From: Ethan Tidmore <[email protected]>
commit 06277983eca4a31d3c2114fa33d99a6e82484b11 upstream.
The function drm_atomic_get_plane_state() can return an error pointer
and is not checked for it. Add error pointer check.
Detected by Smatch:
drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error:
'plane_state' dereferencing possible ERR_PTR()
Fixes: 96180dde23b79 ("drm/sun4i: backend: Add a custom atomic_check for the
frontend")
Signed-off-by: Ethan Tidmore <[email protected]>
Reviewed-by: Chen-Yu Tsai <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Chen-Yu Tsai <[email protected]>
Signed-off-by: Elizaveta Tereshkina <[email protected]>
---
Backport fix for CVE-2026-53066
drivers/gpu/drm/sun4i/sun4i_backend.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c
b/drivers/gpu/drm/sun4i/sun4i_backend.c
index d935f36a24dd..b3741827c6c3 100644
--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
@@ -507,6 +507,9 @@ static int sun4i_backend_atomic_check(struct sunxi_engine
*engine,
drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) {
struct drm_plane_state *plane_state =
drm_atomic_get_plane_state(state, plane);
+ if (IS_ERR(plane_state))
+ return PTR_ERR(plane_state);
+
struct sun4i_layer_state *layer_state =
state_to_sun4i_layer_state(plane_state);
struct drm_framebuffer *fb = plane_state->fb;
--
2.39.2
