[PATCH] drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe

[Chung, ChiaHsuan (Tom)]

Reviewed-by: Tom Chung <chiahsuan.chung at amd.com>

On 7/25/2024 10:54 AM, Srinivasan Shanmugam wrote:
> This commit addresses a null pointer dereference issue in the
> `dcn20_program_pipe` function. The issue could occur when
> `pipe_ctx->plane_state` is null.
>
> The fix adds a check to ensure `pipe_ctx->plane_state` is not null
> before accessing. This prevents a null pointer dereference.
>
> Reported by smatch:
> drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1925 dcn20_program_pipe() error: we previously assumed 'pipe_ctx->plane_state' could be null (see line 1877)
>
> Cc: Tom Chung <chiahsuan.chung at amd.com>
> Cc: Rodrigo Siqueira <Rodrigo.Siqueira at amd.com>
> Cc: Roman Li <roman.li at amd.com>
> Cc: Alex Hung <alex.hung at amd.com>
> Cc: Aurabindo Pillai <aurabindo.pillai at amd.com>
> Cc: Harry Wentland <harry.wentland at amd.com>
> Cc: Hamza Mahfooz <hamza.mahfooz at amd.com>
> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam at amd.com>
> ---
>   .../amd/display/dc/hwss/dcn20/dcn20_hwseq.c   | 30 ++++++++++++-------
>   1 file changed, 19 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
> index 270e337ae27b..5a6064999033 100644
> --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
> +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
> @@ -1922,22 +1922,29 @@ static void dcn20_program_pipe(
>   				dc->res_pool->hubbub, pipe_ctx->plane_res.hubp->inst, pipe_ctx->hubp_regs.det_size);
>   	}
>   
> -	if (pipe_ctx->update_flags.raw || pipe_ctx->plane_state->update_flags.raw || pipe_ctx->stream->update_flags.raw)
> +	if (pipe_ctx->update_flags.raw ||
> +	    (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.raw) ||
> +	    pipe_ctx->stream->update_flags.raw)
>   		dcn20_update_dchubp_dpp(dc, pipe_ctx, context);
>   
> -	if (pipe_ctx->update_flags.bits.enable
> -			|| pipe_ctx->plane_state->update_flags.bits.hdr_mult)
> +	if (pipe_ctx->update_flags.bits.enable ||
> +	    (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.bits.hdr_mult))
>   		hws->funcs.set_hdr_multiplier(pipe_ctx);
>   
>   	if (hws->funcs.populate_mcm_luts) {
> -		hws->funcs.populate_mcm_luts(dc, pipe_ctx, pipe_ctx->plane_state->mcm_luts,
> -				pipe_ctx->plane_state->lut_bank_a);
> -		pipe_ctx->plane_state->lut_bank_a = !pipe_ctx->plane_state->lut_bank_a;
> +		if (pipe_ctx->plane_state) {
> +			hws->funcs.populate_mcm_luts(dc, pipe_ctx, pipe_ctx->plane_state->mcm_luts,
> +						     pipe_ctx->plane_state->lut_bank_a);
> +			pipe_ctx->plane_state->lut_bank_a = !pipe_ctx->plane_state->lut_bank_a;
> +		}
>   	}
>   	if (pipe_ctx->update_flags.bits.enable ||
> -	    pipe_ctx->plane_state->update_flags.bits.in_transfer_func_change ||
> -	    pipe_ctx->plane_state->update_flags.bits.gamma_change ||
> -	    pipe_ctx->plane_state->update_flags.bits.lut_3d)
> +	    (pipe_ctx->plane_state &&
> +	     pipe_ctx->plane_state->update_flags.bits.in_transfer_func_change) ||
> +	    (pipe_ctx->plane_state &&
> +	     pipe_ctx->plane_state->update_flags.bits.gamma_change) ||
> +	    (pipe_ctx->plane_state &&
> +	     pipe_ctx->plane_state->update_flags.bits.lut_3d))
>   		hws->funcs.set_input_transfer_func(dc, pipe_ctx, pipe_ctx->plane_state);
>   
>   	/* dcn10_translate_regamma_to_hw_format takes 750us to finish
> @@ -1947,7 +1954,8 @@ static void dcn20_program_pipe(
>   	if (pipe_ctx->update_flags.bits.enable ||
>   			pipe_ctx->update_flags.bits.plane_changed ||
>   			pipe_ctx->stream->update_flags.bits.out_tf ||
> -			pipe_ctx->plane_state->update_flags.bits.output_tf_change)
> +			(pipe_ctx->plane_state &&
> +			 pipe_ctx->plane_state->update_flags.bits.output_tf_change))
>   		hws->funcs.set_output_transfer_func(dc, pipe_ctx, pipe_ctx->stream);
>   
>   	/* If the pipe has been enabled or has a different opp, we
> @@ -1971,7 +1979,7 @@ static void dcn20_program_pipe(
>   	}
>   
>   	/* Set ABM pipe after other pipe configurations done */
> -	if (pipe_ctx->plane_state->visible) {
> +	if ((pipe_ctx->plane_state && pipe_ctx->plane_state->visible)) {
>   		if (pipe_ctx->stream_res.abm) {
>   			dc->hwss.set_pipe(pipe_ctx);
>   			pipe_ctx->stream_res.abm->funcs->set_abm_level(pipe_ctx->stream_res.abm,