Commit c302e6e3 authored by Srinivasan Shanmugam's avatar Srinivasan Shanmugam Committed by Yu Kuai
Browse files

drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func

mainline inclusion
from mainline-v6.12-rc1
commit 62ed6f0f198da04e884062264df308277628004f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR96
CVE: CVE-2024-49911

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=62ed6f0f198da04e884062264df308277628004f



--------------------------------

This commit adds a null check for the set_output_gamma function pointer
in the dcn20_set_output_transfer_func function. Previously,
set_output_gamma was being checked for null at line 1030, but then it
was being dereferenced without any null check at line 1048. This could
potentially lead to a null pointer dereference error if set_output_gamma
is null.

To fix this, we now ensure that set_output_gamma is not null before
dereferencing it. We do this by adding a null check for set_output_gamma
before the call to set_output_gamma at line 1048.

Cc: Tom Chung <chiahsuan.chung@amd.com>
Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Cc: Roman Li <roman.li@amd.com>
Cc: Alex Hung <alex.hung@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Cc: Harry Wentland <harry.wentland@amd.com>
Cc: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: default avatarSrinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: default avatarTom Chung <chiahsuan.chung@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Conflicts:
	drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
	drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
[commit e53524cdcc02 ("drm/amd/display: Refactor HWSS into component
folder") is not backported, which moved dcn20_hwseq.c]
Signed-off-by: default avatarYu Kuai <yukuai3@huawei.com>
parent f34aecb9
Loading
Loading
Loading
Loading
+2 −1
Original line number Diff line number Diff line
@@ -880,6 +880,7 @@ bool dcn20_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx,
	/*
	 * if above if is not executed then 'params' equal to 0 and set in bypass
	 */
	if (mpc->funcs->set_output_gamma)
		mpc->funcs->set_output_gamma(mpc, mpcc_id, params);

	return true;