Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Unconditional dereference of potentially NULL crtc->helper_private pointer when checking for the hw_reset hook. --
commit 64d66423bd9e9cda8a92c70fb8fec4016d121ea0 Author: Maxime Ripard <[email protected]> drm/tilcdc: Switch to drm_atomic_helper_crtc_create_state The tilcdc crtc implementation uses the deprecated drm_atomic_helper_crtc_reset() as its reset hook. Switch to drm_atomic_helper_crtc_create_state() instead. > diff --git a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c > b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c > index b299d73ce3856..f619b7a6e70d9 100644 > --- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c > +++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c > @@ -714,7 +714,7 @@ static void tilcdc_crtc_hw_reset(struct drm_crtc *crtc) > static const struct drm_crtc_funcs tilcdc_crtc_funcs = { > .set_config = drm_atomic_helper_set_config, > .page_flip = drm_atomic_helper_page_flip, > - .reset = drm_atomic_helper_crtc_reset, > + .atomic_create_state = drm_atomic_helper_crtc_create_state, [Severity: High] Does this change expose a NULL pointer dereference in the core DRM API? By switching to .atomic_create_state, drm_mode_config_reset() will now call drm_mode_config_crtc_reset_with_create_state() during driver probe or system resume. Looking at drm_mode_config_crtc_reset_with_create_state() in drivers/gpu/drm/drm_mode_config.c: drm_mode_config_crtc_reset_with_create_state() { const struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private; ... if (crtc_funcs->hw_reset) crtc_funcs->hw_reset(crtc); return 0; } The crtc_funcs pointer is dereferenced here without a preceding NULL guard. If a driver does not use CRTC helpers, crtc->helper_private will be NULL. Wouldn't this unconditional dereference to check for hw_reset lead to a crash for any driver leaving helper_private unpopulated? > .atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state, > .atomic_destroy_state = drm_atomic_helper_crtc_destroy_state, > .enable_vblank = tilcdc_crtc_enable_vblank, > .disable_vblank = tilcdc_crtc_disable_vblank, > }; -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=5
