From: Laurent Pinchart Date: Wed, 8 Apr 2026 12:42:05 +0000 (+0300) Subject: drm: rcar-du: Fix crash when no CMM is available X-Git-Tag: v7.1-rc1~24^2~1^2 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=f6c73e7156b54d8b9ddf1a27f4e93d3a1e49a73e;p=thirdparty%2Fkernel%2Flinux.git drm: rcar-du: Fix crash when no CMM is available Commit 3bce3fdd1ff2 ("drm: rcar-du: Don't leak device_link to CMM") refactored CMM handling, and introduced an incorrect test for CMM availability. When no CMM is present, the rcrtc->cmm field is NULL, testing rcrtc->cmm->dev causes a NULL pointer dereference. This slipped through testing as all tests were run with the CMM present. Fix this issue by correctly testing for rcrtc->cmm. Fixes: 3bce3fdd1ff2 ("drm: rcar-du: Don't leak device_link to CMM") Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/dri-devel/CAMuHMdXomz9GFDqkBjGX9Sda_GLccPcrihvFbOz0GAitDVNTbw@mail.gmail.com Signed-off-by: Laurent Pinchart Tested-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260408124205.1962448-1-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Tomi Valkeinen (cherry picked from commit 3e9a1da270ddff449b1ad9eadc958f43bc204bd2) Signed-off-by: Tomi Valkeinen --- diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/renesas/rcar-du/rcar_du_crtc.c index 7c36c30a75b63..1a246ebbfc613 100644 --- a/drivers/gpu/drm/renesas/rcar-du/rcar_du_crtc.c +++ b/drivers/gpu/drm/renesas/rcar-du/rcar_du_crtc.c @@ -513,7 +513,7 @@ static void rcar_du_cmm_setup(struct drm_crtc *crtc) struct rcar_du_crtc *rcrtc = to_rcar_crtc(crtc); struct rcar_cmm_config cmm_config = {}; - if (!rcrtc->cmm->dev) + if (!rcrtc->cmm) return; if (drm_lut) @@ -667,7 +667,7 @@ static void rcar_du_crtc_stop(struct rcar_du_crtc *rcrtc) if (rcar_du_has(rcrtc->dev, RCAR_DU_FEATURE_VSP1_SOURCE)) rcar_du_vsp_disable(rcrtc); - if (rcrtc->cmm->dev) + if (rcrtc->cmm) rcar_cmm_disable(rcrtc->cmm->dev); /* @@ -726,7 +726,7 @@ static void rcar_du_crtc_atomic_enable(struct drm_crtc *crtc, struct rcar_du_crtc_state *rstate = to_rcar_crtc_state(crtc->state); struct rcar_du_device *rcdu = rcrtc->dev; - if (rcrtc->cmm->dev) + if (rcrtc->cmm) rcar_cmm_enable(rcrtc->cmm->dev); rcar_du_crtc_get(rcrtc);