diff mbox series

[SRU,J,1/1] drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'

Message ID 20240905005237.12046-2-hui.wang@canonical.com
State New
Headers show
Series CVE-2024-26661 | expand

Commit Message

Hui Wang Sept. 5, 2024, 12:52 a.m. UTC 
From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>

In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;"
pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to
ensure the tg is not NULL.

Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call backs.")
Cc: Yongqiang Sun <yongqiang.sun@amd.com>
Cc: Anthony Koo <Anthony.Koo@amd.com>
Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(backported from commit 66951d98d9bf45ba25acf37fe0747253fafdf298)
[Hui: The commit is merged to mainline kernel from v6.8-rc, it has
significant conflict when applying to jammy kernel, to resolve the
conflict, we need to cherry-pick/backport a series of prerequisite
patches which will introduce big change to the driver, this is not
necessary since from the commit header, the patch is to resolve the
possible NULL issue of pipe_ctx->stream_res.tg, hence I just backport
the relevant part and drop the conflict part. This backported patch
could resolve the possible NULL issue and keep the other part
unchanged.]
CVE-2024-26661
Signed-off-by: Hui Wang <hui.wang@canonical.com>
---
 drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
index 69cc192a7e719..9c9d492b22297 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
@@ -182,9 +182,15 @@  void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx)
 void dcn21_set_pipe(struct pipe_ctx *pipe_ctx)
 {
 	struct abm *abm = pipe_ctx->stream_res.abm;
-	uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
+	struct timing_generator *tg = pipe_ctx->stream_res.tg;
 	struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
 	struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu;
+	uint32_t otg_inst;
+
+	if (!abm && !tg && !panel_cntl)
+		return;
+
+	otg_inst = tg->inst;
 
 	if (dmcu) {
 		dce110_set_pipe(pipe_ctx);