[PATCH v2] drm/display: fix possible null-pointer dereference in dcn10_set_clock()

[Alex Deucher]

Applied.  Thanks!

Alex

On Wed, Aug 11, 2021 at 9:46 AM Tuo Li <islituo at gmail.com> wrote:
>
> The variable dc->clk_mgr is checked in:
>   if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)
>
> This indicates dc->clk_mgr can be NULL.
> However, it is dereferenced in:
>     if (!dc->clk_mgr->funcs->get_clock)
>
> To fix this null-pointer dereference, check dc->clk_mgr and the function
> pointer dc->clk_mgr->funcs->get_clock earlier, and return if one of them
> is NULL.
>
> Reported-by: TOTE Robot <oslab at tsinghua.edu.cn>
> Signed-off-by: Tuo Li <islituo at gmail.com>
> ---
> v2:
> * Move the check of function pointer dc->clk_mgr->funcs->get_clock earlier
> and return if it is NULL.
>   Thank Chen, Guchun for helpful advice.
> ---
>  .../gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
> index c545eddabdcc..03e1c643502e 100644
> --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
> +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
> @@ -3631,13 +3631,12 @@ enum dc_status dcn10_set_clock(struct dc *dc,
>         struct dc_clock_config clock_cfg = {0};
>         struct dc_clocks *current_clocks = &context->bw_ctx.bw.dcn.clk;
>
> -       if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)
> -                               dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
> -                                               context, clock_type, &clock_cfg);
> -
> -       if (!dc->clk_mgr->funcs->get_clock)
> +       if (!dc->clk_mgr || !dc->clk_mgr->funcs->get_clock)
>                 return DC_FAIL_UNSUPPORTED_1;
>
> +       dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
> +               context, clock_type, &clock_cfg);
> +
>         if (clk_khz > clock_cfg.max_clock_khz)
>                 return DC_FAIL_CLK_EXCEED_MAX;
>
> @@ -3655,7 +3654,7 @@ enum dc_status dcn10_set_clock(struct dc *dc,
>         else
>                 return DC_ERROR_UNEXPECTED;
>
> -       if (dc->clk_mgr && dc->clk_mgr->funcs->update_clocks)
> +       if (dc->clk_mgr->funcs->update_clocks)
>                                 dc->clk_mgr->funcs->update_clocks(dc->clk_mgr,
>                                 context, true);
>         return DC_OK;
> --
> 2.25.1
>