RE: [PATCH] drm/display: fix possible null-pointer dereference in dcn10_set_clock()

[Chen, Guchun]

[Public]

Thanks for your patch.

I suggest moving the check of function pointer dc->clk_mgr->funcs->get_clock earlier, and return early if it's NULL, as if it's NULL, it's meaningless to continue the clock setting.

....
if (!dc->clk_mgr || !dc->clk_mgr->funcs->get_clock)
 	return DC_FAIL_UNSUPPORTED_1;

dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
 	context, clock_type, &clock_cfg);
....

Regards,
Guchun

-----Original Message-----
From: amd-gfx <amd-gfx-bounces@xxxxxxxxxxxxxxxxxxxxx> On Behalf Of Tuo Li
Sent: Tuesday, August 10, 2021 5:20 PM
To: Wentland, Harry <Harry.Wentland@xxxxxxx>; Li, Sun peng (Leo) <Sunpeng.Li@xxxxxxx>; Deucher, Alexander <Alexander.Deucher@xxxxxxx>; Koenig, Christian <Christian.Koenig@xxxxxxx>; Pan, Xinhui <Xinhui.Pan@xxxxxxx>; airlied@xxxxxxxx; daniel@xxxxxxxx; Cyr, Aric <Aric.Cyr@xxxxxxx>; Lei, Jun <Jun.Lei@xxxxxxx>; Zhuo, Qingqing <Qingqing.Zhuo@xxxxxxx>; Siqueira, Rodrigo <Rodrigo.Siqueira@xxxxxxx>; Lee, Alvin <Alvin.Lee2@xxxxxxx>; Stempen, Vladimir <Vladimir.Stempen@xxxxxxx>; isabel.zhang@xxxxxxx; Lee, Sung <Sung.Lee@xxxxxxx>; Po-Yu Hsieh Paul <Paul.Hsieh@xxxxxxx>; Wood, Wyatt <Wyatt.Wood@xxxxxxx>
Cc: amd-gfx@xxxxxxxxxxxxxxxxxxxxx; dri-devel@xxxxxxxxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; baijiaju1990@xxxxxxxxx; Tuo Li <islituo@xxxxxxxxx>; TOTE Robot <oslab@xxxxxxxxxxxxxxx>
Subject: [PATCH] drm/display: fix possible null-pointer dereference in dcn10_set_clock()

The variable dc->clk_mgr is checked in:
  if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)

This indicates dc->clk_mgr can be NULL.
However, it is dereferenced in:
  if (!dc->clk_mgr->funcs->get_clock)

To fix this possible null-pointer dereference, check dc->clk_mgr before dereferencing it.

Reported-by: TOTE Robot <oslab@xxxxxxxxxxxxxxx>
Signed-off-by: Tuo Li <islituo@xxxxxxxxx>
---
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index c545eddabdcc..3a7c7c7efa68 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -3635,7 +3635,7 @@ enum dc_status dcn10_set_clock(struct dc *dc,
 				dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
 						context, clock_type, &clock_cfg);
 
-	if (!dc->clk_mgr->funcs->get_clock)
+	if (dc->clk_mgr && !dc->clk_mgr->funcs->get_clock)
 		return DC_FAIL_UNSUPPORTED_1;
 
 	if (clk_khz > clock_cfg.max_clock_khz)
--
2.25.1