[PATCH] drm: rcar-du: Fix crash when no CMM is available

[PATCH] drm: rcar-du: Fix crash when no CMM is available

[Laurent Pinchart]

Commit 3bce3fdd1ff2 ("drm: rcar-du: Don't leak device_link to CMM")
refactored CMM handling, and introduced an incorrect test for CMM
availability. When no CMM is present, the rcrtc->cmm field is NULL,
testing rcrtc->cmm->dev causes a NULL pointer dereference. This slipped
through testing as all tests were run with the CMM present.

Fix this issue by correctly testing for rcrtc->cmm.

Fixes: 3bce3fdd1ff2 ("drm: rcar-du: Don't leak device_link to CMM")
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Closes: https://lore.kernel.org/dri-devel/CAMuHMdXomz9GFDqkBjGX9Sda_GLccPcrihvFbOz0GAitDVNTbw@mail.gmail.com
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/gpu/drm/renesas/rcar-du/rcar_du_crtc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/renesas/rcar-du/rcar_du_crtc.c
index 7c36c30a75b6..1a246ebbfc61 100644
--- a/drivers/gpu/drm/renesas/rcar-du/rcar_du_crtc.c
+++ b/drivers/gpu/drm/renesas/rcar-du/rcar_du_crtc.c
@@ -513,7 +513,7 @@ static void rcar_du_cmm_setup(struct drm_crtc *crtc)
 	struct rcar_du_crtc *rcrtc = to_rcar_crtc(crtc);
 	struct rcar_cmm_config cmm_config = {};
 
-	if (!rcrtc->cmm->dev)
+	if (!rcrtc->cmm)
 		return;
 
 	if (drm_lut)
@@ -667,7 +667,7 @@ static void rcar_du_crtc_stop(struct rcar_du_crtc *rcrtc)
 	if (rcar_du_has(rcrtc->dev, RCAR_DU_FEATURE_VSP1_SOURCE))
 		rcar_du_vsp_disable(rcrtc);
 
-	if (rcrtc->cmm->dev)
+	if (rcrtc->cmm)
 		rcar_cmm_disable(rcrtc->cmm->dev);
 
 	/*
@@ -726,7 +726,7 @@ static void rcar_du_crtc_atomic_enable(struct drm_crtc *crtc,
 	struct rcar_du_crtc_state *rstate = to_rcar_crtc_state(crtc->state);
 	struct rcar_du_device *rcdu = rcrtc->dev;
 
-	if (rcrtc->cmm->dev)
+	if (rcrtc->cmm)
 		rcar_cmm_enable(rcrtc->cmm->dev);
 	rcar_du_crtc_get(rcrtc);
 

base-commit: dc2d30e7db8321a6696d266838f7af7e9d1c7155
-- 
Regards,

Laurent Pinchart

Re: [PATCH] drm: rcar-du: Fix crash when no CMM is available

[Tomi Valkeinen]

Hi,

On 08/04/2026 15:42, Laurent Pinchart wrote:
> Commit 3bce3fdd1ff2 ("drm: rcar-du: Don't leak device_link to CMM")
> refactored CMM handling, and introduced an incorrect test for CMM
> availability. When no CMM is present, the rcrtc->cmm field is NULL,
> testing rcrtc->cmm->dev causes a NULL pointer dereference. This slipped
> through testing as all tests were run with the CMM present.
> 
> Fix this issue by correctly testing for rcrtc->cmm.
> 
> Fixes: 3bce3fdd1ff2 ("drm: rcar-du: Don't leak device_link to CMM")
> Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
> Closes: https://lore.kernel.org/dri-devel/CAMuHMdXomz9GFDqkBjGX9Sda_GLccPcrihvFbOz0GAitDVNTbw@mail.gmail.com
> Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
> ---
>   drivers/gpu/drm/renesas/rcar-du/rcar_du_crtc.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
Thanks, pushed to drm-misc-next.

  Tomi

Claude review: drm: rcar-du: Fix crash when no CMM is available

[Claude Code Review Bot]

Overall Series Review

Subject: drm: rcar-du: Fix crash when no CMM is available
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Patches: 2
Reviewed: 2026-04-12T12:28:44.829717

---

This is a single-patch fix for a NULL pointer dereference crash in the R-Car DU driver. The bug is straightforward: commit 3bce3fdd1ff2 refactored CMM handling to use a `struct rcar_du_cmm *cmm` pointer (which contains a `dev` field), but the null-checks were written as `rcrtc->cmm->dev` instead of `rcrtc->cmm`. When no CMM is present, `rcrtc->cmm` is NULL (it's only assigned at `rcar_du_crtc.c:1304` when `rcdu->cmms[swindex].dev` is non-NULL), so dereferencing it to access `->dev` crashes.

The fix is correct, minimal, and well-targeted. The Fixes tag, Reported-by, and Tested-by are all present. This is a clean bug fix suitable for merging.

---
Generated by Claude Code Patch Reviewer

Claude review: drm: rcar-du: Fix crash when no CMM is available

[Claude Code Review Bot]

Patch Review

**Correctness: Good.** All three sites are correctly changed from `rcrtc->cmm->dev` to `rcrtc->cmm`. Looking at the initialization code at line 1302-1304:

```c
/* CMM might be disabled for this CRTC. */
if (rcdu->cmms[swindex].dev) {
    rcrtc->cmm = &rcdu->cmms[swindex];
```

`rcrtc->cmm` is only set when the corresponding `cmms[].dev` is non-NULL, which means if `rcrtc->cmm` is non-NULL, then `rcrtc->cmm->dev` is guaranteed non-NULL. So testing `rcrtc->cmm` is both sufficient and correct — the two conditions are semantically equivalent when `cmm` is non-NULL, and only the new form is safe when `cmm` is NULL.

**Site 1 (line 516):** `rcar_du_cmm_setup()` — the early return guard. After the fix, `rcrtc->cmm->dev` is still used on line 522 in `rcar_cmm_setup(rcrtc->cmm->dev, &cmm_config)`, which is safe because the NULL check now correctly gates it.

**Site 2 (line 670):** `rcar_du_crtc_stop()` — guards the `rcar_cmm_disable(rcrtc->cmm->dev)` call on the next line. Correct.

**Site 3 (line 729):** `rcar_du_crtc_atomic_enable()` — guards the `rcar_cmm_enable(rcrtc->cmm->dev)` call. Correct.

**No issues found.** The commit message is clear, the Fixes tag correctly identifies the offending commit, it has a Tested-by from the reporter, and the fix is the minimal correct change. Good to merge.

---
Generated by Claude Code Patch Reviewer