Re: [PATCH v2 15/61] drm/fsl-dcu: Convert to atomic_create_state

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unconditional NULL pointer dereference in the error path of fsl_dcu_drm_primary_create_plane().
--

--- Patch [15]: [PATCH v2 15/61] drm/fsl-dcu: Convert to atomic_create_state ---
commit 29c8546f32e570013853685338e1cf8ea2d14508
Author: Maxime Ripard <[email protected]>

drm/fsl-dcu: Convert to atomic_create_state

The plane only initializes a pristine state in its reset hook
using drm_atomic_helper_plane_reset(), which is equivalent to what
atomic_create_state expects. Convert to it.

> diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
> index b34f880c1e098..92794b337512c 100644
> --- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
> +++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
> @@ -177,7 +177,7 @@ static const struct drm_plane_funcs fsl_dcu_drm_plane_funcs = {
>  	.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
>  	.destroy = drm_plane_helper_destroy,
>  	.disable_plane = drm_atomic_helper_disable_plane,
> -	.reset = drm_atomic_helper_plane_reset,
> +	.atomic_create_state = drm_atomic_helper_plane_create_state,
>  	.update_plane = drm_atomic_helper_update_plane,
>  };

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing the changes
in this file I noticed an unconditional NULL pointer dereference in the
error path of fsl_dcu_drm_primary_create_plane().

If drm_universal_plane_init() fails, it sets primary to NULL:

	if (ret) {
		kfree(primary);
		primary = NULL;
	}

And then drm_plane_helper_add() is called with the primary pointer, which
dereferences it unconditionally:

	drm_plane_helper_add(primary, &fsl_dcu_drm_plane_helper_funcs);

Could this cause a kernel crash if plane initialization fails during device
probe? Would it be better to return early if drm_universal_plane_init() fails?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=15