2021-08-10 10:18:04

by Tuo Li

Subject: [PATCH] drm/display: fix possible null-pointer dereference in dcn10_set_clock()

The variable dc->clk_mgr is checked in:
if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)

This indicates dc->clk_mgr can be NULL.
However, it is dereferenced in:
if (!dc->clk_mgr->funcs->get_clock)

To fix this possible null-pointer dereference, check dc->clk_mgr before
dereferencing it.

Reported-by: TOTE Robot <[email protected]>
Signed-off-by: Tuo Li <[email protected]>
---
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index c545eddabdcc..3a7c7c7efa68 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -3635,7 +3635,7 @@ enum dc_status dcn10_set_clock(struct dc *dc,
dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
context, clock_type, &clock_cfg);

- if (!dc->clk_mgr->funcs->get_clock)
+ if (dc->clk_mgr && !dc->clk_mgr->funcs->get_clock)
return DC_FAIL_UNSUPPORTED_1;

if (clk_khz > clock_cfg.max_clock_khz)
--
2.25.1

2021-08-10 14:22:16

by Chen, Guchun

Subject: RE: [PATCH] drm/display: fix possible null-pointer dereference in dcn10_set_clock()

[Public]

Thanks for your patch.

I suggest moving the check of function pointer dc->clk_mgr->funcs->get_clock earlier, and return early if it's NULL, as if it's NULL, it's meaningless to continue the clock setting.

....
if (!dc->clk_mgr || !dc->clk_mgr->funcs->get_clock)
return DC_FAIL_UNSUPPORTED_1;

dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
context, clock_type, &clock_cfg);
....

Regards,
Guchun

-----Original Message-----
From: amd-gfx <[email protected]> On Behalf Of Tuo Li
Sent: Tuesday, August 10, 2021 5:20 PM
To: Wentland, Harry <[email protected]>; Li, Sun peng (Leo) <[email protected]>; Deucher, Alexander <[email protected]>; Koenig, Christian <[email protected]>; Pan, Xinhui <[email protected]>; [email protected]; [email protected]; Cyr, Aric <[email protected]>; Lei, Jun <[email protected]>; Zhuo, Qingqing <[email protected]>; Siqueira, Rodrigo <[email protected]>; Lee, Alvin <[email protected]>; Stempen, Vladimir <[email protected]>; [email protected]; Lee, Sung <[email protected]>; Po-Yu Hsieh Paul <[email protected]>; Wood, Wyatt <[email protected]>
Cc: [email protected]; [email protected]; [email protected]; [email protected]; Tuo Li <[email protected]>; TOTE Robot <[email protected]>
Subject: [PATCH] drm/display: fix possible null-pointer dereference in dcn10_set_clock()

The variable dc->clk_mgr is checked in:
if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)

This indicates dc->clk_mgr can be NULL.
However, it is dereferenced in:
if (!dc->clk_mgr->funcs->get_clock)

To fix this possible null-pointer dereference, check dc->clk_mgr before dereferencing it.

Reported-by: TOTE Robot <[email protected]>
Signed-off-by: Tuo Li <[email protected]>
---
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index c545eddabdcc..3a7c7c7efa68 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -3635,7 +3635,7 @@ enum dc_status dcn10_set_clock(struct dc *dc,
dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
context, clock_type, &clock_cfg);

- if (!dc->clk_mgr->funcs->get_clock)
+ if (dc->clk_mgr && !dc->clk_mgr->funcs->get_clock)
return DC_FAIL_UNSUPPORTED_1;

if (clk_khz > clock_cfg.max_clock_khz)
--
2.25.1