Skip to content

Commit d2b48f3

Browse files
srishanmalexdeucher
authored andcommitted
drm/amd/display: Fix potential null pointer dereference in dc_dmub_srv
Fixes potential null pointer dereference warnings in the dc_dmub_srv_cmd_list_queue_execute() and dc_dmub_srv_is_hw_pwr_up() functions. In both functions, the 'dc_dmub_srv' variable was being dereferenced before it was checked for null. This could lead to a null pointer dereference if 'dc_dmub_srv' is null. The fix is to check if 'dc_dmub_srv' is null before dereferencing it. Thus moving the null checks for 'dc_dmub_srv' to the beginning of the functions to ensure that 'dc_dmub_srv' is not null when it is dereferenced. Found by smatch & thus fixing the below: drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:133 dc_dmub_srv_cmd_list_queue_execute() warn: variable dereferenced before check 'dc_dmub_srv' (see line 128) drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:1167 dc_dmub_srv_is_hw_pwr_up() warn: variable dereferenced before check 'dc_dmub_srv' (see line 1164) Fixes: 028bac5 ("drm/amd/display: decouple dmcub execution to reduce lock granularity") Fixes: 65138eb ("drm/amd/display: Add DCN35 DMUB") Cc: JinZe.Xu <[email protected]> Cc: Hersen Wu <[email protected]> Cc: Josip Pavic <[email protected]> Cc: Roman Li <[email protected]> Cc: Qingqing Zhuo <[email protected]> Cc: Harry Wentland <[email protected]> Cc: Rodrigo Siqueira <[email protected]> Cc: Aurabindo Pillai <[email protected]> Cc: Tom Chung <[email protected]> Signed-off-by: Srinivasan Shanmugam <[email protected]> Reviewed-by: Tom Chung <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
1 parent 4e73826 commit d2b48f3

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -125,14 +125,15 @@ bool dc_dmub_srv_cmd_list_queue_execute(struct dc_dmub_srv *dc_dmub_srv,
125125
unsigned int count,
126126
union dmub_rb_cmd *cmd_list)
127127
{
128-
struct dc_context *dc_ctx = dc_dmub_srv->ctx;
128+
struct dc_context *dc_ctx;
129129
struct dmub_srv *dmub;
130130
enum dmub_status status;
131131
int i;
132132

133133
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
134134
return false;
135135

136+
dc_ctx = dc_dmub_srv->ctx;
136137
dmub = dc_dmub_srv->dmub;
137138

138139
for (i = 0 ; i < count; i++) {
@@ -1161,7 +1162,7 @@ void dc_dmub_srv_subvp_save_surf_addr(const struct dc_dmub_srv *dc_dmub_srv, con
11611162

11621163
bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait)
11631164
{
1164-
struct dc_context *dc_ctx = dc_dmub_srv->ctx;
1165+
struct dc_context *dc_ctx;
11651166
enum dmub_status status;
11661167

11671168
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
@@ -1170,6 +1171,8 @@ bool dc_dmub_srv_is_hw_pwr_up(struct dc_dmub_srv *dc_dmub_srv, bool wait)
11701171
if (dc_dmub_srv->ctx->dc->debug.dmcub_emulation)
11711172
return true;
11721173

1174+
dc_ctx = dc_dmub_srv->ctx;
1175+
11731176
if (wait) {
11741177
if (dc_dmub_srv->ctx->dc->debug.disable_timeout) {
11751178
do {

0 commit comments

Comments
 (0)