drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

[PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

Posted by Haojie Li 1 month, 1 week ago

platform_device_register_data() can fail and return an ERR_PTR, but the
return value is used without checking, leading to an invalid pointer
being stored in ddp_comp[].dev and passed to component_match_add() and
mtk_ddp_comp_init(), which could result in a kernel crash.

Add an IS_ERR() check to jump to the error handling path on failure.

Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195")
Cc: stable@vger.kernel.org
Signed-off-by: Haojie Li <lihaojie@kylinos.cn>
---
 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index c86a3f54f35b..667d7fdbfbac 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -1112,6 +1112,10 @@ static int mtk_drm_probe(struct platform_device *pdev)
 							    PLATFORM_DEVID_AUTO,
 							    (void *)private->mmsys_dev,
 							    sizeof(*private->mmsys_dev));
+		if (IS_ERR(ovl_adaptor)) {
+			ret = PTR_ERR(ovl_adaptor);
+			goto err_node;
+		}
 		private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev = &ovl_adaptor->dev;
 		mtk_ddp_comp_init(dev, NULL, &private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR],
 				  DDP_COMPONENT_DRM_OVL_ADAPTOR);
-- 
2.25.1

Re: [PATCH] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

Posted by CK Hu (胡俊光) 1 month ago

Hi, Haojie:

On Wed, 2026-08-19 at 14:56 +0800, Haojie Li wrote:
> External email : Please do not click links or open attachments until you have verified the sender or the content.
> 
> 
> platform_device_register_data() can fail and return an ERR_PTR, but the
> return value is used without checking, leading to an invalid pointer
> being stored in ddp_comp[].dev and passed to component_match_add() and
> mtk_ddp_comp_init(), which could result in a kernel crash.
> 
> Add an IS_ERR() check to jump to the error handling path on failure.
> 
> Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haojie Li <lihaojie@kylinos.cn>
> ---
>  drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index c86a3f54f35b..667d7fdbfbac 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -1112,6 +1112,10 @@ static int mtk_drm_probe(struct platform_device *pdev)
>                                                             PLATFORM_DEVID_AUTO,
>                                                             (void *)private->mmsys_dev,
>                                                             sizeof(*private->mmsys_dev));
> +               if (IS_ERR(ovl_adaptor)) {
> +                       ret = PTR_ERR(ovl_adaptor);
> +                       goto err_node;

return PTR_ERR(ovl_adaptor);

Regards,
CK

> +               }
>                 private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev = &ovl_adaptor->dev;
>                 mtk_ddp_comp_init(dev, NULL, &private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR],
>                                   DDP_COMPONENT_DRM_OVL_ADAPTOR);
> --
> 2.25.1
> 
>

[PATCH v2] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

Posted by Haojie Li 1 month ago

platform_device_register_data() can fail and return an ERR_PTR, but the
return value is used without checking, leading to an invalid pointer
being stored in ddp_comp[].dev and passed to component_match_add() and
mtk_ddp_comp_init(), which could result in a kernel crash.

Add an IS_ERR() check to jump to the error handling path on failure.

Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195")
Cc: stable@vger.kernel.org
Signed-off-by: Haojie Li <lihaojie@kylinos.cn>
---
 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index c86a3f54f35b..b281482ab8c8 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -1112,6 +1112,9 @@ static int mtk_drm_probe(struct platform_device *pdev)
 							    PLATFORM_DEVID_AUTO,
 							    (void *)private->mmsys_dev,
 							    sizeof(*private->mmsys_dev));
+		if (IS_ERR(ovl_adaptor))
+			return PTR_ERR(ovl_adaptor);
+
 		private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev = &ovl_adaptor->dev;
 		mtk_ddp_comp_init(dev, NULL, &private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR],
 				  DDP_COMPONENT_DRM_OVL_ADAPTOR);
-- 
2.25.1

Re: [PATCH v2] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

Posted by CK Hu (胡俊光) 1 month ago

On Tue, 2026-08-25 at 18:08 +0800, Haojie Li wrote:
> External email : Please do not click links or open attachments until you have verified the sender or the content.
> 
> 
> platform_device_register_data() can fail and return an ERR_PTR, but the
> return value is used without checking, leading to an invalid pointer
> being stored in ddp_comp[].dev and passed to component_match_add() and
> mtk_ddp_comp_init(), which could result in a kernel crash.
> 
> Add an IS_ERR() check to jump to the error handling path on failure.

Reviewed-by: CK Hu <ck.hu@mediatek.com>

> 
> Fixes: 0d9eee9118b7 ("drm/mediatek: Add drm ovl_adaptor sub driver for MT8195")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haojie Li <lihaojie@kylinos.cn>
> ---
>  drivers/gpu/drm/mediatek/mtk_drm_drv.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index c86a3f54f35b..b281482ab8c8 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -1112,6 +1112,9 @@ static int mtk_drm_probe(struct platform_device *pdev)
>                                                             PLATFORM_DEVID_AUTO,
>                                                             (void *)private->mmsys_dev,
>                                                             sizeof(*private->mmsys_dev));
> +               if (IS_ERR(ovl_adaptor))
> +                       return PTR_ERR(ovl_adaptor);
> +
>                 private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR].dev = &ovl_adaptor->dev;
>                 mtk_ddp_comp_init(dev, NULL, &private->ddp_comp[DDP_COMPONENT_DRM_OVL_ADAPTOR],
>                                   DDP_COMPONENT_DRM_OVL_ADAPTOR);
> --
> 2.25.1
>