imx_drm_crtc_reset() destroys the current CRTC state only when
crtc->state is non-NULL, but it always converts crtc->state to
struct imx_crtc_state and passes the result to kfree().
When reset is called without an existing state, container_of(NULL, ...)
does not produce NULL. Keep the imx state free in the same crtc->state
guard as the helper state destruction.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 8ed5dcf966dd ("drm/imx: Use __drm_atomic_helper_crtc_reset")
Signed-off-by: Ruoyu Wang <[email protected]>
---
drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
b/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
index 1405e50ee56b5..e4f0c91dc7610 100644
--- a/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
@@ -111,10 +111,10 @@ static void imx_drm_crtc_reset(struct drm_crtc *crtc)
{
struct imx_crtc_state *state;
- if (crtc->state)
+ if (crtc->state) {
__drm_atomic_helper_crtc_destroy_state(crtc->state);
-
- kfree(to_imx_crtc_state(crtc->state));
+ kfree(to_imx_crtc_state(crtc->state));
+ }
crtc->state = NULL;
state = kzalloc_obj(*state);
--
2.51.0
