWXqhbiSpgzVzFIDL33AEwWbq34A898vzWv2U=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=QtrxPxqthYmM4WYRrzrvZpdwQLYAxPW0aaacluAie6kencdDsvNpYnNq9vdGNaAsdIV8Z3qyiefy+aa3fFDln5JlDR6+hy3Tbx6ga7IOTbpuJ1/UnqL7+eool8gSB+D9KnGah4JTXYd89EqACp2rBUQLN06MNlgSlxjC0dFyIAs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=RVeepdB0; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="RVeepdB0" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1788288642; bh=eu1KlSlWXqhbiSpgzVzFIDL33AEwWbq34A898vzWv2U=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=RVeepdB0Bcueu2yR6HxUoRZoMXRJ6Wle8Ow5IFxiJnxIwLz75sII6M0a0TUCrYZ7b bOR8K5WmFYV6wb0TIAmyZhGrTEDaKVpDjYCK5VaaNpwaFqEHhgts7SetkZ5cZb0hjA WFZzDxQkpoE+8BIxH+Guem+EVr6+aO8dfmUWfcyM7Wj62odW40iFHqCYdkStdsK4Wq hXCgWTAoNK8OgoeHtZusz0Ns4lAvfKf12e6WXy5tKTyDGRAh5BPk1t5oORQ0G0h1eZ T/l9T8qtD9uRUJs5oskv5BSW/3NNrJvMhls8bVNzmnRGpBttx9M9i8dIWUfILO6nGt rT+hRBkU4rmrA== Received: from localhost (unknown [100.64.0.241]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange secp256r1 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: cristicc) by bali.collaboradmins.com (Postfix) with ESMTPSA id 92CA817E0934; Tue, 01 Sep 2026 20:50:42 +0200 (CEST) From: Cristian Ciocaltea Date: Tue, 01 Sep 2026 21:50:26 +0300 Subject: [PATCH v11 02/74] drm/connector: hdmi: Handle reset() state allocation failure Precedence: bulk X-Mailing-List: linux-fbdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260901-dw-hdmi-qp-scramb-v11-2-bc12954a0688@collabora.com> References: <20260901-dw-hdmi-qp-scramb-v11-0-bc12954a0688@collabora.com> In-Reply-To: <20260901-dw-hdmi-qp-scramb-v11-0-bc12954a0688@collabora.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dave Stevenson , Dmitry Baryshkov , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Luca Ceresoli , Chen-Yu Tsai , Samuel Holland , =?utf-8?q?Ma=C3=ADra_Canal?= , Raspberry Pi Kernel Maintenance , Raphael Gallais-Pou , Sandy Huang , =?utf-8?q?Heiko_St=C3=BCbner?= , Andy Yan , Algea Cao , Daniel Stone , Liu Ying , Phong LE , Helge Deller Cc: kernel@collabora.com, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-rockchip@lists.infradead.org, linux-fbdev@vger.kernel.org, Sashiko X-Mailer: b4 0.15.2 In drmm_connector_hdmi_init(), if the reset callback fails to allocate memory, e.g. inside drm_atomic_helper_connector_reset(), connector->state will remain NULL. This is unconditionally passed to drm_connector_attach_max_bpc_property(), leading to a NULL pointer dereference. Bail out with -ENOMEM if the reset callback leaves connector->state unset. Fixes: aadb3e16b8f3 ("drm/connector: hdmi: Add output BPC to the connector state") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260723015306.C94241F000E9@smtp.kernel.org/ Link: https://lore.kernel.org/all/20260723015306.C94241F000E9@smtp.kernel.org/ Reviewed-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea --- drivers/gpu/drm/drm_connector.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c index 8b4baed060f3..0e39431e85b2 100644 --- a/drivers/gpu/drm/drm_connector.c +++ b/drivers/gpu/drm/drm_connector.c @@ -628,6 +628,8 @@ int drmm_connector_hdmi_init(struct drm_device *dev, connector->state = state; } else if (connector->funcs->reset) { connector->funcs->reset(connector); + if (!connector->state) + return -ENOMEM; } drm_connector_attach_max_bpc_property(connector, 8, max_bpc); -- 2.55.0