Re: [syzbot] [dri?] general protection fault in drm_object_attach_property

[Edward Adam Davis]

#syz test

diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 11646453aaac..12f4c5fcec92 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -2175,8 +2175,12 @@ int drm_mode_create_tv_properties_legacy(struct drm_device *dev,
 	struct drm_property *tv_subconnector;
 	unsigned int i;
 
-	if (dev->mode_config.tv_select_subconnector_property)
+	if (dev->mode_config.tv_select_subconnector_property) {
+		if (num_modes && !dev->mode_config.legacy_tv_mode_property)
+			goto tv_mode;
+
 		return 0;
+	}
 
 	/*
 	 * Basic connector properties
@@ -2205,18 +2209,6 @@ int drm_mode_create_tv_properties_legacy(struct drm_device *dev,
 	if (drm_mode_create_tv_margin_properties(dev))
 		goto nomem;
 
-	if (num_modes) {
-		dev->mode_config.legacy_tv_mode_property =
-			drm_property_create(dev, DRM_MODE_PROP_ENUM,
-					    "mode", num_modes);
-		if (!dev->mode_config.legacy_tv_mode_property)
-			goto nomem;
-
-		for (i = 0; i < num_modes; i++)
-			drm_property_add_enum(dev->mode_config.legacy_tv_mode_property,
-					      i, modes[i]);
-	}
-
 	dev->mode_config.tv_brightness_property =
 		drm_property_create_range(dev, 0, "brightness", 0, 100);
 	if (!dev->mode_config.tv_brightness_property)
@@ -2247,6 +2239,19 @@ int drm_mode_create_tv_properties_legacy(struct drm_device *dev,
 	if (!dev->mode_config.tv_hue_property)
 		goto nomem;
 
+tv_mode:
+	if (num_modes) {
+		dev->mode_config.legacy_tv_mode_property =
+			drm_property_create(dev, DRM_MODE_PROP_ENUM,
+					    "mode", num_modes);
+		if (!dev->mode_config.legacy_tv_mode_property)
+			goto nomem;
+
+		for (i = 0; i < num_modes; i++)
+			drm_property_add_enum(dev->mode_config.legacy_tv_mode_property,
+					      i, modes[i]);
+	}
+
 	return 0;
 nomem:
 	return -ENOMEM;