According to your(Villie) reply, the *info has been checked info earlier, and I have read the code of framebuffer_check() and related drm_get_format_info() which it calls, but unfortunatelly, I haven't seen judgement(check) for it. What I only found related with check is the sentence below (in *drm_format_info() in drivers/gpu/drm/drm_fourcc.c)：
```
info = __drm_format_info(format);
WARN_ON(!info);
```
But to the best of my knowledge, "WARN_ON" only gives a dump_stack(), not discontinue the program going on, so it will indeed go to the below line in framebuffer_check() and raise an error:
```
for (i = 0; i < info->num_planes; i++) {
```
So maybe it will make sense of my commited code.
---
drivers/gpu/drm/drm_framebuffer.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index aff3746dedfb..be7dd1998c04 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -194,6 +194,10 @@ static int framebuffer_check(struct drm_device *dev,
/* now let the driver pick its own format info */
info = drm_get_format_info(dev, r);
+ if (!info) {
+ drm_dbg_kms(dev, "no matched format info\n");
+ return -EFAULT;
+ }
for (i = 0; i < info->num_planes; i++) {
unsigned int width = fb_plane_width(r->width, info, i);
--
2.37.1
