Commit c601fd54 authored by Jonathan Cavitt's avatar Jonathan Cavitt Committed by Ville Syrjälä
Browse files

drm/client: Do not destroy NULL modes 



'modes' in drm_client_modeset_probe may fail to kcalloc.  If this
occurs, we jump to 'out', calling modes_destroy on it, which
dereferences it.  This may result in a NULL pointer dereference in the
error case.  Prevent that.

Fixes: 3039cc0c ("drm/client: Make copies of modes")
Signed-off-by: default avatarJonathan Cavitt <jonathan.cavitt@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260224221227.69126-2-jonathan.cavitt@intel.com
parent 74b6e839

drivers/gpu/drm/drm_client_modeset.c

+2 −1
Original line number Diff line number Diff line
@@ -930,6 +930,7 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, 
	mutex_unlock(&client->modeset_mutex);

out:

	kfree(crtcs);

	if (modes)

		modes_destroy(dev, modes, connector_count);

	kfree(modes);

	kfree(offsets);