Merge tag 'drm-atmel-hlcdc-fixes/for-4.7-rc2' of github.com:bbrezillon/linux-at91 into drm-fixes

Two trivial bugfixes for the atmel-hlcdc driver.

The first one is making use of __drm_atomic_helper_crtc_destroy_state()
instead of duplicating its logic in atmel_hlcdc_crtc_reset() and
risking memory leaks if other objects are added to the common CRTC
state.

The second one is fixing a possible NULL pointer dereference.

* tag 'drm-atmel-hlcdc-fixes/for-4.7-rc2' of github.com:bbrezillon/linux-at91:
  drm: atmel-hlcdc: fix a NULL check
  drm: atmel-hlcdc: fix atmel_hlcdc_crtc_reset() implementation

1 files changed, 5 insertions, 5 deletions

diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
index cf23a755f777..bd12231ab0cd 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
@@ -391,12 +391,11 @@ void atmel_hlcdc_crtc_reset(struct drm_crtc *crtc)
 {
         struct atmel_hlcdc_crtc_state *state;
 
-        if (crtc->state && crtc->state->mode_blob)
-                drm_property_unreference_blob(crtc->state->mode_blob);
-
         if (crtc->state) {
+                __drm_atomic_helper_crtc_destroy_state(crtc->state);
                 state = drm_crtc_state_to_atmel_hlcdc_crtc_state(crtc->state);
                 kfree(state);
+                crtc->state = NULL;
         }
 
         state = kzalloc(sizeof(*state), GFP_KERNEL);
@@ -415,8 +414,9 @@ atmel_hlcdc_crtc_duplicate_state(struct drm_crtc *crtc)
                 return NULL;
 
         state = kmalloc(sizeof(*state), GFP_KERNEL);
-        if (state)
-                __drm_atomic_helper_crtc_duplicate_state(crtc, &state->base);
+        if (!state)
+                return NULL;
+        __drm_atomic_helper_crtc_duplicate_state(crtc, &state->base);
 
         cur = drm_crtc_state_to_atmel_hlcdc_crtc_state(crtc->state);
         state->output_mode = cur->output_mode;