From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B46FFEFD202 for ; Wed, 25 Feb 2026 07:52:44 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 110B710E1E3; Wed, 25 Feb 2026 07:52:44 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=intel.com header.i=@intel.com header.b="PNPVIPaG"; dkim-atps=neutral Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.9]) by gabe.freedesktop.org (Postfix) with ESMTPS id A670510E1E3 for ; Wed, 25 Feb 2026 07:52:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1772005962; x=1803541962; h=date:from:to:cc:subject:message-id:references: mime-version:content-transfer-encoding:in-reply-to; bh=269NKUs++Bmxz+P2c3gQHTGC8qfo2DGUjFPHjWeMnxg=; b=PNPVIPaGXtK5UaQE/lTMam9HyWSUC/otAZWcQus/bQ61yLrTsq2Mnuup yyBMOdG61xfVlHdbaPQDmOUDXL4MyM0S+RovEDTMcxTj19Gw2ZJMU1Mbw IAGe+CYHhKCA+3Klh8meoqG4omx25/oIFhjXhWUKZRwhmIPE5AZ9NqnJM urIvJt4mWKdBkUdmVbCxvSUxUZ/uHMroRmRXlPi+hwFG912xtREWEjglC dLBgyvC/9QV4wiZPaxnVHO8TkU3pJKbdHL5d5tOIHbeP96xu9tnU1LHNV TaTi1ECmWDUmQ8dngU5iJGzWyZRA8+MeFZbbY5IGP5twugVOVceVpLJip A==; X-CSE-ConnectionGUID: m+LdyyWSQrqRgO4zeKPiIA== X-CSE-MsgGUID: guipkW8uRq+fRObo7X3AjQ== X-IronPort-AV: E=McAfee;i="6800,10657,11711"; a="95653369" X-IronPort-AV: E=Sophos;i="6.21,310,1763452800"; d="scan'208";a="95653369" Received: from orviesa008.jf.intel.com ([10.64.159.148]) by orvoesa101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Feb 2026 23:52:42 -0800 X-CSE-ConnectionGUID: uOVFkiJQTBWMc9akefStzw== X-CSE-MsgGUID: 67P0GeGEQ5WyJEIgfXQpMg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.21,310,1763452800"; d="scan'208";a="216168615" Received: from abityuts-desk.ger.corp.intel.com (HELO localhost) ([10.245.244.16]) by orviesa008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Feb 2026 23:52:41 -0800 Date: Wed, 25 Feb 2026 09:52:38 +0200 From: Ville =?iso-8859-1?Q?Syrj=E4l=E4?= To: Jonathan Cavitt Cc: dri-devel@lists.freedesktop.org, saurabhg.gupta@intel.com, alex.zuo@intel.com Subject: Re: [PATCH] drm/client: Do not destroy NULL modes Message-ID: References: <20260224221227.69126-2-jonathan.cavitt@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: <20260224221227.69126-2-jonathan.cavitt@intel.com> X-Patchwork-Hint: comment Organization: Intel Finland Oy - BIC 0357606-4 - c/o Alberga Business Park, 6 krs Bertel Jungin Aukio 5, 02600 Espoo, Finland X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Tue, Feb 24, 2026 at 10:12:28PM +0000, Jonathan Cavitt wrote: > 'modes' in drm_client_modeset_probe may fail to kcalloc. If this > occurs, we jump to 'out', calling modes_destroy on it, which > dereferences it. This may result in a NULL pointer dereference in the > error case. Prevent that. >=20 > Fixes: 3039cc0c0653 ("drm/client: Make copies of modes") > Signed-off-by: Jonathan Cavitt > Cc: Ville Syrj=E4l=E4 Thanks. Pushed to drm-misc-fixes. > --- > drivers/gpu/drm/drm_client_modeset.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) >=20 > diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_c= lient_modeset.c > index 262b1b8773c5..bb49b8361271 100644 > --- a/drivers/gpu/drm/drm_client_modeset.c > +++ b/drivers/gpu/drm/drm_client_modeset.c > @@ -930,7 +930,8 @@ int drm_client_modeset_probe(struct drm_client_dev *c= lient, unsigned int width, > mutex_unlock(&client->modeset_mutex); > out: > kfree(crtcs); > - modes_destroy(dev, modes, connector_count); > + if (modes) > + modes_destroy(dev, modes, connector_count); > kfree(modes); > kfree(offsets); > kfree(enabled); > --=20 > 2.43.0 --=20 Ville Syrj=E4l=E4 Intel