diff mbox series

[SRU,J,1/2] drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'

Message ID 20241220093032.422999-2-leo.lin@canonical.com
State New
Headers show
Series CVE-2024-26662 | expand

Commit Message

Yo-Jung (Leo) Lin Dec. 20, 2024, 9:30 a.m. UTC 
From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>

'panel_cntl' structure used to control the display panel could be null,
dereferencing it could lead to a null pointer access.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn21/dcn21_hwseq.c:269 dcn21_set_backlight_level() error: we previously assumed 'panel_cntl' could be null (see line 250)

Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call backs.")
Cc: Yongqiang Sun <yongqiang.sun@amd.com>
Cc: Anthony Koo <Anthony.Koo@amd.com>
Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit e96fddb32931d007db12b1fce9b5e8e4c080401b)
[0xff07: original commit also simplified an outer-most if() now that
 there's an early null check. Ignore that part because that if() hadn't
 appeared here.
 WARNING: Despite being labeled as a fix, this patch DIDN'T fix the CVE
 correctly. Another follow-up patch (drm/amd/display: Fix && vs || typos)
 (17ba9cde11c2) should be applied altogether to fully mitigate this CVE.]
CVE-2024-26662
Signed-off-by: Yo-Jung (Leo) Lin <leo.lin@canonical.com>
---
 drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
index 9c9d492b2229..f48f313dfb4d 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
@@ -208,8 +208,14 @@  bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx,
 	union dmub_rb_cmd cmd;
 	struct dc_context *dc = pipe_ctx->stream->ctx;
 	struct abm *abm = pipe_ctx->stream_res.abm;
-	uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
+	struct timing_generator *tg = pipe_ctx->stream_res.tg;
 	struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
+	uint32_t otg_inst;
+
+	if (!abm && !tg && !panel_cntl)
+		return false;
+
+	otg_inst = tg->inst;
 
 	if (dc->dc->res_pool->dmcu) {
 		dce110_set_backlight_level(pipe_ctx, backlight_pwm_u16_16, frame_ramp);