[PATCH] drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'

[Koo, Anthony]

[AMD Official Use Only - General]

Reviewed-by: Anthony Koo <Anthony.Koo at amd.com>

Thanks,
Anthony

-----Original Message-----
From: SHANMUGAM, SRINIVASAN <SRINIVASAN.SHANMUGAM at amd.com>
Sent: Thursday, January 25, 2024 10:55 AM
To: Siqueira, Rodrigo <Rodrigo.Siqueira at amd.com>; Pillai, Aurabindo <Aurabindo.Pillai at amd.com>
Cc: amd-gfx at lists.freedesktop.org; SHANMUGAM, SRINIVASAN <SRINIVASAN.SHANMUGAM at amd.com>; Wyatt Wood <wyatt.wood at amd.com>; Koo, Anthony <Anthony.Koo at amd.com>
Subject: [PATCH] drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'

The 'stream' pointer is used in dcn10_set_output_transfer_func() before the check if 'stream' is NULL.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1892 dcn10_set_output_transfer_func() warn: variable dereferenced before check 'stream' (see line 1875)

Fixes: ddef02de0d71 ("drm/amd/display: add null checks before logging")
Cc: Wyatt Wood <wyatt.wood at amd.com>
Cc: Anthony Koo <Anthony.Koo at amd.com>
Cc: Rodrigo Siqueira <Rodrigo.Siqueira at amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai at amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam at amd.com>
---
 drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
index d923d8d915f9..22cce2b58f95 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
@@ -1890,6 +1890,9 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx,  {
        struct dpp *dpp = pipe_ctx->plane_res.dpp;

+       if (!stream)
+               return false;
+
        if (dpp == NULL)
                return false;

@@ -1912,8 +1915,8 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx,
        } else
                dpp->funcs->dpp_program_regamma_pwl(dpp, NULL, OPP_REGAMMA_BYPASS);

-       if (stream != NULL && stream->ctx != NULL &&
-                       stream->out_transfer_func != NULL) {
+       if (stream->ctx &&
+           stream->out_transfer_func) {
                log_tf(stream->ctx,
                                stream->out_transfer_func,
                                dpp->regamma_params.hw_points_num);
--
2.34.1