From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from forward201d.mail.yandex.net (forward201d.mail.yandex.net [178.154.239.220]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 07DFC3783CC; Mon, 29 Jun 2026 09:17:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.220 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782724636; cv=none; b=DXDXbY9bmBr+8RJQU4beeQ1jJlTvPC7ivUpySRX3GhQ60QFfXlVAAb0HuGfh1ER3Nm9y4LkJBssuh38Q9zotzBfCsVuu6ytAqQ8biDNhTjgCTsqJ7P1eidlgmSVD6IrtStiXPFiSz8p9KnsIMeor5DQJP2fh6khX+Vs/z8Jbavc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782724636; c=relaxed/simple; bh=uKskaaQi181cgtwH0BimF/V2i2ESaiuqP9naFLgfl+c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Rf+aQiwAYew9H7X8olY9dPs1mb38QozfJ0blXmHa8o7iS+AzXP0VfksWX2P95NAumy8Giy8lb+egtB4riJZ/KgIiJorK6JVpx+H5rirJNWgeVKFg5yl9BSp0JJ3xS6URKhCPhsJVOnBxo+1PVPD0iiy8mXhYK8JB7cqHZpNufuk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru; spf=pass smtp.mailfrom=yandex.ru; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b=eVzIDb7U; arc=none smtp.client-ip=178.154.239.220 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b="eVzIDb7U" Received: from forward101d.mail.yandex.net (forward101d.mail.yandex.net [IPv6:2a02:6b8:c41:1300:1:45:d181:d101]) by forward201d.mail.yandex.net (postfix) with ESMTPS id E6FFF82FBC; Mon, 29 Jun 2026 12:11:02 +0300 (MSK) Received: from mail-nwsmtp-smtp-production-main-73.iva.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-73.iva.yp-c.yandex.net [IPv6:2a02:6b8:c0c:bb8b:0:640:6ac7:0]) by forward101d.mail.yandex.net (postfix) with ESMTPS id 4F091C006A; Mon, 29 Jun 2026 12:10:54 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-73.iva.yp-c.yandex.net (smtp) with ESMTPSA id ZAZXGGsiDOs0-bvxPsrrN; Mon, 29 Jun 2026 12:10:53 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1782724253; bh=6sWfq1ii8CZ63zd/fACYXQ6suOEoWDKB19vowTfgyPU=; h=Message-ID:Date:In-Reply-To:Cc:Subject:References:To:From; b=eVzIDb7UzQqiIrreUq0Il7aRtv9PPsehEDpWtRsiNbX/QgxgiobKwmCXUZMwJMk6T u+wp50ZDXfkRkpFBSAJiPGlgwUD/qR9ETiYpDl7GONTuWZIIz3fmUM3UwqfWruSplr c0kOT7PdinjtfvEMMHu+czGW7nXe/Z/lEy9NxH6s= Authentication-Results: mail-nwsmtp-smtp-production-main-73.iva.yp-c.yandex.net; dkim=pass header.i=@yandex.ru From: Evgenii Burenchev To: stable@vger.kernel.org, Greg Kroah-Hartman Cc: Evgenii Burenchev , harry.wentland@amd.com, sunpeng.li@amd.com, siqueira@igalia.com, alexander.deucher@amd.com, christian.koenig@amd.com, airlied@gmail.com, simona@ffwll.ch, mario.limonciello@amd.com, alex.hung@amd.com, superm1@kernel.org, timur.kristof@gmail.com, ivan.lipski@amd.com, ray.wu@amd.com, aurabindo.pillai@amd.com, chen-yu.chen@amd.com, mripard@kernel.org, Dillon.Varone@amd.com, mwen@igalia.com, chiahsuan.chung@amd.com, kenneth.feng@amd.com, srinivasan.shanmugam@amd.com, tzimmermann@suse.de, Alvin.Lee2@amd.com, dmitry.baryshkov@oss.qualcomm.com, chaitanya.kumar.borah@intel.com, ekurzinger@gmail.com, pierre-eric.pelloux-prayer@amd.com, HaoPing.Liu@amd.com, Tony.Cheng@amd.com, amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org Subject: [PATCH v4 1/3] drm/amd/display: Fix dangling pointer in plane reset function Date: Mon, 29 Jun 2026 12:04:29 +0300 Message-ID: <20260629090435.9729-3-evg28bur@yandex.ru> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260629090435.9729-2-evg28bur@yandex.ru> References: <20260629090435.9729-2-evg28bur@yandex.ru> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit amdgpu_dm_plane_drm_plane_reset() frees the old state before allocating a new one. If kzalloc_obj() fails, the function returns without updating the state pointer, leaving a dangling pointer to already freed memory. Fix this by allocating the new state first. On allocation failure, the old state remains untouched and the function safely returns. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 5d945cbcd4b1 ("drm/amd/display: Create a file dedicated to planes") Signed-off-by: Evgenii Burenchev --- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c index c7f8e08feaf4..cfd76c54f652 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c @@ -1488,17 +1488,15 @@ static const struct drm_plane_helper_funcs dm_primary_plane_helper_funcs = { static void amdgpu_dm_plane_drm_plane_reset(struct drm_plane *plane) { - struct dm_plane_state *amdgpu_state = NULL; - - if (plane->state) - plane->funcs->atomic_destroy_state(plane, plane->state); + struct dm_plane_state *amdgpu_state; amdgpu_state = kzalloc_obj(*amdgpu_state); - WARN_ON(amdgpu_state == NULL); - if (!amdgpu_state) return; + if (plane->state) + plane->funcs->atomic_destroy_state(plane, plane->state); + __drm_atomic_helper_plane_reset(plane, &amdgpu_state->base); amdgpu_state->degamma_tf = AMDGPU_TRANSFER_FUNCTION_DEFAULT; amdgpu_state->hdr_mult = AMDGPU_HDR_MULT_DEFAULT; -- 2.43.0