From: Alex Hung <[email protected]> [ Upstream commit 673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c ]
[WHAT & HOW] Function return values must be checked before data can be used in subsequent functions. This fixes 4 CHECKED_RETURN issues reported by Coverity. [ Backport to 6.1.y: adapted the visual-panel, watermark, and link-detection checks to their older locations. The upstream DMUB run-list/D3 path is absent; the older dc_dmub_srv_cmd_queue() already checks and logs idle-wait failures but, unlike upstream, still retries the queue once afterwards. No DMUB queue change is included. ] Reviewed-by: Harry Wentland <[email protected]> Signed-off-by: Alex Hung <[email protected]> Tested-by: Daniel Wheeler <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Assisted-by: LLM Signed-off-by: Artem Dinaburg <[email protected]> --- Hi Greg, Sasha, and drm amd maintainers, I am working through the small CVE backports still missing from 6.1.y. This one addresses CVE-2024-46775. It carries the three return-value checks that map to 6.1.y: visual-panel validation, p-state watermark propagation, and sink-detection validation during link-training retries. The upstream DMUB run-list/D3 path does not exist here. I left 6.1.y's older dc_dmub_srv_cmd_queue() unchanged. It already checks and logs the idle-wait result, but unlike upstream it still re-queues once after a failed wait, and checks that re-queue's status. The corresponding 6.6.y backport is already in the 6.6.y stable queue. The fix is already present in 6.12.y, 6.18.y, and 7.2.y, but not in 6.1.y. The target-specific adjustment is recorded in the bracketed note above. Could you please queue it for 6.1.y? CVE: CVE-2024-46775 Upstream: 673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c AI assistance: An LLM helped identify, adapt, and validate this backport; I reviewed the resulting code and validation evidence. Thanks, Artem Dinaburg drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 3 +-- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 3 ++- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c | 3 ++- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c index 82b747c0ed693b..1d3d9a82c4637d 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c @@ -2808,8 +2808,7 @@ bool perform_link_training_with_retries( if (status == LINK_TRAINING_ABORT) { enum dc_connection_type type = dc_connection_none; - dc_link_detect_sink(link, &type); - if (type == dc_connection_none) { + if (dc_link_detect_sink(link, &type) && type == dc_connection_none) { DC_LOG_HW_LINK_TRAINING("%s: Aborting training because sink unplugged\n", __func__); break; } diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c index 31bb7e782c6b1d..35e8f22d30204b 100644 --- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c @@ -396,7 +396,8 @@ void dc_dmub_srv_get_visual_confirm_color_cmd(struct dc *dc, struct pipe_ctx *pi enum dmub_status status; unsigned int panel_inst = 0; - dc_get_edp_link_panel_inst(dc, pipe_ctx->stream->link, &panel_inst); + if (!dc_get_edp_link_panel_inst(dc, pipe_ctx->stream->link, &panel_inst)) + return; memset(&cmd, 0, sizeof(cmd)); diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c index aacb1fb5c73eb5..d2eebe39a55e33 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c @@ -595,7 +595,8 @@ static bool hubbub2_program_watermarks( hubbub1->base.ctx->dc->clk_mgr->clks.p_state_change_support == false) safe_to_lower = true; - hubbub1_program_pstate_watermarks(hubbub, watermarks, refclk_mhz, safe_to_lower); + if (hubbub1_program_pstate_watermarks(hubbub, watermarks, refclk_mhz, safe_to_lower)) + wm_pending = true; REG_SET(DCHUBBUB_ARB_SAT_LEVEL, 0, DCHUBBUB_ARB_SAT_LEVEL, 60 * refclk_mhz); -- 2.39.5
