From nobody Sun Jun 14 08:49:32 2026 Received: from ewsoutbound.kpnmail.nl (ewsoutbound.kpnmail.nl [195.121.94.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8DCE8324705 for ; Thu, 2 Apr 2026 01:51:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=195.121.94.183 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775094706; cv=none; b=jZCXLKeRKCv/5oVb0iLdj4WHZ81W1kqrstuInm46DxsYVLbcuiCWXeodMbaUFkK4sS/tnTH8nCzRxbIucoIBCibDcNDecxSp+hc1j0SSNIJeIntfsaDirme/b07xIf6O1Cy7iu+pdbq5FIc4ymqGtZyRhb1ljoZG12SHb97E2K8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775094706; c=relaxed/simple; bh=E54ozJr+k3CmHrCH4TMn9EIXNhC6N/f0+82xMEaE0A4=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=jvKIkgv8nkS0Ql7cEfNDHvB2BsT33HNdLMZvfYph/j85QDVvPgvE4Mp7M1Ft6UZYHCFi8SrlHP292jcaC2q7M2qJDVqrNRy+8qPYm9wsGetzqpHJ5j7+3TAXd+P0iM8O3AS/WffYzmK4PNOvym6Qepoa8VjZybWr+tuk9hk+1eA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=xs4all.nl; spf=pass smtp.mailfrom=xs4all.nl; dkim=pass (2048-bit key) header.d=xs4all.nl header.i=@xs4all.nl header.b=kWr5bTlg; arc=none smtp.client-ip=195.121.94.183 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=xs4all.nl Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=xs4all.nl Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=xs4all.nl header.i=@xs4all.nl header.b="kWr5bTlg" X-KPN-MessageId: 7c158a5f-2e36-11f1-bea8-005056992ed3 Received: from smtp.kpnmail.nl (unknown [10.31.155.8]) by ewsoutbound.so.kpn.org (Halon) with ESMTPS id 7c158a5f-2e36-11f1-bea8-005056992ed3; Thu, 02 Apr 2026 03:51:37 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=xs4all.nl; s=xs4all01; h=mime-version:message-id:date:subject:to:from; bh=Upu3hspDUQtPDlHPtVRD7wHM/YoMYhyMfZlDEsMhLIQ=; b=kWr5bTlgUBAsYCFVZvEZKISUNJ8aAWb4r6CH1rdr3mDXF6e3cWXgZGeFpiLVXiht3o2mbQoE7K9RM jUsRuGOX5zT2x5SgY6oibHmgY+Rc2epyX/p3NOOydgwefv+2f3fdcvKGW4ON6zaZgz7ZsMuP4OPtIm UrJIxmgHrw0BRketDnTCBWOpSqKOEu56j8y6K+nQmWm5iUkGgo3LvLsabvTKKEaoeQOnS2iz1PpJm4 gHq7Pj7/h6lSmkTvVEqPaXaOgxhnoJieKYim+Kczogweh4wtIfzqBKyfHpm1Y0LQUPEMYUa7bemHjJ t7m0XwuGt8QNfVQ+RM6sRok+TtBqA4Q== X-KPN-MID: 33|d0yl7Q98SvCfDXiXT6MNI3+M172r2vhAevaezgnNeMz7hc66nPLLkBqAN87QFmi E99pckkSYaE7vMoavjHuq9kgBSZ7B6v7O82uXlivcUDY= X-KPN-VerifiedSender: Yes X-CMASSUN: 33|+eor1/XExEcGHdwXtd/w6CzghpLDsdomTA1L9wkEUJS6tTi4SqdF45cNcFGDY9T mPNBFmETAlbD/OH8ZPHhbVg== Received: from DESKTOP-40RM2Q1.localdomain (unknown [188.212.113.114]) by smtp.xs4all.nl (Halon) with ESMTPSA id 77d246e9-2e36-11f1-9c09-00505699d6e5; Thu, 02 Apr 2026 03:51:36 +0200 (CEST) From: Henri Zikken To: Emma Anholt , Maxime Ripard Cc: David Airlie , Daniel Vetter , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Henri Zikken , root Subject: [PATCH] drm/vc4: Fix NULL pointer dereference in vc4_plane_create_additional_planes Date: Thu, 2 Apr 2026 01:51:01 +0000 Message-Id: <20260402015101.3328-1-zikken@xs4all.nl> X-Mailer: git-send-email 2.39.5 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a vc4 DRM device has no TXP (Writeback) CRTC, txp_crtc remains uninitialized after the drm_for_each_crtc loop. Subsequent calls to drm_crtc_mask(txp_crtc) then dereference a NULL pointer, causing a kernel panic. This was observed on Raspberry Pi Zero 2W with a DPI panel connected, where vc4_dpi_dev_probe triggers vc4_drm_bind which calls vc4_plane_create_additional_planes without a TXP being present. Fix by initializing txp_crtc to NULL and guarding all drm_crtc_mask() calls on txp_crtc with a NULL check. Fixes: (vc4_plane_create_additional_planes introduction) Signed-off-by: Henri Zikken Signed-off-by: root --- drivers/gpu/drm/vc4/vc4_plane.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plan= e.c index fdd6ba310..c43c12c2c 100644 --- a/drivers/gpu/drm/vc4/vc4_plane.c +++ b/drivers/gpu/drm/vc4/vc4_plane.c @@ -2665,7 +2665,7 @@ int vc4_plane_create_additional_planes(struct drm_dev= ice *drm) struct drm_plane *cursor_plane; struct drm_crtc *crtc; unsigned int i; - struct drm_crtc *txp_crtc; + struct drm_crtc *txp_crtc =3D NULL; uint32_t non_txp_crtc_mask; =20 drm_for_each_crtc(crtc, drm) { @@ -2678,7 +2678,7 @@ int vc4_plane_create_additional_planes(struct drm_dev= ice *drm) } =20 non_txp_crtc_mask =3D GENMASK(drm->mode_config.num_crtc - 1, 0) - - drm_crtc_mask(txp_crtc); + (txp_crtc ? drm_crtc_mask(txp_crtc) : 0); =20 /* Set up some arbitrary number of planes. We're not limited * by a set number of physical registers, just the space in @@ -2707,7 +2707,7 @@ int vc4_plane_create_additional_planes(struct drm_dev= ice *drm) for (i =3D 0; i < VC4_NUM_TXP_OVERLAY_PLANES; i++) { struct drm_plane *plane =3D vc4_plane_init(drm, DRM_PLANE_TYPE_OVERLAY, - drm_crtc_mask(txp_crtc)); + (txp_crtc ? drm_crtc_mask(txp_crtc) : 0)); =20 if (IS_ERR(plane)) continue; --=20 2.39.5