* [PATCH] drm/panthor: Fix NULL pointer dereference in sync signal cleanup
@ 2026-11-13 9:44 Tuo Li
0 siblings, 0 replies; only message in thread
From: Tuo Li @ 2026-11-13 9:44 UTC (permalink / raw)
To: boris.brezillon, steven.price, liviu.dudau, maarten.lankhorst,
mripard, tzimmermann, airlied, simona
Cc: dri-devel, linux-kernel, Tuo Li
In panthor_submit_ctx_add_sync_signal(), drm_syncobj_find() may return
NULL. The function then jumps to err_free_sig_sync, where
panthor_sync_signal_free() unconditionally calls drm_syncobj_put() on
the NULL pointer, causing a NULL pointer dereference.
Check sig_sync->syncobj before calling drm_syncobj_put() to avoid the
NULL pointer dereference.
Fixes: 4bdca1150792 ("drm/panthor: Add the driver frontend block")
Signed-off-by: Tuo Li <islituo@gmail.com>
---
drivers/gpu/drm/panthor/panthor_drv.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panthor/panthor_drv.c b/drivers/gpu/drm/panthor/panthor_drv.c
index dc8d0191aef4..8d73956530a8 100644
--- a/drivers/gpu/drm/panthor/panthor_drv.c
+++ b/drivers/gpu/drm/panthor/panthor_drv.c
@@ -364,7 +364,9 @@ panthor_sync_signal_free(struct panthor_sync_signal *sig_sync)
if (!sig_sync)
return;
- drm_syncobj_put(sig_sync->syncobj);
+ if (sig_sync->syncobj)
+ drm_syncobj_put(sig_sync->syncobj);
+
dma_fence_chain_free(sig_sync->chain);
dma_fence_put(sig_sync->fence);
kfree(sig_sync);
--
2.43.0
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-11-13 9:45 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-11-13 9:44 [PATCH] drm/panthor: Fix NULL pointer dereference in sync signal cleanup Tuo Li
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®