On Sat, Dec 13, 2025 at 12:08:16AM +0100, David Heidelberg via B4 Relay wrote:
> From: Petr Hodina <[email protected]>
>
> dpu_crtc_duplicate_state() assumes that crtc->state is always valid,
> but under certain error or teardown paths it may be NULL, leading to
> a NULL-pointer dereference when calling to_dpu_crtc_state().
>
> Signed-off-by: Petr Hodina <[email protected]>
> Signed-off-by: David Heidelberg <[email protected]>
> ---
> drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
Missing Fixes tag.
>
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
> b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
> index c39f1908ea654..d03666e14d7de 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
> @@ -1114,7 +1114,12 @@ static void dpu_crtc_reset(struct drm_crtc *crtc)
> */
> static struct drm_crtc_state *dpu_crtc_duplicate_state(struct drm_crtc *crtc)
> {
> - struct dpu_crtc_state *cstate, *old_cstate =
> to_dpu_crtc_state(crtc->state);
> + struct dpu_crtc_state *cstate, *old_cstate;
> +
> + if (WARN_ON(!crtc->state))
> + return NULL;
> +
> + old_cstate = to_dpu_crtc_state(crtc->state);
>
> cstate = kmemdup(old_cstate, sizeof(*old_cstate), GFP_KERNEL);
> if (!cstate) {
>
> --
> 2.51.0
>
>
--
With best wishes
Dmitry
