From: Petr Hodina <[email protected]> dpu_crtc_duplicate_state() assumes that crtc->state is always valid, but under certain error or teardown paths it may be NULL, leading to a NULL-pointer dereference when calling to_dpu_crtc_state().
Signed-off-by: Petr Hodina <[email protected]> Signed-off-by: David Heidelberg <[email protected]> --- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c index c39f1908ea654..d03666e14d7de 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c @@ -1114,7 +1114,12 @@ static void dpu_crtc_reset(struct drm_crtc *crtc) */ static struct drm_crtc_state *dpu_crtc_duplicate_state(struct drm_crtc *crtc) { - struct dpu_crtc_state *cstate, *old_cstate = to_dpu_crtc_state(crtc->state); + struct dpu_crtc_state *cstate, *old_cstate; + + if (WARN_ON(!crtc->state)) + return NULL; + + old_cstate = to_dpu_crtc_state(crtc->state); cstate = kmemdup(old_cstate, sizeof(*old_cstate), GFP_KERNEL); if (!cstate) { -- 2.51.0
