Bug 216338

Summary:	Null Pointer Dereference in rockchip_drm_vop2.c
Product:	Drivers	Reporter:	Chris Morgan (macromorgan)
Component:	Video(DRI - non Intel)	Assignee:	drivers_video-dri
Status:	NEW ---
Severity:	normal
Priority:	P1
Hardware:	ARM
OS:	Linux
Kernel Version:	5.19.0	Subsystem:
Regression:	No	Bisected commit-id:

Description Chris Morgan 2022-08-08 14:40:01 UTC

When you use more than 1 video port (VP0 and VP1, for instance) on a Rockchip RK3566 with the VOP2 driver, the driver issues a null pointer dereference when it gets to the drm_crtc_init_with_planes function here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c?h=v5.19#n2333

This appears to be because the function above it assigns primary planes to all active video ports, but since it has special logic for the RK3566 it only ends up with 1 primary plane to assign to a video port. When it encounters a second video port it assigns it nothing, and then triggers a null pointer dereference when it gets to the drm_crtc_init_with_planes function because plane is null.