Skip to content

Commit af08197

Browse files
srishanmalexdeucher
authored andcommitted
drm/amd/display: Fix NULL pointer dereferences in dm_update_crtc_state() v2
Added checks for NULL values after retrieving drm_new_conn_state to prevent dereferencing NULL pointers. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:10751 dm_update_crtc_state() warn: 'drm_new_conn_state' can also be NULL drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c 10672 static int dm_update_crtc_state(struct amdgpu_display_manager *dm, 10673 struct drm_atomic_state *state, 10674 struct drm_crtc *crtc, 10675 struct drm_crtc_state *old_crtc_state, 10676 struct drm_crtc_state *new_crtc_state, 10677 bool enable, 10678 bool *lock_and_validation_needed) 10679 { 10680 struct dm_atomic_state *dm_state = NULL; 10681 struct dm_crtc_state *dm_old_crtc_state, *dm_new_crtc_state; 10682 struct dc_stream_state *new_stream; 10683 int ret = 0; 10684 ... 10703 10704 /* TODO This hack should go away */ 10705 if (connector && enable) { 10706 /* Make sure fake sink is created in plug-in scenario */ 10707 drm_new_conn_state = drm_atomic_get_new_connector_state(state, 10708 connector); drm_atomic_get_new_connector_state() can't return error pointers, only NULL. 10709 drm_old_conn_state = drm_atomic_get_old_connector_state(state, 10710 connector); 10711 10712 if (IS_ERR(drm_new_conn_state)) { ^^^^^^^^^^^^^^^^^^ 10713 ret = PTR_ERR_OR_ZERO(drm_new_conn_state); Calling PTR_ERR_OR_ZERO() doesn't make sense. It can't be success. 10714 goto fail; 10715 } 10716 ... 10748 10749 dm_new_crtc_state->abm_level = dm_new_conn_state->abm_level; 10750 --> 10751 ret = fill_hdr_info_packet(drm_new_conn_state, ^^^^^^^^^^^^^^^^^^ Unchecked dereference 10752 &new_stream->hdr_static_metadata); 10753 if (ret) 10754 goto fail; 10755 v2: Modified the NULL pointer check for drm_new_conn_state in the dm_update_crtc_state function to include a warning via WARN_ON and return -EINVAL to indicate an invalid state when the pointer is NULL. Cc: Harry Wentland <harry.wentland@amd.com> Cc: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Cc: Tom Chung <chiahsuan.chung@amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Cc: Roman Li <roman.li@amd.com> Cc: Alex Hung <alex.hung@amd.com> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
1 parent 127e612 commit af08197

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10864,8 +10864,8 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
1086410864
drm_old_conn_state = drm_atomic_get_old_connector_state(state,
1086510865
connector);
1086610866

10867-
if (IS_ERR(drm_new_conn_state)) {
10868-
ret = PTR_ERR_OR_ZERO(drm_new_conn_state);
10867+
if (WARN_ON(!drm_new_conn_state)) {
10868+
ret = -EINVAL;
1086910869
goto fail;
1087010870
}
1087110871

0 commit comments

Comments
 (0)