[PATCH] drm/gma500: clean up modeset on backlight init failure

[PATCH] drm/gma500: clean up modeset on backlight init failure

[Myeonghun Pak]

psb_driver_load() initializes KMS polling before it attempts to
initialize backlight support. If gma_backlight_init() fails, the
function returns directly and skips psb_driver_unload(), leaving
drm_kms_helper_poll_fini() uncalled.

Use the existing error path so the partially initialized modeset state
is unwound before probe fails.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: 1f90b1232773 ("drm/gma500: Refactor backlight support (v2)")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/gpu/drm/gma500/psb_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
index 005ab7f535..7218026fe2 100644
--- a/drivers/gpu/drm/gma500/psb_drv.c
+++ b/drivers/gpu/drm/gma500/psb_drv.c
@@ -406,7 +406,7 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags)
 	drm_connector_list_iter_end(&conn_iter);
 
 	if (ret)
-		return ret;
+		goto out_err;
 	psb_intel_opregion_enable_asle(dev);
 
 	return devm_add_action_or_reset(dev->dev, psb_device_release, dev);
-- 
2.47.1

Re: [PATCH] drm/gma500: clean up modeset on backlight init failure

[Patrik Jakobsson]

On Sun, May 24, 2026 at 5:57 PM Myeonghun Pak <mhun512@gmail.com> wrote:
>
> psb_driver_load() initializes KMS polling before it attempts to
> initialize backlight support. If gma_backlight_init() fails, the
> function returns directly and skips psb_driver_unload(), leaving
> drm_kms_helper_poll_fini() uncalled.
>
> Use the existing error path so the partially initialized modeset state
> is unwound before probe fails.

Hi,
Yes the existing code is faulty but calling psb_driver_unload() to
unwind the init could call backlight_device_unregister() on an ERR_PTR
backlight_device which is guaranteed to fail.

The correct fix would be to convert psb_driver_load() to use devm
and/or goto unwind pattern.

-Patrik

>
> This issue was identified during our ongoing static-analysis research while
> reviewing kernel code.
>
> Fixes: 1f90b1232773 ("drm/gma500: Refactor backlight support (v2)")
> Cc: stable@vger.kernel.org
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---
>  drivers/gpu/drm/gma500/psb_drv.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
> index 005ab7f535..7218026fe2 100644
> --- a/drivers/gpu/drm/gma500/psb_drv.c
> +++ b/drivers/gpu/drm/gma500/psb_drv.c
> @@ -406,7 +406,7 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags)
>         drm_connector_list_iter_end(&conn_iter);
>
>         if (ret)
> -               return ret;
> +               goto out_err;
>         psb_intel_opregion_enable_asle(dev);
>
>         return devm_add_action_or_reset(dev->dev, psb_device_release, dev);
> --
> 2.47.1
>

Re: [PATCH] drm/gma500: clean up modeset on backlight init failure

[Myeonghun Pak]

Hi Patrik,

Thanks for the feedback. I'll address this and submit v2.

Thanks,
Myeonghun

2026년 6월 1일 (월) 오전 5:50, Patrik Jakobsson <patrik.r.jakobsson@gmail.com>님이 작성:
>
> On Sun, May 24, 2026 at 5:57 PM Myeonghun Pak <mhun512@gmail.com> wrote:
> >
> > psb_driver_load() initializes KMS polling before it attempts to
> > initialize backlight support. If gma_backlight_init() fails, the
> > function returns directly and skips psb_driver_unload(), leaving
> > drm_kms_helper_poll_fini() uncalled.
> >
> > Use the existing error path so the partially initialized modeset state
> > is unwound before probe fails.
>
> Hi,
> Yes the existing code is faulty but calling psb_driver_unload() to
> unwind the init could call backlight_device_unregister() on an ERR_PTR
> backlight_device which is guaranteed to fail.
>
> The correct fix would be to convert psb_driver_load() to use devm
> and/or goto unwind pattern.
>
> -Patrik
>
> >
> > This issue was identified during our ongoing static-analysis research while
> > reviewing kernel code.
> >
> > Fixes: 1f90b1232773 ("drm/gma500: Refactor backlight support (v2)")
> > Cc: stable@vger.kernel.org
> > Co-developed-by: Ijae Kim <ae878000@gmail.com>
> > Signed-off-by: Ijae Kim <ae878000@gmail.com>
> > Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> > ---
> >  drivers/gpu/drm/gma500/psb_drv.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
> > index 005ab7f535..7218026fe2 100644
> > --- a/drivers/gpu/drm/gma500/psb_drv.c
> > +++ b/drivers/gpu/drm/gma500/psb_drv.c
> > @@ -406,7 +406,7 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags)
> >         drm_connector_list_iter_end(&conn_iter);
> >
> >         if (ret)
> > -               return ret;
> > +               goto out_err;
> >         psb_intel_opregion_enable_asle(dev);
> >
> >         return devm_add_action_or_reset(dev->dev, psb_device_release, dev);
> > --
> > 2.47.1
> >