]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
authorNikita Zhandarovich <n.zhandarovich@fintech.ru>
Tue, 6 Feb 2024 16:50:56 +0000 (08:50 -0800)
committerSasha Levin <sashal@kernel.org>
Tue, 26 Mar 2024 22:17:05 +0000 (18:17 -0400)
[ Upstream commit 2a3cfb9a24a28da9cc13d2c525a76548865e182c ]

Since 'adev->dm.dc' in amdgpu_dm_fini() might turn out to be NULL
before the call to dc_enable_dmub_notifications(), check
beforehand to ensure there will not be a possible NULL-ptr-deref
there.

Also, since commit 1e88eb1b2c25 ("drm/amd/display: Drop
CONFIG_DRM_AMD_DC_HDCP") there are two separate checks for NULL in
'adev->dm.dc' before dc_deinit_callbacks() and dc_dmub_srv_destroy().
Clean up by combining them all under one 'if'.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 81927e2808be ("drm/amd/display: Support for DMUB AUX")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c

index 1a9bbb04bd5e2c7fb9d29b5c7f2e1d0cd92d978c..8083e7156afcf7bf93449a8a9db8a2a90d4527fd 100644 (file)
@@ -1929,17 +1929,15 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
                adev->dm.hdcp_workqueue = NULL;
        }
 
-       if (adev->dm.dc)
+       if (adev->dm.dc) {
                dc_deinit_callbacks(adev->dm.dc);
-
-       if (adev->dm.dc)
                dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
-
-       if (dc_enable_dmub_notifications(adev->dm.dc)) {
-               kfree(adev->dm.dmub_notify);
-               adev->dm.dmub_notify = NULL;
-               destroy_workqueue(adev->dm.delayed_hpd_wq);
-               adev->dm.delayed_hpd_wq = NULL;
+               if (dc_enable_dmub_notifications(adev->dm.dc)) {
+                       kfree(adev->dm.dmub_notify);
+                       adev->dm.dmub_notify = NULL;
+                       destroy_workqueue(adev->dm.delayed_hpd_wq);
+                       adev->dm.delayed_hpd_wq = NULL;
+               }
        }
 
        if (adev->dm.dmub_bo)