In drmm_connector_hdmi_init(), if the reset callback fails to allocate
memory, e.g. inside drm_atomic_helper_connector_reset(),
connector->state will remain NULL. This is unconditionally passed to
drm_connector_attach_max_bpc_property(), leading to a NULL pointer
dereference.
Bail out with -ENOMEM if the reset callback leaves connector->state
unset.
Fixes: aadb3e16b8f3 ("drm/connector: hdmi: Add output BPC to the connector
state")
Reported-by: Sashiko <[email protected]>
Closes: https://lore.kernel.org/all/[email protected]/
Signed-off-by: Cristian Ciocaltea <[email protected]>
---
drivers/gpu/drm/drm_connector.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 8b4baed060f3..0e39431e85b2 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -628,6 +628,8 @@ int drmm_connector_hdmi_init(struct drm_device *dev,
connector->state = state;
} else if (connector->funcs->reset) {
connector->funcs->reset(connector);
+ if (!connector->state)
+ return -ENOMEM;
}
drm_connector_attach_max_bpc_property(connector, 8, max_bpc);
--
2.55.0
