From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 625C62BEC4E; Sun, 1 Jun 2025 23:35:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748820913; cv=none; b=q6b24JHqc6+2CUOiW8MDS8F2pLeGBoCMGTlCyHsb/W/fv4Bkj8Uk4SIakzFnWgOb6aKEYlsUoD0AAZytoyC//jgtZqyh0EswcbaBhb8nxUPkr/OyAvxM4b/VMSCOmtRjkDfPuI+YSMxVCElOyMv/i7i8ji4x09ILTn7jYkXartg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748820913; c=relaxed/simple; bh=rEzQeC/387T1OKCa8TxjZy2jNxB42YamcO2hBOW+DiY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version:Content-Type; b=DiPxWORbcc6cfpQtLe3jiSO8vEDkbcoa/xwvfIWvEIgGrRT4Gmro6HxLEyHRUsg10mfh4KcWugxGpszycPHupiBWUVNoLlxBHXD7wSoonMprhG4FXJPOLowr9IzmoLDlhfikPvjpFDh1UP+C7LkynVJBHKBk96728foQR7mNTiM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=HKQNAus4; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="HKQNAus4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0EC31C4CEE7; Sun, 1 Jun 2025 23:35:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1748820913; bh=rEzQeC/387T1OKCa8TxjZy2jNxB42YamcO2hBOW+DiY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HKQNAus4MDTY5odq39ynA4RzQc60hqmW0p2MHJPIguo/xf7ddKv/NFiVacb5WZuX9 6v87bmP5/WJIeiKIfbCFfJIPl6DNJVffxWVycgvLS6lc70g7Fcu3w9YX0AFU/UJ8Ov weuKINJGhrduYVRh8IDRIRRP2JJfSmLQnWfk3d2L2+zEJkbJ9PPGmWA1gBdIBYt1Xh wA5wHrATHwBT5Rjuon3JnEqBCOouVYl+dh5QQBiYMYesyIlY2bN04FIav8t9Q0e7IU SyknbWMsbVqyUWUjwBrgCv121qFUPHYk/4AMEaG9cdHMid88r8DGlBi+0Ezz+eAQEX RNwweJzcbUGSA== From: Sasha Levin To: patches@lists.linux.dev, stable@vger.kernel.org Cc: Srinivasan Shanmugam , Harry Wentland , Nicholas Kazlauskas , Tom Chung , Roman Li , Alex Hung , Aurabindo Pillai , Alex Deucher , Sasha Levin , sunpeng.li@amd.com, christian.koenig@amd.com, airlied@gmail.com, simona@ffwll.ch, mario.limonciello@amd.com, Wayne.Lin@amd.com, dominik.kaszewski@amd.com, mwen@igalia.com, amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [PATCH AUTOSEL 6.12 27/93] drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() Date: Sun, 1 Jun 2025 19:32:54 -0400 Message-Id: <20250601233402.3512823-27-sashal@kernel.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250601233402.3512823-1-sashal@kernel.org> References: <20250601233402.3512823-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.12.31 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Srinivasan Shanmugam [ Upstream commit 3f397cd203f247879c2f1a061e90d4c8d23655de ] This commit updates the dm_force_atomic_commit function to replace the usage of PTR_ERR_OR_ZERO with IS_ERR for checking error states after retrieving the Connector (drm_atomic_get_connector_state), CRTC (drm_atomic_get_crtc_state), and Plane (drm_atomic_get_plane_state) states. The function utilized PTR_ERR_OR_ZERO for error checking. However, this approach is inappropriate in this context because the respective functions do not return NULL; they return pointers that encode errors. This change ensures that error pointers are properly checked using IS_ERR before attempting to dereference. Cc: Harry Wentland Cc: Nicholas Kazlauskas Cc: Tom Chung Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin --- Based on my analysis, here's my assessment: **YES** This commit should be backported to stable kernel trees. Here's my detailed analysis: ## Commit Analysis **1. Bug Fix Nature:** This commit fixes a clear programming error where `PTR_ERR_OR_ZERO()` was incorrectly used to check error pointers returned by `drm_atomic_get_connector_state()`, `drm_atomic_get_crtc_state()`, and `drm_atomic_get_plane_state()`. The commit message clearly states these functions "do not return NULL; they return pointers that encode errors." **2. Specific Code Issues Fixed:** - **Before:** Used `PTR_ERR_OR_ZERO(conn_state)` which is inappropriate since these functions never return NULL - **After:** Uses `IS_ERR(conn_state)` followed by `PTR_ERR(conn_state)` which is the correct pattern for error pointer checking **3. Comparison with Similar Commits:** Looking at the provided examples, this commit closely matches **Similar Commit #4 (Status: YES)** which also: - Adds null pointer checks for proper error handling - Fixes potential crashes from dereferencing error pointers - Is a small, contained bug fix - Addresses static analysis findings (Coverity-style issues) **4. Risk Assessment:** - **Low Risk:** The change is minimal and only affects error handling paths - **No Architectural Changes:** This is purely a bug fix with no feature additions - **Contained Impact:** Only affects the `dm_force_atomic_commit()` function in AMD display driver - **Improves Stability:** Prevents potential kernel crashes from dereferencing error pointers **5. Stable Tree Criteria Met:** - ✅ Fixes an important bug (potential crash) - ✅ Small and contained change - ✅ No new features introduced - ✅ Minimal regression risk - ✅ Clear fix for incorrect API usage **6. Critical System Impact:** The DRM subsystem is critical for display functionality, and improper error handling in atomic commits could lead to: - Kernel oops/crashes during display mode changes - System instability during hotplug events - Potential security implications from dereferencing invalid pointers The fix ensures proper error propagation in the display driver's atomic commit path, which is essential for system stability. .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 5f9452b22596a..03016cba25d7a 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -10256,16 +10256,20 @@ static int dm_force_atomic_commit(struct drm_connector *connector) */ conn_state = drm_atomic_get_connector_state(state, connector); - ret = PTR_ERR_OR_ZERO(conn_state); - if (ret) + /* Check for error in getting connector state */ + if (IS_ERR(conn_state)) { + ret = PTR_ERR(conn_state); goto out; + } /* Attach crtc to drm_atomic_state*/ crtc_state = drm_atomic_get_crtc_state(state, &disconnected_acrtc->base); - ret = PTR_ERR_OR_ZERO(crtc_state); - if (ret) + /* Check for error in getting crtc state */ + if (IS_ERR(crtc_state)) { + ret = PTR_ERR(crtc_state); goto out; + } /* force a restore */ crtc_state->mode_changed = true; @@ -10273,9 +10277,11 @@ static int dm_force_atomic_commit(struct drm_connector *connector) /* Attach plane to drm_atomic_state */ plane_state = drm_atomic_get_plane_state(state, plane); - ret = PTR_ERR_OR_ZERO(plane_state); - if (ret) + /* Check for error in getting plane state */ + if (IS_ERR(plane_state)) { + ret = PTR_ERR(plane_state); goto out; + } /* Call commit internally with the state we just constructed */ ret = drm_atomic_commit(state); -- 2.39.5