Commit 0e9e6332 authored Nov 04, 2024 by Srinivasan Shanmugam Committed by Jinjiang Tu Nov 04, 2024

drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream

stable inclusion
from stable-v5.10.227
commit 1ebfa6663807c144be8c8b6727375012409d2356
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAE
CVE: CVE-2024-49913

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1ebfa6663807c144be8c8b6727375012409d2356



--------------------------------

[ Upstream commit 66d71a72539e173a9b00ca0b1852cbaa5f5bf1ad ]

This commit addresses a null pointer dereference issue in the
`commit_planes_for_stream` function at line 4140. The issue could occur
when `top_pipe_to_program` is null.

The fix adds a check to ensure `top_pipe_to_program` is not null before
accessing its stream_res. This prevents a null pointer dereference.

Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140 commit_planes_for_stream() error: we previously assumed 'top_pipe_to_program' could be null (see line 3906)

Cc: Tom Chung <chiahsuan.chung@amd.com>
Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Cc: Roman Li <roman.li@amd.com>
Cc: Alex Hung <alex.hung@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Cc: Harry Wentland <harry.wentland@amd.com>
Cc: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>

parent 07660771

drivers/gpu/drm/amd/display/dc/core/dc.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -2608,7 +2608,8 @@ static void commit_planes_for_stream(struct dc *dc,
		dc->hwss.pipe_control_lock(dc, top_pipe_to_program, false);

		if ((update_type != UPDATE_TYPE_FAST) && stream->update_flags.bits.dsc_changed)
		if (top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) {
		if (top_pipe_to_program &&
		top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) {
		top_pipe_to_program->stream_res.tg->funcs->wait_for_state(
		top_pipe_to_program->stream_res.tg,
		CRTC_STATE_VACTIVE);