[PATCH 5.10/5.15 v2] drm/sun4i: backend: fix error pointer dereference

[Elizaveta Tereshkina]

From: Ethan Tidmore <ethantidmore06@xxxxxxxxx>

commit 06277983eca4a31d3c2114fa33d99a6e82484b11 upstream.

The function drm_atomic_get_plane_state() can return an error pointer
and is not checked for it. Add error pointer check.

Detected by Smatch:
drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error:
'plane_state' dereferencing possible ERR_PTR()

Fixes: 96180dde23b79 ("drm/sun4i: backend: Add a custom atomic_check for the frontend")
Signed-off-by: Ethan Tidmore <ethantidmore06@xxxxxxxxx>
Reviewed-by: Chen-Yu Tsai <wens@xxxxxxxxxx>
Link: https://patch.msgid.link/20260217014801.60760-1-ethantidmore06@xxxxxxxxx
Signed-off-by: Chen-Yu Tsai <wens@xxxxxxxxxx>
Signed-off-by: Elizaveta Tereshkina <etereshkina@xxxxxxxxxxxxx>
---
Backport fix for CVE-2026-53066

v2: Separate variables declarations to avoid instance of warning due to
lack of b5ec6fd286df ("kbuild: Drop -Wdeclaration-after-statement")

 drivers/gpu/drm/sun4i/sun4i_backend.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
index 9c4581a3b65f..20740ff02a81 100644
--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
@@ -505,13 +505,19 @@ static int sun4i_backend_atomic_check(struct sunxi_engine *engine,
 		return 0;
 
 	drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) {
-		struct drm_plane_state *plane_state =
-			drm_atomic_get_plane_state(state, plane);
-		struct sun4i_layer_state *layer_state =
-			state_to_sun4i_layer_state(plane_state);
-		struct drm_framebuffer *fb = plane_state->fb;
+		struct drm_plane_state *plane_state;
+		struct sun4i_layer_state *layer_state;
+		struct drm_framebuffer *fb;
 		struct drm_format_name_buf format_name;
 
+		plane_state = drm_atomic_get_plane_state(state, plane);
+
+		if (IS_ERR(plane_state))
+			return PTR_ERR(plane_state);
+
+		layer_state = state_to_sun4i_layer_state(plane_state);
+		fb = plane_state->fb;
+
 		if (!sun4i_backend_plane_is_supported(plane_state,
 						      &layer_state->uses_frontend))
 			return -EINVAL;
-- 
2.43.0