Ruoyu Wang <[email protected]> 於 2026年7月7日週二 下午3:05寫道： > > mtk_crtc_reset() destroys the current CRTC state only when crtc->state > is non-NULL, but it always converts crtc->state to struct mtk_crtc_state > and passes the result to kfree(). > > When reset is called without an existing state, container_of(NULL, ...) > does not produce NULL. Keep the mtk state free in the same crtc->state > guard as the helper state destruction. > > This issue was found by a static analysis checker and confirmed by > manual source review.
Applied to mediatek-drm-fixes [1], thanks. [1] https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux.git/log/?h=mediatek-drm-fixes Regards, Chun-Kuang. > > Fixes: 2d267b81898e ("drm/mtk: Use __drm_atomic_helper_crtc_reset") > Signed-off-by: Ruoyu Wang <[email protected]> > --- > drivers/gpu/drm/mediatek/mtk_crtc.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/mediatek/mtk_crtc.c > b/drivers/gpu/drm/mediatek/mtk_crtc.c > index 8e552cdc3b53b..97e3ff412e6ee 100644 > --- a/drivers/gpu/drm/mediatek/mtk_crtc.c > +++ b/drivers/gpu/drm/mediatek/mtk_crtc.c > @@ -154,10 +154,10 @@ static void mtk_crtc_reset(struct drm_crtc *crtc) > { > struct mtk_crtc_state *state; > > - if (crtc->state) > + if (crtc->state) { > __drm_atomic_helper_crtc_destroy_state(crtc->state); > - > - kfree(to_mtk_crtc_state(crtc->state)); > + kfree(to_mtk_crtc_state(crtc->state)); > + } > crtc->state = NULL; > > state = kzalloc_obj(*state); > -- > 2.51.0 >
