Skip to content

Commit 8ccb5bf

Browse files
zehortigozaLyude
authored andcommitted
drm/mst: Fix possible NULL pointer dereference in drm_dp_mst_process_up_req()
According to DP specification, DP_SINK_EVENT_NOTIFY is also a broadcast message but as this function only handles DP_CONNECTION_STATUS_NOTIFY I will only make the static analyzer that caught this issue happy by not calling drm_dp_get_mst_branch_device_by_guid() with a NULL guid, causing drm_dp_mst_process_up_req() to return in the "if (!mstb)" right bellow. Fixes: 9408cc9 ("drm/dp_mst: Handle UP requests asynchronously") Cc: Lyude Paul <[email protected]> Cc: Sean Paul <[email protected]> Cc: <[email protected]> # v5.5+ Signed-off-by: José Roberto de Souza <[email protected]> [added cc to stable] Signed-off-by: Lyude Paul <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
1 parent cf913e9 commit 8ccb5bf

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

drivers/gpu/drm/drm_dp_mst_topology.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3760,7 +3760,8 @@ drm_dp_mst_process_up_req(struct drm_dp_mst_topology_mgr *mgr,
37603760
else if (msg->req_type == DP_RESOURCE_STATUS_NOTIFY)
37613761
guid = msg->u.resource_stat.guid;
37623762

3763-
mstb = drm_dp_get_mst_branch_device_by_guid(mgr, guid);
3763+
if (guid)
3764+
mstb = drm_dp_get_mst_branch_device_by_guid(mgr, guid);
37643765
} else {
37653766
mstb = drm_dp_get_mst_branch_device(mgr, hdr->lct, hdr->rad);
37663767
}

0 commit comments

Comments
 (0)