Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

drm/plane: Fix create_in_format_blob() return value

create_in_format_blob() is either supposed to return a valid
pointer or an error, but never NULL. The caller will dereference
the blob when it is not an error, and thus will oops if NULL
returned. Return proper error values in the failure cases.

Cc: stable@vger.kernel.org
Cc: Arun R Murthy <arun.r.murthy@intel.com>
Fixes: 0d6dcd741c26 ("drm/plane: modify create_in_formats to acommodate async")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20251112233030.24117-2-ville.syrjala@linux.intel.com
Reviewed-by: Arun R Murthy <arun.r.murthy@intel.com>

+2 -2
+2 -2
drivers/gpu/drm/drm_plane.c
··· 210 210 formats_size = sizeof(__u32) * plane->format_count; 211 211 if (WARN_ON(!formats_size)) { 212 212 /* 0 formats are never expected */ 213 - return 0; 213 + return ERR_PTR(-EINVAL); 214 214 } 215 215 216 216 modifiers_size = ··· 226 226 227 227 blob = drm_property_create_blob(dev, blob_size, NULL); 228 228 if (IS_ERR(blob)) 229 - return NULL; 229 + return blob; 230 230 231 231 blob_data = blob->data; 232 232 blob_data->version = FORMAT_BLOB_CURRENT;