Re: [PATCH 3/3] drm/nouveau: don't dereference outp before checking it in nouveau_dp_irq

[lyude@redhat.com]

Reviewed-by: Lyude Paul <lyude@redhat.com>

On Sat, 2026-08-15 at 21:54 +0200, Marek Czernohous wrote:
> From: Marek Czernohous <marek@czernohous.de>
> 
> nouveau_dp_irq() looks the encoder up and dereferences it in the same
> breath, five lines before testing it:
> 
> 	struct nouveau_encoder *outp = find_encoder(connector,
> DCB_OUTPUT_DP);
> 	struct nouveau_drm *drm = nouveau_drm(outp->base.base.dev);
> 	...
> 	if (!outp)
> 		return;
> 
> find_encoder() walks the connector's possible encoders and returns
> NULL
> when none of them matches the requested type, so the NULL test is not
> decoration: it is the author saying this can happen. The initialiser
> above it dereferences the same pointer regardless.
> 
> The NULL test predates the dereference. commit 773eb04d14a1
> ("drm/nouveau/disp: expose conn event class") turned nouveau_dp_irq()
> into a work callback, and since the drm pointer was no longer passed
> in
> as an argument it was recovered from the encoder in the declaration
> block, which put the dereference above the existing test.
> 
> Move the drm lookup below the test. No functional change when outp is
> non-NULL.
> 
> Fixes: 773eb04d14a1 ("drm/nouveau/disp: expose conn event class")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Marek Czernohous <marek@czernohous.de>
> ---
>  drivers/gpu/drm/nouveau/nouveau_dp.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/nouveau/nouveau_dp.c
> b/drivers/gpu/drm/nouveau/nouveau_dp.c
> index 55691ec44aba..738802358d85 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_dp.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_dp.c
> @@ -486,7 +486,7 @@ nouveau_dp_irq(struct work_struct *work)
>  		container_of(work, typeof(*nv_connector), irq_work);
>  	struct drm_connector *connector = &nv_connector->base;
>  	struct nouveau_encoder *outp = find_encoder(connector,
> DCB_OUTPUT_DP);
> -	struct nouveau_drm *drm = nouveau_drm(outp->base.base.dev);
> +	struct nouveau_drm *drm;
>  	struct nv50_mstm *mstm;
>  	u64 hpd = 0;
>  	int ret;
> @@ -494,6 +494,8 @@ nouveau_dp_irq(struct work_struct *work)
>  	if (!outp)
>  		return;
>  
> +	drm = nouveau_drm(outp->base.base.dev);
> +
>  	mstm = outp->dp.mstm;
>  	NV_DEBUG(drm, "service %s\n", connector->name);
>