diff options
| author | Ville Syrjälä <ville.syrjala@linux.intel.com> | 2025-11-13 01:30:28 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-12-01 11:45:47 +0100 |
| commit | 860f93f4fce1e733b8a2474f6bfa153243d775f3 (patch) | |
| tree | 1eabccbd57b79069d331553470e0a36305d2efa8 /drivers/gpu | |
| parent | 7e3e9b3a44c23c8eac86a41308c05077d6d30f41 (diff) | |
| download | linux-860f93f4fce1e733b8a2474f6bfa153243d775f3.tar.gz linux-860f93f4fce1e733b8a2474f6bfa153243d775f3.tar.bz2 linux-860f93f4fce1e733b8a2474f6bfa153243d775f3.zip | |
drm/plane: Fix create_in_format_blob() return value
commit cead55e24cf9e092890cf51c0548eccd7569defa upstream.
create_in_format_blob() is either supposed to return a valid
pointer or an error, but never NULL. The caller will dereference
the blob when it is not an error, and thus will oops if NULL
returned. Return proper error values in the failure cases.
Cc: stable@vger.kernel.org
Cc: Arun R Murthy <arun.r.murthy@intel.com>
Fixes: 0d6dcd741c26 ("drm/plane: modify create_in_formats to acommodate async")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20251112233030.24117-2-ville.syrjala@linux.intel.com
Reviewed-by: Arun R Murthy <arun.r.murthy@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/drm_plane.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c index 38f82391bfda..a30493ed9715 100644 --- a/drivers/gpu/drm/drm_plane.c +++ b/drivers/gpu/drm/drm_plane.c @@ -210,7 +210,7 @@ static struct drm_property_blob *create_in_format_blob(struct drm_device *dev, formats_size = sizeof(__u32) * plane->format_count; if (WARN_ON(!formats_size)) { /* 0 formats are never expected */ - return 0; + return ERR_PTR(-EINVAL); } modifiers_size = @@ -226,7 +226,7 @@ static struct drm_property_blob *create_in_format_blob(struct drm_device *dev, blob = drm_property_create_blob(dev, blob_size, NULL); if (IS_ERR(blob)) - return NULL; + return blob; blob_data = blob->data; blob_data->version = FORMAT_BLOB_CURRENT; |