[SRU][J][PATCH 1/1] drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'

[Hui Wang]

From: Srinivasan Shanmugam <srinivasan.shanmugam at amd.com>

In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;"
pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to
ensure the tg is not NULL.

Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call backs.")
Cc: Yongqiang Sun <yongqiang.sun at amd.com>
Cc: Anthony Koo <Anthony.Koo at amd.com>
Cc: Rodrigo Siqueira <Rodrigo.Siqueira at amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai at amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam at amd.com>
Reviewed-by: Anthony Koo <Anthony.Koo at amd.com>
Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
(backported from commit 66951d98d9bf45ba25acf37fe0747253fafdf298)
[Hui: The commit is merged to mainline kernel from v6.8-rc, it has
significant conflict when applying to jammy kernel, to resolve the
conflict, we need to cherry-pick/backport a series of prerequisite
patches which will introduce big change to the driver, this is not
necessary since from the commit header, the patch is to resolve the
possible NULL issue of pipe_ctx->stream_res.tg, hence I just backport
the relevant part and drop the conflict part. This backported patch
could resolve the possible NULL issue and keep the other part
unchanged.]
CVE-2024-26661
Signed-off-by: Hui Wang <hui.wang at canonical.com>
---
 drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
index 69cc192a7e719..9c9d492b22297 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
@@ -182,9 +182,15 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx)
 void dcn21_set_pipe(struct pipe_ctx *pipe_ctx)
 {
 	struct abm *abm = pipe_ctx->stream_res.abm;
-	uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
+	struct timing_generator *tg = pipe_ctx->stream_res.tg;
 	struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
 	struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu;
+	uint32_t otg_inst;
+
+	if (!abm && !tg && !panel_cntl)
+		return;
+
+	otg_inst = tg->inst;
 
 	if (dmcu) {
 		dce110_set_pipe(pipe_ctx);
-- 
2.34.1