-----Original Message----- From: Ville Syrjala ville.syrjala@linux.intel.com Sent: Thursday, November 13, 2025 5:00 AM To: dri-devel@lists.freedesktop.org Cc: intel-gfx@lists.freedesktop.org; intel-xe@lists.freedesktop.org; stable@vger.kernel.org; Murthy, Arun R arun.r.murthy@intel.com Subject: [PATCH 1/3] drm/plane: Fix create_in_format_blob() return value

From: Ville Syrjälä ville.syrjala@linux.intel.com

create_in_format_blob() is either supposed to return a valid pointer or an error, but never NULL. The caller will dereference the blob when it is not an error, and thus will oops if NULL returned. Return proper error values in the failure cases.

Cc: stable@vger.kernel.org Cc: Arun R Murthy arun.r.murthy@intel.com Fixes: 0d6dcd741c26 ("drm/plane: modify create_in_formats to acommodate async") Signed-off-by: Ville Syrjälä ville.syrjala@linux.intel.com

---

Reviewed-by: Arun R Murthy arun.r.murthy@intel.com

Thanks and Regards, Arun R Murthy --------------------

drivers/gpu/drm/drm_plane.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c index 38f82391bfda..a30493ed9715 100644 --- a/drivers/gpu/drm/drm_plane.c +++ b/drivers/gpu/drm/drm_plane.c @@ -210,7 +210,7 @@ static struct drm_property_blob *create_in_format_blob(struct drm_device *dev, formats_size = sizeof(__u32) * plane->format_count; if (WARN_ON(!formats_size)) { /* 0 formats are never expected */

• return 0;
  

• return ERR_PTR(-EINVAL);
  

  }

  modifiers_size =

@@ -226,7 +226,7 @@ static struct drm_property_blob *create_in_format_blob(struct drm_device *dev,

blob = drm_property_create_blob(dev, blob_size, NULL); if (IS_ERR(blob))

• return NULL;
  

• return blob;
  
  

  blob_data = blob->data; blob_data->version = FORMAT_BLOB_CURRENT;

-- 2.49.1