[PATCH] drm/amd/display: move connector state dereference after NULL check

[PATCH] drm/amd/display: move connector state dereference after NULL check

[Guangshuo Li]

amdgpu_dm_connector_atomic_check() checks whether the old or new
connector state returned by the atomic helpers is NULL before using
those pointers.

However, new_con_state is already dereferenced while initializing crtc,
before the NULL check is reached. If
drm_atomic_get_new_connector_state() returns NULL, the function can
dereference the NULL pointer before the WARN_ON() check can handle it.

Declare crtc first and initialize it only after the NULL check has
succeeded.

Fixes: 1e5e8d672fec ("drm/amd/display: Avoid a NULL pointer dereference")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index d3a8d681227a..7b040fd7e3fb 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -8640,13 +8640,14 @@ amdgpu_dm_connector_atomic_check(struct drm_connector *conn,
 		drm_atomic_get_new_connector_state(state, conn);
 	struct drm_connector_state *old_con_state =
 		drm_atomic_get_old_connector_state(state, conn);
-	struct drm_crtc *crtc = new_con_state->crtc;
+	struct drm_crtc *crtc;
 	struct drm_crtc_state *new_crtc_state;
 	struct amdgpu_dm_connector *aconn = to_amdgpu_dm_connector(conn);
 	int ret;
 
 	if (WARN_ON(unlikely(!old_con_state || !new_con_state)))
 		return -EINVAL;
+	crtc = new_con_state->crtc;
 
 	trace_amdgpu_dm_connector_atomic_check(new_con_state);
 
-- 
2.43.0

Re: [PATCH] drm/amd/display: move connector state dereference after NULL check

[Mario Limonciello]

On 7/8/26 02:27, Guangshuo Li wrote:
> amdgpu_dm_connector_atomic_check() checks whether the old or new
> connector state returned by the atomic helpers is NULL before using
> those pointers.
> 
> However, new_con_state is already dereferenced while initializing crtc,
> before the NULL check is reached. If
> drm_atomic_get_new_connector_state() returns NULL, the function can
> dereference the NULL pointer before the WARN_ON() check can handle it.
> 
> Declare crtc first and initialize it only after the NULL check has
> succeeded.
> 
> Fixes: 1e5e8d672fec ("drm/amd/display: Avoid a NULL pointer dereference")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---

Good finding.  I'll get this applied.

Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>

>   drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> index d3a8d681227a..7b040fd7e3fb 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> @@ -8640,13 +8640,14 @@ amdgpu_dm_connector_atomic_check(struct drm_connector *conn,
>   		drm_atomic_get_new_connector_state(state, conn);
>   	struct drm_connector_state *old_con_state =
>   		drm_atomic_get_old_connector_state(state, conn);
> -	struct drm_crtc *crtc = new_con_state->crtc;
> +	struct drm_crtc *crtc;
>   	struct drm_crtc_state *new_crtc_state;
>   	struct amdgpu_dm_connector *aconn = to_amdgpu_dm_connector(conn);
>   	int ret;
>   
>   	if (WARN_ON(unlikely(!old_con_state || !new_con_state)))
>   		return -EINVAL;
> +	crtc = new_con_state->crtc;
>   
>   	trace_amdgpu_dm_connector_atomic_check(new_con_state);
>