On Sun, May 24, 2026 at 5:57 PM Myeonghun Pak <[email protected]> wrote:
>
> psb_driver_load() initializes KMS polling before it attempts to
> initialize backlight support. If gma_backlight_init() fails, the
> function returns directly and skips psb_driver_unload(), leaving
> drm_kms_helper_poll_fini() uncalled.
>
> Use the existing error path so the partially initialized modeset state
> is unwound before probe fails.
Hi,
Yes the existing code is faulty but calling psb_driver_unload() to
unwind the init could call backlight_device_unregister() on an ERR_PTR
backlight_device which is guaranteed to fail.
The correct fix would be to convert psb_driver_load() to use devm
and/or goto unwind pattern.
-Patrik
>
> This issue was identified during our ongoing static-analysis research while
> reviewing kernel code.
>
> Fixes: 1f90b1232773 ("drm/gma500: Refactor backlight support (v2)")
> Cc: [email protected]
> Co-developed-by: Ijae Kim <[email protected]>
> Signed-off-by: Ijae Kim <[email protected]>
> Signed-off-by: Myeonghun Pak <[email protected]>
> ---
> drivers/gpu/drm/gma500/psb_drv.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/gma500/psb_drv.c
> b/drivers/gpu/drm/gma500/psb_drv.c
> index 005ab7f535..7218026fe2 100644
> --- a/drivers/gpu/drm/gma500/psb_drv.c
> +++ b/drivers/gpu/drm/gma500/psb_drv.c
> @@ -406,7 +406,7 @@ static int psb_driver_load(struct drm_device *dev,
> unsigned long flags)
> drm_connector_list_iter_end(&conn_iter);
>
> if (ret)
> - return ret;
> + goto out_err;
> psb_intel_opregion_enable_asle(dev);
>
> return devm_add_action_or_reset(dev->dev, psb_device_release, dev);
> --
> 2.47.1
>
