Skip to content

Commit e927b36

Browse files
srishanmalexdeucher
authored andcommitted
drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()
dcn401_init_hw() assumes that update_bw_bounding_box() is valid when entering the update path. However, the existing condition: ((!fams2_enable && update_bw_bounding_box) || freq_changed) does not guarantee this, as the freq_changed branch can evaluate to true independently of the callback pointer. This can result in calling update_bw_bounding_box() when it is NULL. Fix this by separating the update condition from the pointer checks and ensuring the callback, dc->clk_mgr, and bw_params are validated before use. Fixes the below: ../dc/hwss/dcn401/dcn401_hwseq.c:367 dcn401_init_hw() error: we previously assumed 'dc->res_pool->funcs->update_bw_bounding_box' could be null (see line 362) Fixes: ca0fb24 ("drm/amd/display: Underflow Seen on DCN401 eGPU") Cc: Daniel Sa <Daniel.Sa@amd.com> Cc: Alvin Lee <alvin.lee2@amd.com> Cc: Roman Li <roman.li@amd.com> Cc: Alex Hung <alex.hung@amd.com> Cc: Tom Chung <chiahsuan.chung@amd.com> Cc: Dan Carpenter <dan.carpenter@linaro.org> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 86117c5) Cc: stable@vger.kernel.org
1 parent 4487571 commit e927b36

1 file changed

Lines changed: 11 additions & 6 deletions

File tree

drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,7 @@ void dcn401_init_hw(struct dc *dc)
147147
int edp_num;
148148
uint32_t backlight = MAX_BACKLIGHT_LEVEL;
149149
uint32_t user_level = MAX_BACKLIGHT_LEVEL;
150+
bool dchub_ref_freq_changed;
150151
int current_dchub_ref_freq = 0;
151152

152153
if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->init_clocks) {
@@ -360,14 +361,18 @@ void dcn401_init_hw(struct dc *dc)
360361
dc->caps.dmub_caps.psr = dc->ctx->dmub_srv->dmub->feature_caps.psr;
361362
dc->caps.dmub_caps.mclk_sw = dc->ctx->dmub_srv->dmub->feature_caps.fw_assisted_mclk_switch_ver > 0;
362363
dc->caps.dmub_caps.fams_ver = dc->ctx->dmub_srv->dmub->feature_caps.fw_assisted_mclk_switch_ver;
364+
365+
/* sw and fw FAMS versions must match for support */
363366
dc->debug.fams2_config.bits.enable &=
364-
dc->caps.dmub_caps.fams_ver == dc->debug.fams_version.ver; // sw & fw fams versions must match for support
365-
if ((!dc->debug.fams2_config.bits.enable && dc->res_pool->funcs->update_bw_bounding_box)
366-
|| res_pool->ref_clocks.dchub_ref_clock_inKhz / 1000 != current_dchub_ref_freq) {
367+
dc->caps.dmub_caps.fams_ver == dc->debug.fams_version.ver;
368+
dchub_ref_freq_changed =
369+
res_pool->ref_clocks.dchub_ref_clock_inKhz / 1000 != current_dchub_ref_freq;
370+
if ((!dc->debug.fams2_config.bits.enable || dchub_ref_freq_changed) &&
371+
dc->res_pool->funcs->update_bw_bounding_box &&
372+
dc->clk_mgr && dc->clk_mgr->bw_params) {
367373
/* update bounding box if FAMS2 disabled, or if dchub clk has changed */
368-
if (dc->clk_mgr)
369-
dc->res_pool->funcs->update_bw_bounding_box(dc,
370-
dc->clk_mgr->bw_params);
374+
dc->res_pool->funcs->update_bw_bounding_box(dc,
375+
dc->clk_mgr->bw_params);
371376
}
372377
}
373378
}

0 commit comments

Comments
 (0)