linux-kernel - [PATCH] drm/amd/display: Fix missing NULL check in dcn21_set_backlight

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 8 Feb 2024 04:37:11 -0800
From: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
To: Harry Wentland <harry.wentland@....com>
CC: Nikita Zhandarovich <n.zhandarovich@...tech.ru>, Leo Li
	<sunpeng.li@....com>, Rodrigo Siqueira <Rodrigo.Siqueira@....com>, "Alex
 Deucher" <alexander.deucher@....com>, Christian König
	<christian.koenig@....com>, "Pan, Xinhui" <Xinhui.Pan@....com>, David Airlie
	<airlied@...il.com>, Daniel Vetter <daniel@...ll.ch>, Leon Huang
	<Leon.Huang1@....com>, <amd-gfx@...ts.freedesktop.org>,
	<dri-devel@...ts.freedesktop.org>, <linux-kernel@...r.kernel.org>,
	<lvc-project@...uxtesting.org>
Subject: [PATCH] drm/amd/display: Fix missing NULL check in dcn21_set_backlight_level()

On the off chance 'panel_cntl' ends up being not properly initialized,
dcn21_set_backlight_level() may hit NULL pointer dereference while
changing embedded panel backlight levels.

Prevent this issue by using some of the existing checks for the
similar purpose. At the same time clean up redundant tests for
NULL in 'abm'.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 6f0ef80a00ad ("drm/amd/display: Fix ABM pipe/backlight issues when change backlight")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
---
 drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
index 8e88dcaf88f5..2b1b580541a8 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
@@ -247,7 +247,7 @@ bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx,
 	if (abm != NULL) {
 		uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
 
-		if (abm && panel_cntl) {
+		if (panel_cntl) {
 			if (abm->funcs && abm->funcs->set_pipe_ex) {
 				abm->funcs->set_pipe_ex(abm,
 						otg_inst,
@@ -261,15 +261,16 @@ bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx,
 							panel_cntl->inst,
 							panel_cntl->pwrseq_inst);
 			}
+
+			if (abm->funcs && abm->funcs->set_backlight_level_pwm)
+				abm->funcs->set_backlight_level_pwm(abm, backlight_pwm_u16_16,
+					frame_ramp, 0, panel_cntl->inst);
+			else
+				dmub_abm_set_backlight(dc, backlight_pwm_u16_16, frame_ramp,
+					panel_cntl->inst);
 		}
 	}
 
-	if (abm && abm->funcs && abm->funcs->set_backlight_level_pwm)
-		abm->funcs->set_backlight_level_pwm(abm, backlight_pwm_u16_16,
-			frame_ramp, 0, panel_cntl->inst);
-	else
-		dmub_abm_set_backlight(dc, backlight_pwm_u16_16, frame_ramp, panel_cntl->inst);
-
 	return true;
 }