Commit 6238de90 authored by Zicheng Qu's avatar Zicheng Qu Committed by Xiongfeng Wang
Browse files

drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe

mainline inclusion
from mainline-v6.13-rc1
commit 6a057072ddd127255350357dd880903e8fa23f36
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEI
CVE: CVE-2024-53201

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6a057072ddd127255350357dd880903e8fa23f36



--------------------------------

This commit addresses a null pointer dereference issue in
dcn20_program_pipe(). Previously, commit 8e4ed3cf1642 ("drm/amd/display:
Add null check for pipe_ctx->plane_state in dcn20_program_pipe")
partially fixed the null pointer dereference issue. However, in
dcn20_update_dchubp_dpp(), the variable pipe_ctx is passed in, and
plane_state is accessed again through pipe_ctx. Multiple if statements
directly call attributes of plane_state, leading to potential null
pointer dereference issues. This patch adds necessary null checks to
ensure stability.

Fixes: 8e4ed3cf1642 ("drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe")
Reviewed-by: default avatarTom Chung <chiahsuan.chung@amd.com>
Signed-off-by: default avatarZicheng Qu <quzicheng@huawei.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Conflicts:
	drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
	drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
[wangxiongfeng: Fix conflicts because file path is changed]
Signed-off-by: default avatarXiongfeng Wang <wangxiongfeng2@huawei.com>
parent c2020692
Loading
Loading
Loading
Loading
+3 −3
Original line number Diff line number Diff line
@@ -1601,9 +1601,9 @@ static void dcn20_program_pipe(
			dc->res_pool->hubbub->funcs->force_wm_propagate_to_pipes(dc->res_pool->hubbub);
	}

	if (pipe_ctx->update_flags.raw ||
		(pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.raw) ||
		pipe_ctx->stream->update_flags.raw)
	if (pipe_ctx->plane_state && (pipe_ctx->update_flags.raw ||
	    pipe_ctx->plane_state->update_flags.raw ||
	    pipe_ctx->stream->update_flags.raw))
		dcn20_update_dchubp_dpp(dc, pipe_ctx, context);

	if (pipe_ctx->plane_state && (pipe_ctx->update_flags.bits.enable ||