Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] drm/msm/dpu: NULL pointer dereference in dpu_kms_destroy() during error paths --
commit a4f8ebdb83ba4326d66366d808a6aed47be384e3 Author: Yongxing Mou <[email protected]> drm/msm/dp: introduce dp_mst_drm module This commit adds the dp_mst_drm module and the core MST manager data structures. It introduces the MST manager object, per-stream encoder state, and the registration hooks used to initialize and destroy the MST manager during DP device setup. > diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c > b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c > index da3556eb6ecc2..7ee4e7e4d34a3 100644 > --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c > +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c [ ... ] > @@ -905,6 +915,8 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms) > static void dpu_kms_destroy(struct msm_kms *kms) > { > struct dpu_kms *dpu_kms; > + struct msm_drm_private *priv; > + int i; > > if (!kms) { > DPU_ERROR("invalid kms\n"); > @@ -912,6 +924,11 @@ static void dpu_kms_destroy(struct msm_kms *kms) > } > > dpu_kms = to_dpu_kms(kms); > + priv = dpu_kms->dev->dev_private; > + > + for (i = 0; i < ARRAY_SIZE(priv->kms->dp); i++) [Severity: High] Does this cause a NULL pointer dereference if initialization fails early? If msm_kms_init() fails (e.g., if alloc_ordered_workqueue() fails and returns -ENOMEM), it populates kms->funcs before failure. The failure propagates up to msm_drm_init(), which then triggers the err_msm_uninit error path calling msm_drm_kms_uninit(). Because kms->funcs is set, kms->funcs->destroy() (which maps to dpu_kms_destroy()) is executed. However, dpu_kms->dev is only assigned after a successful msm_kms_init(), so it remains NULL. Unconditionally dereferencing dpu_kms->dev to access dev_private here appears to cause a kernel panic on driver probe error paths. > + if (priv->kms->dp[i]) > + msm_dp_mst_unregister(priv->kms->dp[i]); > > _dpu_kms_hw_destroy(dpu_kms); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=18
