drm/client: Do not destroy NULL modes

'modes' in drm_client_modeset_probe may fail to kcalloc.  If this
occurs, we jump to 'out', calling modes_destroy on it, which
dereferences it.  This may result in a NULL pointer dereference in the
error case.  Prevent that.

Fixes: 3039cc0c0653 ("drm/client: Make copies of modes")
Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260224221227.69126-2-jonathan.cavitt@intel.com

diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c
index 262b1b8773c58b7613181daa4b98f49973d04a15..bb49b8361271a3f8a09a2f0579f4fe1d2271b2d8 100644 (file)
--- a/drivers/gpu/drm/drm_client_modeset.c
+++ b/drivers/gpu/drm/drm_client_modeset.c
@@ -930,7 +930,8 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width,
        mutex_unlock(&client->modeset_mutex);
 out:
        kfree(crtcs);
-       modes_destroy(dev, modes, connector_count);
+       if (modes)
+               modes_destroy(dev, modes, connector_count);
        kfree(modes);
        kfree(offsets);
        kfree(enabled);