[PATCH] drm/panthor: Fix NULL pointer dereference in sync signal cleanup
From: Tuo Li
Date: Fri Nov 13 2026 - 16:32:22 EST
In panthor_submit_ctx_add_sync_signal(), drm_syncobj_find() may return
NULL. The function then jumps to err_free_sig_sync, where
panthor_sync_signal_free() unconditionally calls drm_syncobj_put() on
the NULL pointer, causing a NULL pointer dereference.
Check sig_sync->syncobj before calling drm_syncobj_put() to avoid the
NULL pointer dereference.
Fixes: 4bdca1150792 ("drm/panthor: Add the driver frontend block")
Signed-off-by: Tuo Li <islituo@xxxxxxxxx>
---
drivers/gpu/drm/panthor/panthor_drv.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panthor/panthor_drv.c b/drivers/gpu/drm/panthor/panthor_drv.c
index dc8d0191aef4..8d73956530a8 100644
--- a/drivers/gpu/drm/panthor/panthor_drv.c
+++ b/drivers/gpu/drm/panthor/panthor_drv.c
@@ -364,7 +364,9 @@ panthor_sync_signal_free(struct panthor_sync_signal *sig_sync)
if (!sig_sync)
return;
- drm_syncobj_put(sig_sync->syncobj);
+ if (sig_sync->syncobj)
+ drm_syncobj_put(sig_sync->syncobj);
+
dma_fence_chain_free(sig_sync->chain);
dma_fence_put(sig_sync->fence);
kfree(sig_sync);
--
2.43.0