[PATCH v2] drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func

[Chung, ChiaHsuan (Tom)]

Reviewed-by: Tom Chung <chiahsuan.chung at amd.com>

On 7/22/2024 7:48 PM, Srinivasan Shanmugam wrote:
> This commit adds a null check for the set_output_gamma function pointer
> in the  dcn30_set_output_transfer_func function. Previously,
> set_output_gamma was being checked for nullity at line 386, but then it
> was being dereferenced without any nullity check at line 401. This
> could potentially lead to a null pointer dereference error if
> set_output_gamma is indeed null.
>
> To fix this, we now ensure that set_output_gamma is not null before
> dereferencing it. We do this by adding a nullity check for
> set_output_gamma before the call to set_output_gamma at line 401. If
> set_output_gamma is null, we log an error message and do not call the
> function.
>
> This fix prevents a potential null pointer dereference error.
>
> drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func()
> error: we previously assumed 'mpc->funcs->set_output_gamma' could be null (see line 386)
>
> drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c
>      373 bool dcn30_set_output_transfer_func(struct dc *dc,
>      374                                 struct pipe_ctx *pipe_ctx,
>      375                                 const struct dc_stream_state *stream)
>      376 {
>      377         int mpcc_id = pipe_ctx->plane_res.hubp->inst;
>      378         struct mpc *mpc = pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc;
>      379         const struct pwl_params *params = NULL;
>      380         bool ret = false;
>      381
>      382         /* program OGAM or 3DLUT only for the top pipe*/
>      383         if (pipe_ctx->top_pipe == NULL) {
>      384                 /*program rmu shaper and 3dlut in MPC*/
>      385                 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);
>      386                 if (ret == false && mpc->funcs->set_output_gamma) {
>                                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL
>
>      387                         if (stream->out_transfer_func.type == TF_TYPE_HWPWL)
>      388                                 params = &stream->out_transfer_func.pwl;
>      389                         else if (pipe_ctx->stream->out_transfer_func.type ==
>      390                                         TF_TYPE_DISTRIBUTED_POINTS &&
>      391                                         cm3_helper_translate_curve_to_hw_format(
>      392                                         &stream->out_transfer_func,
>      393                                         &mpc->blender_params, false))
>      394                                 params = &mpc->blender_params;
>      395                          /* there are no ROM LUTs in OUTGAM */
>      396                         if (stream->out_transfer_func.type == TF_TYPE_PREDEFINED)
>      397                                 BREAK_TO_DEBUGGER();
>      398                 }
>      399         }
>      400
> --> 401         mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
>                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash
>
>      402         return ret;
>      403 }
>
> Fixes: d99f13878d6f ("drm/amd/display: Add DCN3 HWSEQ")
> Reported-by: Dan Carpenter <dan.carpenter at linaro.org>
> Cc: Tom Chung <chiahsuan.chung at amd.com>
> Cc: Rodrigo Siqueira <Rodrigo.Siqueira at amd.com>
> Cc: Roman Li <roman.li at amd.com>
> Cc: Hersen Wu <hersenxs.wu at amd.com>
> Cc: Alex Hung <alex.hung at amd.com>
> Cc: Aurabindo Pillai <aurabindo.pillai at amd.com>
> Cc: Harry Wentland <harry.wentland at amd.com>
> Cc: Hamza Mahfooz <hamza.mahfooz at amd.com>
> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam at amd.com>
> ---
> v2: s/DRM_ERROR/DC_LOG_ERROR (Tom)
>
>   drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
> index 98a40d46aaae..42c52284a868 100644
> --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
> +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
> @@ -398,7 +398,11 @@ bool dcn30_set_output_transfer_func(struct dc *dc,
>   		}
>   	}
>   
> -	mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
> +	if (mpc->funcs->set_output_gamma)
> +		mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
> +	else
> +		DC_LOG_ERROR("%s: set_output_gamma function pointer is NULL.\n", __func__);
> +
>   	return ret;
>   }
>