* [PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
@ 2026-08-19 6:56 Haojie Li
2026-08-25 6:23 ` CK Hu (胡俊光)
0 siblings, 1 reply; 4+ messages in thread
From: Haojie Li @ 2026-08-19 6:56 UTC (permalink / raw)
To: chunkuang.hu, p.zabel
Cc: dri-devel, linux-kernel, stable, linux-mediatek, Haojie Li
platform_device_register_data() can fail and return an ERR_PTR, but the
return value is used without checking, leading to an invalid pointer
being stored in ddp_comp[].dev and passed to component_match_add() and
mtk_ddp_comp_init(), which could result in a kernel crash.
Add an IS_ERR() check to jump to the error handling path on failure.
Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195")
Cc: stable@vger.kernel.org
Signed-off-by: Haojie Li <lihaojie@kylinos.cn>
---
drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index c86a3f54f35b..667d7fdbfbac 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -1112,6 +1112,10 @@ static int mtk_drm_probe(struct platform_device *pdev)
PLATFORM_DEVID_AUTO,
(void *)private->mmsys_dev,
sizeof(*private->mmsys_dev));
+ if (IS_ERR(ovl_adaptor)) {
+ ret = PTR_ERR(ovl_adaptor);
+ goto err_node;
+ }
private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev = &ovl_adaptor->dev;
mtk_ddp_comp_init(dev, NULL, &private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR],
DDP_COMPONENT_DRM_OVL_ADAPTOR);
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
2026-08-19 6:56 [PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device Haojie Li
@ 2026-08-25 6:23 ` CK Hu (胡俊光)
2026-08-25 10:08 ` [PATCH v2] " Haojie Li
0 siblings, 1 reply; 4+ messages in thread
From: CK Hu (胡俊光) @ 2026-08-25 6:23 UTC (permalink / raw)
To: p.zabel@pengutronix.de, lihaojie@kylinos.cn,
chunkuang.hu@kernel.org
Cc: dri-devel@lists.freedesktop.org,
linux-mediatek@lists.infradead.org, stable@vger.kernel.org,
linux-kernel@vger.kernel.org
Hi, Haojie:
On Wed, 2026-08-19 at 14:56 +0800, Haojie Li wrote:
> External email : Please do not click links or open attachments until you have verified the sender or the content.
>
>
> platform_device_register_data() can fail and return an ERR_PTR, but the
> return value is used without checking, leading to an invalid pointer
> being stored in ddp_comp[].dev and passed to component_match_add() and
> mtk_ddp_comp_init(), which could result in a kernel crash.
>
> Add an IS_ERR() check to jump to the error handling path on failure.
>
> Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haojie Li <lihaojie@kylinos.cn>
> ---
> drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index c86a3f54f35b..667d7fdbfbac 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -1112,6 +1112,10 @@ static int mtk_drm_probe(struct platform_device *pdev)
> PLATFORM_DEVID_AUTO,
> (void *)private->mmsys_dev,
> sizeof(*private->mmsys_dev));
> + if (IS_ERR(ovl_adaptor)) {
> + ret = PTR_ERR(ovl_adaptor);
> + goto err_node;
return PTR_ERR(ovl_adaptor);
Regards,
CK
> + }
> private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev = &ovl_adaptor->dev;
> mtk_ddp_comp_init(dev, NULL, &private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR],
> DDP_COMPONENT_DRM_OVL_ADAPTOR);
> --
> 2.25.1
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH v2] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
2026-08-25 6:23 ` CK Hu (胡俊光)
@ 2026-08-25 10:08 ` Haojie Li
2026-08-26 6:50 ` CK Hu (胡俊光)
0 siblings, 1 reply; 4+ messages in thread
From: Haojie Li @ 2026-08-25 10:08 UTC (permalink / raw)
To: ck.hu
Cc: chunkuang.hu, dri-devel, lihaojie, linux-kernel, linux-mediatek,
p.zabel, stable
platform_device_register_data() can fail and return an ERR_PTR, but the
return value is used without checking, leading to an invalid pointer
being stored in ddp_comp[].dev and passed to component_match_add() and
mtk_ddp_comp_init(), which could result in a kernel crash.
Add an IS_ERR() check to jump to the error handling path on failure.
Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195")
Cc: stable@vger.kernel.org
Signed-off-by: Haojie Li <lihaojie@kylinos.cn>
---
drivers/gpu/drm/mediatek/mtk_drm_drv.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index c86a3f54f35b..b281482ab8c8 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -1112,6 +1112,9 @@ static int mtk_drm_probe(struct platform_device *pdev)
PLATFORM_DEVID_AUTO,
(void *)private->mmsys_dev,
sizeof(*private->mmsys_dev));
+ if (IS_ERR(ovl_adaptor))
+ return PTR_ERR(ovl_adaptor);
+
private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev = &ovl_adaptor->dev;
mtk_ddp_comp_init(dev, NULL, &private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR],
DDP_COMPONENT_DRM_OVL_ADAPTOR);
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH v2] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
2026-08-25 10:08 ` [PATCH v2] " Haojie Li
@ 2026-08-26 6:50 ` CK Hu (胡俊光)
0 siblings, 0 replies; 4+ messages in thread
From: CK Hu (胡俊光) @ 2026-08-26 6:50 UTC (permalink / raw)
To: lihaojie@kylinos.cn
Cc: dri-devel@lists.freedesktop.org,
linux-mediatek@lists.infradead.org, chunkuang.hu@kernel.org,
p.zabel@pengutronix.de, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
On Tue, 2026-08-25 at 18:08 +0800, Haojie Li wrote:
> External email : Please do not click links or open attachments until you have verified the sender or the content.
>
>
> platform_device_register_data() can fail and return an ERR_PTR, but the
> return value is used without checking, leading to an invalid pointer
> being stored in ddp_comp[].dev and passed to component_match_add() and
> mtk_ddp_comp_init(), which could result in a kernel crash.
>
> Add an IS_ERR() check to jump to the error handling path on failure.
Reviewed-by: CK Hu <ck.hu@mediatek.com>
>
> Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haojie Li <lihaojie@kylinos.cn>
> ---
> drivers/gpu/drm/mediatek/mtk_drm_drv.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index c86a3f54f35b..b281482ab8c8 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -1112,6 +1112,9 @@ static int mtk_drm_probe(struct platform_device *pdev)
> PLATFORM_DEVID_AUTO,
> (void *)private->mmsys_dev,
> sizeof(*private->mmsys_dev));
> + if (IS_ERR(ovl_adaptor))
> + return PTR_ERR(ovl_adaptor);
> +
> private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev = &ovl_adaptor->dev;
> mtk_ddp_comp_init(dev, NULL, &private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR],
> DDP_COMPONENT_DRM_OVL_ADAPTOR);
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-08-26 6:50 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-19 6:56 [PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device Haojie Li
2026-08-25 6:23 ` CK Hu (胡俊光)
2026-08-25 10:08 ` [PATCH v2] " Haojie Li
2026-08-26 6:50 ` CK Hu (胡俊光)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox