git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From fa4c500ce93f4f933c38e6d6388970e121e27b21 Mon Sep 17 00:00:00 2001
   2 From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
   3 Date: Wed, 22 May 2024 20:54:50 +0530
   4 Subject: drm/amdgpu/display: Fix null pointer dereference in dc_stream_program_cursor_position
   5
   6 From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
   7
   8 commit fa4c500ce93f4f933c38e6d6388970e121e27b21 upstream.
   9
  10 The fix involves adding a null check for 'stream' at the beginning of
  11 the function. If 'stream' is NULL, the function immediately returns
  12 false. This ensures that 'stream' is not NULL when we dereference it to
  13 access 'ctx' in 'dc = stream->ctx->dc;' the function.
  14
  15 Fixes the below:
  16         drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:398 dc_stream_program_cursor_position()
  17         error: we previously assumed 'stream' could be null (see line 397)
  18
  19 drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
  20     389 bool dc_stream_program_cursor_position(
  21     390         struct dc_stream_state *stream,
  22     391         const struct dc_cursor_position *position)
  23     392 {
  24     393         struct dc *dc;
  25     394         bool reset_idle_optimizations = false;
  26     395         const struct dc_cursor_position *old_position;
  27     396
  28     397         old_position = stream ? &stream->cursor_position : NULL;
  29                                ^^^^^^^^
  30 The patch adds a NULL check
  31
  32 --> 398         dc = stream->ctx->dc;
  33                      ^^^^^^^^
  34 The old code didn't check
  35
  36     399
  37     400         if (dc_stream_set_cursor_position(stream, position)) {
  38     401                 dc_z10_restore(dc);
  39     402
  40     403                 /* disable idle optimizations if enabling cursor */
  41     404                 if (dc->idle_optimizations_allowed &&
  42     405                     (!old_position->enable || dc->debug.exit_idle_opt_for_cursor_updates) &&
  43     406                     position->enable) {
  44     407                         dc_allow_idle_optimizations(dc, false);
  45
  46 Fixes: f63f86b5affc ("drm/amd/display: Separate setting and programming of cursor")
  47 Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
  48 Cc: Harry Wentland <harry.wentland@amd.com>
  49 Cc: Tom Chung <chiahsuan.chung@amd.com>
  50 Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
  51 Cc: Roman Li <roman.li@amd.com>
  52 Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
  53 Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
  54 Reviewed-by: Harry Wentland <harry.wentland@amd.com>
  55 Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
  56 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  57 ---
  58  drivers/gpu/drm/amd/display/dc/core/dc_stream.c |    5 ++++-
  59  1 file changed, 4 insertions(+), 1 deletion(-)
  60
  61 --- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
  62 +++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
  63 @@ -394,7 +394,10 @@ bool dc_stream_program_cursor_position(
  64         bool reset_idle_optimizations = false;
  65         const struct dc_cursor_position *old_position;
  66
  67 -       old_position = stream ? &stream->cursor_position : NULL;
  68 +       if (!stream)
  69 +               return false;
  70 +
  71 +       old_position = &stream->cursor_position;
  72         dc = stream->ctx->dc;
  73
  74         if (dc_stream_set_cursor_position(stream, position)) {