Skip to content

Commit d2b48f3

Browse files
srishanmalexdeucher
authored andcommitted
drm/amd/display: Fix potential null pointer dereference in dc_dmub_srv
Fixes potential null pointer dereference warnings in the dc_dmub_srv_cmd_list_queue_execute() and dc_dmub_srv_is_hw_pwr_up() functions. In both functions, the 'dc_dmub_srv' variable was being dereferenced before it was checked for null. This could lead to a null pointer dereference if 'dc_dmub_srv' is null. The fix is to check if 'dc_dmub_srv' is null before dereferencing it. Thus moving the null checks for 'dc_dmub_srv' to the beginning of the functions to ensure that 'dc_dmub_srv' is not null when it is dereferenced. Found by smatch & thus fixing the below: drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:133 dc_dmub_srv_cmd_list_queue_execute() warn: variable dereferenced before check 'dc_dmub_srv' (see line 128) drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:1167 dc_dmub_srv_is_hw_pwr_up() warn: variable dereferenced before check 'dc_dmub_srv' (see line 1164) Fixes: 028bac5 ("drm/amd/display: decouple dmcub execution to reduce lock granularity") Fixes: 65138eb ("drm/amd/display: Add DCN35 DMUB") Cc: JinZe.Xu <jinze.xu@amd.com> Cc: Hersen Wu <hersenxs.wu@amd.com> Cc: Josip Pavic <josip.pavic@amd.com> Cc: Roman Li <roman.li@amd.com> Cc: Qingqing Zhuo <Qingqing.Zhuo@amd.com> Cc: Harry Wentland <Harry.Wentland@amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> Cc: Tom Chung <chiahsuan.chung@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Tom Chung <chiahsuan.chung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
1 parent 4e73826 commit d2b48f3

1 file changed

Lines changed: 5 additions & 2 deletions

File tree

drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -125,14 +125,15 @@ bool dc_dmub_srv_cmd_list_queue_execute(struct dc_dmub_srv *dc_dmub_srv,
125125
unsigned int count,
126126
union dmub_rb_cmd *cmd_list)
127127
{
128-
struct dc_context *dc_ctx = dc_dmub_srv->ctx;
128+
struct dc_context *dc_ctx;
129129
struct dmub_srv *dmub;
130130
enum dmub_status status;
131131
int i;
132132

133133
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
134134
return false;
135135

136+
dc_ctx = dc_dmub_srv->ctx;
136137
dmub = dc_dmub_srv->dmub;
137138

138139
for (i = 0 ; i < count; i++) {
@@ -1161,7 +1162,7 @@ void dc_dmub_srv_subvp_save_surf_addr(const struct dc_dmub_srv *dc_dmub_srv, con
11611162

11621163
bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait)
11631164
{
1164-
struct dc_context *dc_ctx = dc_dmub_srv->ctx;
1165+
struct dc_context *dc_ctx;
11651166
enum dmub_status status;
11661167

11671168
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
@@ -1170,6 +1171,8 @@ bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait)
11701171
if (dc_dmub_srv->ctx->dc->debug.dmcub_emulation)
11711172
return true;
11721173

1174+
dc_ctx = dc_dmub_srv->ctx;
1175+
11731176
if (wait) {
11741177
if (dc_dmub_srv->ctx->dc->debug.disable_timeout) {
11751178
do {

0 commit comments

Comments
 (0)