From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 945C3379C32 for ; Tue, 7 Jul 2026 15:05:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783436739; cv=none; b=pRiy8XT5sElLmuv70vlZZPJNRrs950ixFxHdmcU2e1SpJHEN0bqUI0RQ9RSldLmqvCJVv2IjECWde0ZXPf9QVcBRj8M4yvpjY0aQOZ2I26scW6q3iqZM91X7ZojkBCc6oaF0aGh2IsBzdlOgfiOBZXO4qZ5QHFvlfG++kGLpFtE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783436739; c=relaxed/simple; bh=g6nlxqRAYYTQh3u7Jh6r/N5PVNKHJvMn7iDNtt9SO3s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RYMfBqrVdh1W7PFqO5zIkiSXgf4Hp5lGIIiYXatMF1ev2oYOKaz1t+uX42P25CEOPmB/X4+HiStLRJid7XNTlc2utTBF7oKqs6y7jJbdT4puen7fZ9QrCBGEnkl4+rulPw7v8MCRcbcGgWkfA4ut18miLSquGkDQfGDcYiOEQDg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=csNOdMKq; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="csNOdMKq" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-382a3fe0d28so3516001a91.0 for ; Tue, 07 Jul 2026 08:05:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783436736; x=1784041536; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=7SSWQg6HrEbpp/1xgGT38ar/90z2MxrGW6oImpnAmb0=; b=csNOdMKqNPmcHw6sTvfovfsnciU/zfB1jCUvlpds8Rxe1gkTadKFG0oVUVqKhoKY/d bGbZiuo6thouJhGM/32Wp8aavijxqceJ0tM7NSmxEXR/mWiniS8+TT+fajN5/FHx40l2 S6ODiENzSJVE4mTK23oVBQ4LbMsEJwhrxH80TjnvHnZl9XaCWify6+rJGTTpJZWohIma TrkVBy6QWuc+0NzS0iwbDJqZwVMZpGV0FxnFs8/VO5JqFsA9oJERjK0bACgiyfT6Leui zdVai3XUw4MJuq675Yfr76nx373DMxOxE24FXfiP8hkSNWoH/Z8yUZA9RPaW97KgL7UQ jeiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783436736; x=1784041536; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=7SSWQg6HrEbpp/1xgGT38ar/90z2MxrGW6oImpnAmb0=; b=OEzgx8fOxnYnUFYPhV464k4zVcU9N5I/3zFelMyQlPNtMeCkBvrGBakGvlb7U5NO8v prDH+9W49pf6SIQC+Pb95xeTr7JU3BvN//bJnVcctKI65Kd528opgfS/rkalMn77ayr3 s5XDPKIg7GegOoRbUnSKImJfBO7lFtpJ/i+yHfnpu4ChPURj5DCafBTv6UixI4S5UXhg 5POwZPLjjcNhXzI4zDm0Htxf6lVMwBkHboqneenmiy/2bmR3f54wqDHLAu7ppTqvlKJ1 LCTZ6qXIJY53UYFUNWyieHPSNJc+nvmW9Pkv6dHqaZn+liP0gpkr+qt/4wjqF592zL31 WorA== X-Forwarded-Encrypted: i=1; AHgh+RppWy4Z3X5lo+ks4tvLOqSRf9gn2eFYSDxCc49q+1F3Gh82t95fAGxh7BNaej4rSy2Zg+F1PUSup0W1sI0=@vger.kernel.org X-Gm-Message-State: AOJu0YyGYF/JUH9Kz4gl0rcQR6pdmTc2CWirWvtLAaB85+WZO0JHZu1z bNvoeyemfcT35g5zeHJjbBI58cAuJxfW0pLGKv3EuL3fMeWQN17yQHv3 X-Gm-Gg: AfdE7cksYUc6uBISCM4Xl0rI0jlA2Mx4vYOL9gvuyqTU0dMlA7+xR5azdGZoScS1aJa e4u1t31fZ4I0ZPa8XlrVumYvNvTVwETNmPryi1KENsDZkufAlX2X+xIWG9xIKGGiqQNSP0agkxR kx/mpxWbgUG7xLi18huotgELK2iD9zsi0oklfCXM31TZCV+aVasxJr6hqnfMWP39bboQkVVEfMs ud5R+VwDjbBYL5kQXKnwya2zAnVI3/pooShUENxS1CdXOaIm2MxudCfVnXxVncleYeUapfOCJ2/ 72f6ymr1CDaKng9BWDpYGQnzXWk99CSO7fPbPn2MT9f8ypMkU8SWTyjIuU6UnJS8vRsVZUcCT4H bDyE0QNNwcVl0HJT7+xiXMcCS1uSUKR+nALoNto3gpghrYOnuN098lDxbOpapiPj/A+NfQ4puYq kwhyHM9kkeZ9IsCNh6dX+Xn9hOQ8Z/2uQq X-Received: by 2002:a17:90b:4f48:b0:387:e0bb:57f6 with SMTP id 98e67ed59e1d1-387e0bb5c07mr2778290a91.39.1783436735574; Tue, 07 Jul 2026 08:05:35 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:239e:a31b:1d0d:374f]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-387d229a20csm1284197a91.16.2026.07.07.08.05.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2026 08:05:34 -0700 (PDT) From: Ruoyu Wang To: chunkuang.hu@kernel.org, p.zabel@pengutronix.de, airlied@gmail.com, simona@ffwll.ch, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com Cc: dri-devel@lists.freedesktop.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Ruoyu Wang Subject: [PATCH] drm/mediatek: Check CRTC state before freeing Date: Tue, 7 Jul 2026 23:05:28 +0800 Message-ID: <20260707150528.2270739-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit mtk_crtc_reset() destroys the current CRTC state only when crtc->state is non-NULL, but it always converts crtc->state to struct mtk_crtc_state and passes the result to kfree(). When reset is called without an existing state, container_of(NULL, ...) does not produce NULL. Keep the mtk state free in the same crtc->state guard as the helper state destruction. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 2d267b81898e ("drm/mtk: Use __drm_atomic_helper_crtc_reset") Signed-off-by: Ruoyu Wang --- drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/mediatek/mtk_crtc.c b/drivers/gpu/drm/mediatek/mtk_crtc.c index 8e552cdc3b53b..97e3ff412e6ee 100644 --- a/drivers/gpu/drm/mediatek/mtk_crtc.c +++ b/drivers/gpu/drm/mediatek/mtk_crtc.c @@ -154,10 +154,10 @@ static void mtk_crtc_reset(struct drm_crtc *crtc) { struct mtk_crtc_state *state; - if (crtc->state) + if (crtc->state) { __drm_atomic_helper_crtc_destroy_state(crtc->state); - - kfree(to_mtk_crtc_state(crtc->state)); + kfree(to_mtk_crtc_state(crtc->state)); + } crtc->state = NULL; state = kzalloc_obj(*state); -- 2.51.0