In jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it
may be NULL:

  if (!jdi)
    mipi_dsi_detach(dsi);

However, when jdi is NULL, the function does not return and continues by
calling jdi_panel_disable():

  err = jdi_panel_disable(&jdi->base);

Inside jdi_panel_disable(), jdi is dereferenced unconditionally, which can
lead to a NULL-pointer dereference:

  struct jdi_panel *jdi = to_panel_jdi(panel);
  backlight_disable(jdi->backlight);

To prevent such a potential NULL-pointer dereference, return early from
jdi_panel_dsi_remove() when jdi is NULL.

Signed-off-by: Tuo Li <islituo@gmail.com>
---
 drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
index 23462065d726..ea975170faff 100644
--- a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
+++ b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
@@ -434,8 +434,10 @@ static void jdi_panel_dsi_remove(struct mipi_dsi_device *dsi)
 	int err;
 
 	/* only detach from host for the DSI-LINK2 interface */
-	if (!jdi)
+	if (!jdi) {
 		mipi_dsi_detach(dsi);
+		return;
+	}
 
 	err = jdi_panel_disable(&jdi->base);
 	if (err < 0)
-- 
2.43.0

Hi,

On Thu, 18 Dec 2025 20:09:55 +0800, Tuo Li wrote:
> In jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it
> may be NULL:
> 
>   if (!jdi)
>     mipi_dsi_detach(dsi);
> 
> However, when jdi is NULL, the function does not return and continues by
> calling jdi_panel_disable():
> 
> [...]

Thanks, Applied to https://gitlab.freedesktop.org/drm/misc/kernel.git (drm-misc-next)

[1/1] drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove()
      https://gitlab.freedesktop.org/drm/misc/kernel/-/commit/95eed73b871111123a8b1d31cb1fce7e902e49ea

-- 
Neil

On 12/18/25 13:09, Tuo Li wrote:
> In jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it
> may be NULL:
> 
>    if (!jdi)
>      mipi_dsi_detach(dsi);
> 
> However, when jdi is NULL, the function does not return and continues by
> calling jdi_panel_disable():
> 
>    err = jdi_panel_disable(&jdi->base);
> 
> Inside jdi_panel_disable(), jdi is dereferenced unconditionally, which can
> lead to a NULL-pointer dereference:
> 
>    struct jdi_panel *jdi = to_panel_jdi(panel);
>    backlight_disable(jdi->backlight);
> 
> To prevent such a potential NULL-pointer dereference, return early from
> jdi_panel_dsi_remove() when jdi is NULL.
> 
> Signed-off-by: Tuo Li <islituo@gmail.com>
> ---
>   drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
> index 23462065d726..ea975170faff 100644
> --- a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
> +++ b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
> @@ -434,8 +434,10 @@ static void jdi_panel_dsi_remove(struct mipi_dsi_device *dsi)
>   	int err;
>   
>   	/* only detach from host for the DSI-LINK2 interface */
> -	if (!jdi)
> +	if (!jdi) {
>   		mipi_dsi_detach(dsi);
> +		return;
> +	}
>   
>   	err = jdi_panel_disable(&jdi->base);
>   	if (err < 0)

Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>

Thanks,
Neil