Re: [PATCH] drm/amd/display: Fix crash in hwss_set_output_transfer_func()

["Viktor Jägersküpper" <viktor_jaegerskuepper@freenet.de>]

On 8/3/26 14:41, Timur Kristóf wrote:
> The pipe_ctx->plane_res.hubp pointer is NULL on all DCE
> hardware, which causes a kernel NULL pointer dereference
> on all Vega and older GPUs.
> 
> Let's add a simple NULL check.
> 
> Fixes: f879f53407f0 ("drm/amd/display: Refactor DPP_SET_OUTPUT_TRANSFER_FUNC to drop pipe_ctx")
> Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
> Cc: Tomasz Siemek <tomasz.siemek@amd.com>

I've tested this patch (applied to amd-staging-drm-next) because I
observed the crash during my tests for
https://gitlab.freedesktop.org/drm/amd/-/work_items/5557 and I confirm
that the patch fixes the crash.

Tested-by: Viktor Jägersküpper <viktor_jaegerskuepper@freenet.de>

> ---
>  drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
> index 11411fa94665..5495e493b2eb 100644
> --- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
> +++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
> @@ -1900,7 +1900,8 @@ void hwss_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx)
>  				.xfm = pipe_ctx->plane_res.xfm,
>  				.dpp = pipe_ctx->plane_res.dpp,
>  				.mpc = dc->res_pool->mpc,
> -				.mpcc_id = pipe_ctx->plane_res.hubp->inst,
> +				.mpcc_id = pipe_ctx->plane_res.hubp ?
> +						pipe_ctx->plane_res.hubp->inst : 0,
>  				.is_top_pipe = resource_is_pipe_type(pipe_ctx, OPP_HEAD),
>  				.stream = pipe_ctx->stream,
>  			}