This series backports commit [52f1783ff414 ("drm/amd/display: Fix potential null dereference")] to stable branch 5.10.y. However to apply this i had to backport commit [3beac533b8da ("drm/amd/display: Remove redundant safeguards for dmub-srv destroy()")] first.
Igor Artemiev (1): drm/amd/display: Fix potential null dereference
Roman Li (1): drm/amd/display: Remove redundant safeguards for dmub-srv destroy()
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
-- 2.43.0
From: Roman Li roman.li@amd.com
[ Upstream commit 3beac533b8daa18358dabbe5059c417d192b2a93 ]
[Why] dc_dmub_srv_destroy() has internal null-check and null assignment. No need to duplicate them externally.
[How] Remove redundant safeguards.
Signed-off-by: Lang Yu Lang.Yu@amd.com Signed-off-by: Roman Li roman.li@amd.com Reviewed-by: Nicholas Kazlauskas Nicholas.Kazlauskas@amd.com Acked-by: Qingqing Zhuo qingqing.zhuo@amd.com Tested-by: Daniel Wheeler daniel.wheeler@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Eslam Khafagy eslam.medhat1993@gmail.com --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 45420968e5f1..b698d652d41f 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -1141,10 +1141,8 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) if (adev->dm.dc) dc_deinit_callbacks(adev->dm.dc); #endif - if (adev->dm.dc->ctx->dmub_srv) { - dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); - adev->dm.dc->ctx->dmub_srv = NULL; - } + + dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
if (adev->dm.dmub_bo) amdgpu_bo_free_kernel(&adev->dm.dmub_bo,
From: Igor Artemiev Igor.A.Artemiev@mcst.ru
[ Upstream commit 52f1783ff4146344342422c1cd94fcb4ce39b6fe ]
The adev->dm.dc pointer can be NULL and dereferenced in amdgpu_dm_fini() without checking.
Add a NULL pointer check before calling dc_dmub_srv_destroy().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 9a71c7d31734 ("drm/amd/display: Register DMUB service with DC") Signed-off-by: Igor Artemiev Igor.A.Artemiev@mcst.ru Signed-off-by: Hamza Mahfooz hamza.mahfooz@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Eslam Khafagy eslam.medhat1993@gmail.com --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index b698d652d41f..0aa681939b7e 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -1142,7 +1142,8 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) dc_deinit_callbacks(adev->dm.dc); #endif
- dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); + if (adev->dm.dc) + dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
if (adev->dm.dmub_bo) amdgpu_bo_free_kernel(&adev->dm.dmub_bo,
linux-stable-mirror@lists.linaro.org
-
Eslam Khafagy