Executive brief
A flaw in the Linux kernel's display rendering driver for Allwinner sun4i devices fails to properly propagate errors when initializing graphics layers. When layer initialization fails, the code sets a null pointer that subsequent display initialization routines attempt to dereference, causing the system to crash. This affects systems using this display driver during graphics initialization.
Technical details
The vulnerability exists in the sun4i_crtc_init() function in drivers/gpu/drm/sun4i/sun4i_crtc.c. When the sunxi_engine_layers_init() call fails and returns an error pointer, the function incorrectly returns a plain NULL instead of propagating the error pointer. The caller sun4i_tcon_bind() uses IS_ERR() to check the result, which does not catch NULL, allowing execution to continue with an invalid null pointer stored in tcon->crtc. Subsequent calls to sun4i_rgb_init() and sun4i_lvds_init() dereference this null pointer in drm_crtc_mask(), triggering a kernel oops. The fix changes the error return from NULL to ERR_CAST(planes), ensuring proper error handling throughout the call chain.
Affected products
- Linux Linux kernel various versions with DRM sun4i driver
Timeline
- 2026-09-17: disclosed
- 2026-08-03: patched