From: Nikita Zhandarovich n.zhandarovich@fintech.ru
[ Upstream commit 2a3cfb9a24a28da9cc13d2c525a76548865e182c ]
Since 'adev->dm.dc' in amdgpu_dm_fini() might turn out to be NULL before the call to dc_enable_dmub_notifications(), check beforehand to ensure there will not be a possible NULL-ptr-deref there.
Also, since commit 1e88eb1b2c25 ("drm/amd/display: Drop CONFIG_DRM_AMD_DC_HDCP") there are two separate checks for NULL in 'adev->dm.dc' before dc_deinit_callbacks() and dc_dmub_srv_destroy(). Clean up by combining them all under one 'if'.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
Fixes: 81927e2808be ("drm/amd/display: Support for DMUB AUX") Signed-off-by: Nikita Zhandarovich n.zhandarovich@fintech.ru Signed-off-by: Alex Deucher alexander.deucher@amd.com [ To fix CVE-2024-27041, I fix the merge conflict by still using macro CONFIG_DRM_AMD_DC_HDCP in the first adev->dm.dc check. ] Signed-off-by: Imkanmod Khan imkanmodkhan@gmail.com --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 8dc0f70df24f..7b4d44dcb343 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -1882,14 +1882,14 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) dc_deinit_callbacks(adev->dm.dc); #endif
- if (adev->dm.dc) + if (adev->dm.dc) { dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); - - if (dc_enable_dmub_notifications(adev->dm.dc)) { - kfree(adev->dm.dmub_notify); - adev->dm.dmub_notify = NULL; - destroy_workqueue(adev->dm.delayed_hpd_wq); - adev->dm.delayed_hpd_wq = NULL; + if (dc_enable_dmub_notifications(adev->dm.dc)) { + kfree(adev->dm.dmub_notify); + adev->dm.dmub_notify = NULL; + destroy_workqueue(adev->dm.delayed_hpd_wq); + adev->dm.delayed_hpd_wq = NULL; + } }
if (adev->dm.dmub_bo)
[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 2a3cfb9a24a28da9cc13d2c525a76548865e182c
WARNING: Author mismatch between patch and upstream commit: Backport author: Imkanmod Khanimkanmodkhan@gmail.com Commit author: Nikita Zhandarovichn.zhandarovich@fintech.ru
Status in newer kernel trees: 6.12.y | Present (exact SHA1) 6.6.y | Present (different SHA1: e040f1fbe9ab) 6.1.y | Not found
Note: The patch differs from the upstream commit: --- 1: 2a3cfb9a24a28 ! 1: 62480a5656c9a drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini() @@ Metadata ## Commit message ## drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
+ [ Upstream commit 2a3cfb9a24a28da9cc13d2c525a76548865e182c ] + Since 'adev->dm.dc' in amdgpu_dm_fini() might turn out to be NULL before the call to dc_enable_dmub_notifications(), check beforehand to ensure there will not be a possible NULL-ptr-deref @@ Commit message Fixes: 81927e2808be ("drm/amd/display: Support for DMUB AUX") Signed-off-by: Nikita Zhandarovich n.zhandarovich@fintech.ru Signed-off-by: Alex Deucher alexander.deucher@amd.com + [ To fix CVE-2024-27041, I fix the merge conflict by still using macro + CONFIG_DRM_AMD_DC_HDCP in the first adev->dm.dc check. ] + Signed-off-by: Imkanmod Khan imkanmodkhan@gmail.com
## drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ## @@ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c: static void amdgpu_dm_fini(struct amdgpu_device *adev) - adev->dm.hdcp_workqueue = NULL; - } + dc_deinit_callbacks(adev->dm.dc); + #endif
- if (adev->dm.dc) + if (adev->dm.dc) { - dc_deinit_callbacks(adev->dm.dc); -- -- if (adev->dm.dc) dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); - - if (dc_enable_dmub_notifications(adev->dm.dc)) { ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-6.1.y | Success | Success |
linux-stable-mirror@lists.linaro.org
-
Imkanmod Khan -
Sasha Levin