Commit 942151fc authored by Alex Hung's avatar Alex Hung Committed by Gu Bowen
Browse files

drm/amd/display: Check null pointers before multiple uses 

mainline inclusion
from mainline-v6.12-rc1
commit fdd5ecbbff751c3b9061d8ebb08e5c96119915b4
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8O
CVE: CVE-2024-49920

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fdd5ecbbff751c3b9061d8ebb08e5c96119915b4



--------------------------------

[WHAT & HOW]
Poniters, such as stream_enc and dc->bw_vbios, are null checked previously
in the same function, so Coverity warns "implies that stream_enc and
dc->bw_vbios might be null". They are used multiple times in the
subsequent code and need to be checked.

This fixes 10 FORWARD_NULL issues reported by Coverity.

Reviewed-by: default avatarRodrigo Siqueira <rodrigo.siqueira@amd.com>
Signed-off-by: default avatarJerry Zuo <jerry.zuo@amd.com>
Signed-off-by: default avatarAlex Hung <alex.hung@amd.com>
Tested-by: default avatarDaniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Conflicts:
	drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
	drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_dio.c
	drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
        drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
	drivers/gpu/drm/amd/display/dc/resource/dce112/dce112_resource.c
        drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
	drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
	drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c
	drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource_helpers.c
	drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c
[Due to commit e53524cdcc02 (drm/amd/display: Refactor HWSS into component
folder) rename related files, which not merge. And context conflicts in
link_hwss_dio.c and dc_hw_sequencer.c.]
Signed-off-by: default avatarGu Bowen <gubowen5@huawei.com>
parent b2eaf472

drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c

+42 −40
Original line number Diff line number Diff line
@@ -512,7 +512,8 @@ void hwss_build_fast_sequence(struct dc *dc, 
	while (current_pipe) {

		current_mpc_pipe = current_pipe;

		while (current_mpc_pipe) {

			if (dc->hwss.set_flip_control_gsl && current_mpc_pipe->plane_state && current_mpc_pipe->plane_state->update_flags.raw) {

			if (current_mpc_pipe->plane_state) {

				if (dc->hwss.set_flip_control_gsl && current_mpc_pipe->plane_state->update_flags.raw) {

					block_sequence[*num_steps].params.set_flip_control_gsl_params.pipe_ctx = current_mpc_pipe;

					block_sequence[*num_steps].params.set_flip_control_gsl_params.flip_immediate = current_mpc_pipe->plane_state->flip_immediate;

					block_sequence[*num_steps].func = HUBP_SET_FLIP_CONTROL_GSL;
@@ -555,6 +556,7 @@ void hwss_build_fast_sequence(struct dc *dc, 
					block_sequence[*num_steps].func = DPP_PROGRAM_BIAS_AND_SCALE;

					(*num_steps)++;

				}

			}

			if (hws->funcs.set_output_transfer_func && current_mpc_pipe->stream->update_flags.bits.out_tf) {

				block_sequence[*num_steps].params.set_output_transfer_func_params.dc = dc;

				block_sequence[*num_steps].params.set_output_transfer_func_params.pipe_ctx = current_mpc_pipe;

drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c

+4 −1
Original line number Diff line number Diff line
@@ -1069,7 +1069,10 @@ static void bw_calcs_data_update_from_pplib(struct dc *dc) 
	struct dm_pp_clock_levels clks = {0};

	int memory_type_multiplier = MEMORY_TYPE_MULTIPLIER_CZ;



	if (dc->bw_vbios && dc->bw_vbios->memory_type == bw_def_hbm)

	if (!dc->bw_vbios)

		return;



	if (dc->bw_vbios->memory_type == bw_def_hbm)

		memory_type_multiplier = MEMORY_TYPE_HBM;



	/*do system clock  TODO PPLIB: after PPLIB implement,

drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c

+7 −1
Original line number Diff line number Diff line
@@ -2008,6 +2008,9 @@ void dcn20_post_unlock_program_front_end( 
		}

	}



	if (!hwseq)

		return;



	/* P-State support transitions:

	 * Natural -> FPO: 		P-State disabled in prepare, force disallow anytime is safe

	 * FPO -> Natural: 		Unforce anytime after FW disable is safe (P-State will assert naturally)
@@ -2015,7 +2018,7 @@ void dcn20_post_unlock_program_front_end( 
	 * FPO -> Unsupported:	P-State disabled in prepare, unforce disallow anytime is safe

	 * FPO <-> SubVP:		Force disallow is maintained on the FPO / SubVP pipes

	 */

	if (hwseq && hwseq->funcs.update_force_pstate)

	if (hwseq->funcs.update_force_pstate)

		dc->hwseq->funcs.update_force_pstate(dc, context);



	/* Only program the MALL registers after all the main and phantom pipes
@@ -2253,6 +2256,9 @@ bool dcn20_wait_for_blank_complete( 
{

	int counter;



	if (!opp)

		return false;



	for (counter = 0; counter < 1000; counter++) {

		if (opp->funcs->dpg_is_blanked(opp))

			break;

drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c

+3 −0
Original line number Diff line number Diff line
@@ -1645,6 +1645,9 @@ static void dcn32_enable_phantom_plane(struct dc *dc, 
		else

			phantom_plane = dc_create_plane_state(dc);



		if (!phantom_plane)

			continue;



		memcpy(&phantom_plane->address, &curr_pipe->plane_state->address, sizeof(phantom_plane->address));

		memcpy(&phantom_plane->scaling_quality, &curr_pipe->plane_state->scaling_quality,

				sizeof(phantom_plane->scaling_quality));

drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c

+5 −5
Original line number Diff line number Diff line
@@ -233,7 +233,6 @@ bool dcn32_is_center_timing(struct pipe_ctx *pipe) 
				pipe->stream->timing.v_addressable != pipe->stream->src.height) {

			is_center_timing = true;

		}

	}



		if (pipe->plane_state) {

			if (pipe->stream->timing.v_addressable != pipe->plane_state->dst_rect.height &&
@@ -241,6 +240,7 @@ bool dcn32_is_center_timing(struct pipe_ctx *pipe) 
				is_center_timing = true;

			}

		}

	}



	return is_center_timing;

}