From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: drm/atomic: Drop private obj state allocation Date: Wed, 11 Mar 2026 13:09:08 +1000 Message-ID: In-Reply-To: <20260310-drm-mode-config-init-v1-10-de7397c8e1cf@kernel.org> References: <20260310-drm-mode-config-init-v1-0-de7397c8e1cf@kernel.org> <20260310-drm-mode-config-init-v1-10-de7397c8e1cf@kernel.org> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 Patch Review **Potential issue:** After this patch, `drm_atomic_private_obj_init()` no longer allocates a state, and the state won't be allocated until `drm_dev_register()` calls `drm_mode_config_create_state()`. If any code accesses `obj->state` between `drm_atomic_private_obj_init()` and `drm_dev_register()`, it will hit a NULL pointer. Looking at `drm_atomic_private_obj_fini()`: ```c void drm_atomic_private_obj_fini(struct drm_private_obj *obj) { list_del(&obj->head); obj->funcs->atomic_destroy_state(obj, obj->state); // obj->state could be NULL! ``` If a driver fails during probe after calling `drm_atomic_private_obj_init()` but before `drm_dev_register()`, the cleanup path would call `drm_atomic_private_obj_fini()` with `obj->state == NULL`, which would be passed to `atomic_destroy_state()` and likely crash. This is a real concern that should be addressed, e.g., by adding a NULL check in `drm_atomic_private_obj_fini()`. --- Generated by Claude Code Patch Reviewer