From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com>
stable inclusion
from stable-v6.11.3
commit 65a6fee22d5cfa645cb05489892dc9cd3d142fc2
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAY
CVE: CVE-2024-49914
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 8e4ed3cf1642df0c4456443d865cff61a9598aa8 ]
This commit addresses a null pointer dereference issue in the
`dcn20_program_pipe` function. The issue could occur when
`pipe_ctx->plane_state` is null.
The fix adds a check to ensure `pipe_ctx->plane_state` is not null
before accessing. This prevents a null pointer dereference.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1925 dcn20_program_pipe() error: we previously assumed 'pipe_ctx->plane_state' could be null (see line 1877)
Cc: Tom Chung <chiahsuan.chung(a)amd.com>
Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com>
Cc: Roman Li <roman.li(a)amd.com>
Cc: Alex Hung <alex.hung(a)amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com>
Cc: Harry Wentland <harry.wentland(a)amd.com>
Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com>
Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com>
Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Conflicts:
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
[The stable version 5.10 is missing patch 65a6fee22d5cfa645cb05489892dc9cd3d142fc2,
which was pulled from 6.11. Manually removed unnecessary code, such as
if (pipe_ctx->update_flags.bits.det_size),
if (hws->funcs.populate_mcm_luts),
if (pipe_ctx->update_flags.bits.enable),
if ((pipe_ctx->plane_state && pipe_ctx->plane_state->visible)).
The purpose of this patch is to check if pipe_ctx->plane_state is not
null before using its properties. Other extraneous code from higher
versions is unrelated to the current patch and has been removed.]
Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com>
---
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index 0adbcfc5e222..8d6a5b45b688 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -1601,16 +1601,20 @@ static void dcn20_program_pipe(
dc->res_pool->hubbub->funcs->force_wm_propagate_to_pipes(dc->res_pool->hubbub);
}
- if (pipe_ctx->update_flags.raw || pipe_ctx->plane_state->update_flags.raw || pipe_ctx->stream->update_flags.raw)
+ if (pipe_ctx->update_flags.raw ||
+ (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.raw) ||
+ pipe_ctx->stream->update_flags.raw)
dcn20_update_dchubp_dpp(dc, pipe_ctx, context);
- if (pipe_ctx->update_flags.bits.enable
- || pipe_ctx->plane_state->update_flags.bits.hdr_mult)
+ if (pipe_ctx->update_flags.bits.enable ||
+ (pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.bits.hdr_mult))
hws->funcs.set_hdr_multiplier(pipe_ctx);
if (pipe_ctx->update_flags.bits.enable ||
- pipe_ctx->plane_state->update_flags.bits.in_transfer_func_change ||
- pipe_ctx->plane_state->update_flags.bits.gamma_change)
+ (pipe_ctx->plane_state &&
+ pipe_ctx->plane_state->update_flags.bits.in_transfer_func_change) ||
+ (pipe_ctx->plane_state &&
+ pipe_ctx->plane_state->update_flags.bits.gamma_change))
hws->funcs.set_input_transfer_func(dc, pipe_ctx, pipe_ctx->plane_state);
/* dcn10_translate_regamma_to_hw_format takes 750us to finish
--
2.34.1
tree: https://gitee.com/openeuler/kernel.git OLK-5.10
head: bf973836a0d3e07d47c4005e1c6d32a27f35b2b2
commit: 79c68ab3280fab8ace1b10bf8eadce508ee89c3c [2417/2417] etmem: add original kernel swap enabled options
config: x86_64-randconfig-014-20241112 (https://download.01.org/0day-ci/archive/20241112/202411120941.Ots9b35i-lkp@…)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241112/202411120941.Ots9b35i-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411120941.Ots9b35i-lkp@intel.com/
All errors (new ones prefixed by >>):
ld: warning: net/bpfilter/bpfilter_umh_blob.o: missing .note.GNU-stack section implies executable stack
ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
ld: warning: net/bpfilter/bpfilter_umh_blob.o: missing .note.GNU-stack section implies executable stack
ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
ld: warning: .tmp_vmlinux.kallsyms1 has a LOAD segment with RWX permissions
ld: mm/vmscan.o: in function `kernel_swap_check':
>> mm/vmscan.c:3467: undefined reference to `kernel_swap_enabled'
>> ld: mm/vmscan.c:3467: undefined reference to `kernel_swap_enabled'
>> ld: mm/vmscan.c:3467: undefined reference to `kernel_swap_enabled'
vim +3467 mm/vmscan.c
3459
3460 #ifdef CONFIG_ETMEM
3461 /*
3462 * Check if original kernel swap is enabled
3463 * turn off kernel swap,but leave page cache reclaim on
3464 */
3465 static inline void kernel_swap_check(struct scan_control *sc)
3466 {
> 3467 if (sc != NULL && !kernel_swap_enabled())
3468 sc->may_swap = 0;
3469 }
3470 #endif
3471
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki