[PATCH] drm/display: fix possible null-pointer dereference in dcn10_set_clock()

[PATCH] drm/display: fix possible null-pointer dereference in dcn10_set_clock()

[Tuo Li]

The variable dc->clk_mgr is checked in:
  if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)

This indicates dc->clk_mgr can be NULL.
However, it is dereferenced in:
  if (!dc->clk_mgr->funcs->get_clock)

To fix this possible null-pointer dereference, check dc->clk_mgr before
dereferencing it.

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Tuo Li <islituo@gmail.com>
---
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index c545eddabdcc..3a7c7c7efa68 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -3635,7 +3635,7 @@ enum dc_status dcn10_set_clock(struct dc *dc,
 				dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
 						context, clock_type, &clock_cfg);
 
-	if (!dc->clk_mgr->funcs->get_clock)
+	if (dc->clk_mgr && !dc->clk_mgr->funcs->get_clock)
 		return DC_FAIL_UNSUPPORTED_1;
 
 	if (clk_khz > clock_cfg.max_clock_khz)
-- 
2.25.1

RE: [PATCH] drm/display: fix possible null-pointer dereference in dcn10_set_clock()

[Chen, Guchun]

[Public]

Thanks for your patch.

I suggest moving the check of function pointer dc->clk_mgr->funcs->get_clock earlier, and return early if it's NULL, as if it's NULL, it's meaningless to continue the clock setting.

....
if (!dc->clk_mgr || !dc->clk_mgr->funcs->get_clock)
 	return DC_FAIL_UNSUPPORTED_1;

dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
 	context, clock_type, &clock_cfg);
....

Regards,
Guchun

-----Original Message-----
From: amd-gfx <amd-gfx-bounces@lists.freedesktop.org> On Behalf Of Tuo Li
Sent: Tuesday, August 10, 2021 5:20 PM
To: Wentland, Harry <Harry.Wentland@amd.com>; Li, Sun peng (Leo) <Sunpeng.Li@amd.com>; Deucher, Alexander <Alexander.Deucher@amd.com>; Koenig, Christian <Christian.Koenig@amd.com>; Pan, Xinhui <Xinhui.Pan@amd.com>; airlied@linux.ie; daniel@ffwll.ch; Cyr, Aric <Aric.Cyr@amd.com>; Lei, Jun <Jun.Lei@amd.com>; Zhuo, Qingqing <Qingqing.Zhuo@amd.com>; Siqueira, Rodrigo <Rodrigo.Siqueira@amd.com>; Lee, Alvin <Alvin.Lee2@amd.com>; Stempen, Vladimir <Vladimir.Stempen@amd.com>; isabel.zhang@amd.com; Lee, Sung <Sung.Lee@amd.com>; Po-Yu Hsieh Paul <Paul.Hsieh@amd.com>; Wood, Wyatt <Wyatt.Wood@amd.com>
Cc: amd-gfx@lists.freedesktop.org; dri-devel@lists.freedesktop.org; linux-kernel@vger.kernel.org; baijiaju1990@gmail.com; Tuo Li <islituo@gmail.com>; TOTE Robot <oslab@tsinghua.edu.cn>
Subject: [PATCH] drm/display: fix possible null-pointer dereference in dcn10_set_clock()

The variable dc->clk_mgr is checked in:
  if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)

This indicates dc->clk_mgr can be NULL.
However, it is dereferenced in:
  if (!dc->clk_mgr->funcs->get_clock)

To fix this possible null-pointer dereference, check dc->clk_mgr before dereferencing it.

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Tuo Li <islituo@gmail.com>
---
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index c545eddabdcc..3a7c7c7efa68 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -3635,7 +3635,7 @@ enum dc_status dcn10_set_clock(struct dc *dc,
 				dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
 						context, clock_type, &clock_cfg);
 
-	if (!dc->clk_mgr->funcs->get_clock)
+	if (dc->clk_mgr && !dc->clk_mgr->funcs->get_clock)
 		return DC_FAIL_UNSUPPORTED_1;
 
 	if (clk_khz > clock_cfg.max_clock_khz)
--
2.25.1