host1x: bus: Fix missing ops null check in error teardown

PATCH Applied shayderrr 2 participants 2 messages May 17 – May 28

Subsystems (3)

DRM drivers Tegra architecture support DRM drivers for NVIDIA Tegra

lore

Share & tools

lore

shayderrr

author

2026-05-17 17:05 UTC #0 lore raw

PATCH 1/1 host1x: bus: Fix missing ops null check in error teardown

In host1x_device_init(), the error teardown paths do not check client->ops before dereferencing it, unlike the forward init paths which correctly guard with 'client->ops &&'. This can result in a NULL pointer dereference if client->ops is NULL.

Fix by adding the missing client->ops check in both the teardown and teardown_late labels.

Signed-off-by shayderrr <[email protected]>

---
 drivers/gpu/host1x/bus.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/gpu/host1x/bus.c +2 -2

index f814eb4941c0..43ce048de73a 100644
@@ -221,7 +221,7 @@ int host1x_device_init(struct host1x_device *device)
 
 teardown:
 	list_for_each_entry_continue_reverse(client, &device->clients, list)
-		if (client->ops->exit)
+		if (client->ops && client->ops->exit)
 			client->ops->exit(client);
 
 	/* reset client to end of list for late teardown */

@@ -229,7 +229,7 @@ int host1x_device_init(struct host1x_device *device)
 
 teardown_late:
 	list_for_each_entry_continue_reverse(client, &device->clients, list)
-		if (client->ops->late_exit)
+		if (client->ops && client->ops->late_exit)
 			client->ops->late_exit(client);
 
 	mutex_unlock(&device->clients_lock);

Signature · 1 line

2.50.1 (Apple Git-155)

Thierry Reding

maintainer Applied

2026-05-28 13:30 UTC #1 lore raw

Quoted 5 lines · shayderrr

In host1x_device_init(), the error teardown paths do not check client->ops before dereferencing it, unlike the forward init paths which correctly guard with 'client->ops &&'. This can result in a NULL pointer dereference if client->ops is NULL.

Quoted 7 lines

Fix by adding the missing client->ops check in both the teardown and teardown_late labels.
Signed-off-by shayderrr <[email protected]>
---
 drivers/gpu/host1x/bus.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

I don't think this can ever happen because all clients do implement the ops structure, but since we have them in the code above, makes sense to be consistent.

Applied, thanks.

Thierry