From 5341f1a01d518544a2d99c6c75464b79a6201cf8 Mon Sep 17 00:00:00 2001 From: Srinivasan Shanmugam Date: Fri, 25 Oct 2024 11:11:57 +0800 Subject: [PATCH] drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func mainline inclusion from mainline-v6.12-rc1 commit 62ed6f0f198da04e884062264df308277628004f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR96 CVE: CVE-2024-49911 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=62ed6f0f198da04e884062264df308277628004f -------------------------------- This commit adds a null check for the set_output_gamma function pointer in the dcn20_set_output_transfer_func function. Previously, set_output_gamma was being checked for null at line 1030, but then it was being dereferenced without any null check at line 1048. This could potentially lead to a null pointer dereference error if set_output_gamma is null. To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma at line 1048. Cc: Tom Chung Cc: Rodrigo Siqueira Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Cc: Hamza Mahfooz Signed-off-by: Srinivasan Shanmugam Reviewed-by: Tom Chung Signed-off-by: Alex Deucher Conflicts: drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c [commit e53524cdcc02 ("drm/amd/display: Refactor HWSS into component folder") is not backported, which moved dcn20_hwseq.c] Signed-off-by: Yu Kuai --- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c index c6c4888c6665..2248473a6a76 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c @@ -830,7 +830,8 @@ bool dcn20_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx, /* * if above if is not executed then 'params' equal to 0 and set in bypass */ - mpc->funcs->set_output_gamma(mpc, mpcc_id, params); + if (mpc->funcs->set_output_gamma) + mpc->funcs->set_output_gamma(mpc, mpcc_id, params); return true; } -- Gitee