Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()

dcn401_init_hw() assumes that update_bw_bounding_box() is valid when
entering the update path. However, the existing condition:

((!fams2_enable && update_bw_bounding_box) || freq_changed)

does not guarantee this, as the freq_changed branch can evaluate to true
independently of the callback pointer.

This can result in calling update_bw_bounding_box() when it is NULL.

Fix this by separating the update condition from the pointer checks and
ensuring the callback, dc->clk_mgr, and bw_params are validated before
use.

Fixes the below:
../dc/hwss/dcn401/dcn401_hwseq.c:367 dcn401_init_hw() error: we previously assumed 'dc->res_pool->funcs->update_bw_bounding_box' could be null (see line 362)

Fixes: ca0fb243c3bb ("drm/amd/display: Underflow Seen on DCN401 eGPU")
Cc: Daniel Sa <Daniel.Sa@amd.com>
Cc: Alvin Lee <alvin.lee2@amd.com>
Cc: Roman Li <roman.li@amd.com>
Cc: Alex Hung <alex.hung@amd.com>
Cc: Tom Chung <chiahsuan.chung@amd.com>
Cc: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

authored by

Srinivasan Shanmugam and committed by
Alex Deucher
86117c5a 606f6b17

+11 -6
+11 -6
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
··· 143 143 int edp_num; 144 144 uint32_t backlight = MAX_BACKLIGHT_LEVEL; 145 145 uint32_t user_level = MAX_BACKLIGHT_LEVEL; 146 + bool dchub_ref_freq_changed; 146 147 int current_dchub_ref_freq = 0; 147 148 148 149 if (dc->clk_mgr && dc->clk_mgr->funcs && dc->clk_mgr->funcs->init_clocks) { ··· 358 357 dc->caps.dmub_caps.psr = dc->ctx->dmub_srv->dmub->feature_caps.psr; 359 358 dc->caps.dmub_caps.mclk_sw = dc->ctx->dmub_srv->dmub->feature_caps.fw_assisted_mclk_switch_ver > 0; 360 359 dc->caps.dmub_caps.fams_ver = dc->ctx->dmub_srv->dmub->feature_caps.fw_assisted_mclk_switch_ver; 360 + 361 + /* sw and fw FAMS versions must match for support */ 361 362 dc->debug.fams2_config.bits.enable &= 362 - dc->caps.dmub_caps.fams_ver == dc->debug.fams_version.ver; // sw & fw fams versions must match for support 363 - if ((!dc->debug.fams2_config.bits.enable && dc->res_pool->funcs->update_bw_bounding_box) 364 - || res_pool->ref_clocks.dchub_ref_clock_inKhz / 1000 != current_dchub_ref_freq) { 363 + dc->caps.dmub_caps.fams_ver == dc->debug.fams_version.ver; 364 + dchub_ref_freq_changed = 365 + res_pool->ref_clocks.dchub_ref_clock_inKhz / 1000 != current_dchub_ref_freq; 366 + if ((!dc->debug.fams2_config.bits.enable || dchub_ref_freq_changed) && 367 + dc->res_pool->funcs->update_bw_bounding_box && 368 + dc->clk_mgr && dc->clk_mgr->bw_params) { 365 369 /* update bounding box if FAMS2 disabled, or if dchub clk has changed */ 366 - if (dc->clk_mgr) 367 - dc->res_pool->funcs->update_bw_bounding_box(dc, 368 - dc->clk_mgr->bw_params); 370 + dc->res_pool->funcs->update_bw_bounding_box(dc, 371 + dc->clk_mgr->bw_params); 369 372 } 370 373 } 371 374 }