From 73c3ed7495c67b8fbdc31cf58e6ca8757df31a33 Mon Sep 17 00:00:00 2001

From: Jiasheng Jiang <jiasheng@iscas.ac.cn>

Date: Tue, 14 Dec 2021 18:08:37 +0800

Subject: [PATCH] drm: mali-dp: potential dereference of null pointer

Git-commit: 73c3ed7495c67b8fbdc31cf58e6ca8757df31a33

Patch-mainline: v5.19-rc1

References: CVE-2022-3115 bsc#1206393

The return value of kzalloc() needs to be checked.

To avoid use of null pointer '&state->base' in case of the

failure of alloc.

Fixes: 99665d072183 ("drm: mali-dp: add malidp_crtc_state struct")

Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>

Reviewed-by: Brian Starkey <brian.starkey@arm.com>

Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>

Link: https://patchwork.freedesktop.org/patch/msgid/20211214100837.46912-1-jiasheng@iscas.ac.cn

Acked-by: Takashi Iwai <tiwai@suse.de>

---

 drivers/gpu/drm/arm/malidp_crtc.c | 5 ++++-

 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/arm/malidp_crtc.c b/drivers/gpu/drm/arm/malidp_crtc.c

index 494075ddbef6..b5928b52e279 100644

--- a/drivers/gpu/drm/arm/malidp_crtc.c

+++ b/drivers/gpu/drm/arm/malidp_crtc.c

@@ -487,7 +487,10 @@ static void malidp_crtc_reset(struct drm_crtc *crtc)

 	if (crtc->state)

 		malidp_crtc_destroy_state(crtc, crtc->state);

-	__drm_atomic_helper_crtc_reset(crtc, &state->base);

+	if (state)

+		__drm_atomic_helper_crtc_reset(crtc, &state->base);

+	else

+		__drm_atomic_helper_crtc_reset(crtc, NULL);

 }

 static int malidp_crtc_enable_vblank(struct drm_crtc *crtc)

-- 

2.35.3