| Message ID | 20230403131037.1912215-1-Igor.A.Artemiev@mcst.ru (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/amd/display: Fix potential null dereference | expand |
On 4/3/23 09:10, Igor Artemiev wrote: > The adev->dm.dc pointer can be NULL and dereferenced in amdgpu_dm_fini() > without checking. > > Add a NULL pointer check before calling dc_dmub_srv_destroy(). > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 9a71c7d31734 ("drm/amd/display: Register DMUB service with DC") > Signed-off-by: Igor Artemiev <Igor.A.Artemiev@mcst.ru> Applied, thanks! > --- > drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c > index a01fd41643fc..27f7a554874e 100644 > --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c > +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c > @@ -1854,7 +1854,8 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) > dc_deinit_callbacks(adev->dm.dc); > #endif > > - dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); > + if (adev->dm.dc) > + dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); > > if (dc_enable_dmub_notifications(adev->dm.dc)) { > kfree(adev->dm.dmub_notify);
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index a01fd41643fc..27f7a554874e 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -1854,7 +1854,8 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) dc_deinit_callbacks(adev->dm.dc); #endif - dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); + if (adev->dm.dc) + dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv); if (dc_enable_dmub_notifications(adev->dm.dc)) { kfree(adev->dm.dmub_notify);
The adev->dm.dc pointer can be NULL and dereferenced in amdgpu_dm_fini() without checking. Add a NULL pointer check before calling dc_dmub_srv_destroy(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 9a71c7d31734 ("drm/amd/display: Register DMUB service with DC") Signed-off-by: Igor Artemiev <Igor.A.Artemiev@mcst.ru> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)