Skip to contentSkip to conversation

FAILED: patch "[PATCH] drm/amd/display: handle failed allocation during stream" failed to apply to 5.8-stable tree

PATCH [email protected] 1 participant 1 message Aug 20, 2020

Subsystems (4)
Stable branch DRM drivers Radeon and amdgpu DRM drivers AMD display core
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 5.8-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 4462282a7253e3663790f8ab092a4107d905bd76 Mon Sep 17 00:00:00 2001
From: Josip Pavic <[email protected]>
Date: Mon, 6 Jul 2020 15:43:39 -0400
Subject: [PATCH] drm/amd/display: handle failed allocation during stream
construction

[Why]
Failing to allocate a transfer function during stream construction leads to a null pointer dereference

[How]
Handle the failed allocation by failing the stream construction

Cc [email protected]
Signed-off-by Josip Pavic <[email protected]>
Reviewed-by Aric Cyr <[email protected]>
Acked-by Rodrigo Siqueira <[email protected]>
Signed-off-by Alex Deucher <[email protected]>
drivers/gpu/drm/amd/display/dc/core/dc_stream.c +16 -3
index 3b897372ed27..d6989d115c5c 100644
@@ -56,7 +56,7 @@ void update_stream_signal(struct dc_stream_state *stream, struct dc_sink *sink)
 	}
 }
 
-static void dc_stream_construct(struct dc_stream_state *stream,
+static bool dc_stream_construct(struct dc_stream_state *stream,
 	struct dc_sink *dc_sink_data)
 {
 	uint32_t i = 0;

@@ -118,11 +118,17 @@ static void dc_stream_construct(struct dc_stream_state *stream,
 	update_stream_signal(stream, dc_sink_data);
 
 	stream->out_transfer_func = dc_create_transfer_func();
+	if (stream->out_transfer_func == NULL) {
+		dc_sink_release(dc_sink_data);
+		return false;
+	}
 	stream->out_transfer_func->type = TF_TYPE_BYPASS;
 	stream->out_transfer_func->ctx = stream->ctx;
 
 	stream->stream_id = stream->ctx->dc_stream_id_count;
 	stream->ctx->dc_stream_id_count++;
+
+	return true;
 }
 
 static void dc_stream_destruct(struct dc_stream_state *stream)

@@ -164,13 +170,20 @@ struct dc_stream_state *dc_create_stream_for_sink(
 
 	stream = kzalloc(sizeof(struct dc_stream_state), GFP_KERNEL);
 	if (stream == NULL)
-		return NULL;
+		goto alloc_fail;
 
-	dc_stream_construct(stream, sink);
+	if (dc_stream_construct(stream, sink) == false)
+		goto construct_fail;
 
 	kref_init(&stream->refcount);
 
 	return stream;
+
+construct_fail:
+	kfree(stream);
+
+alloc_fail:
+	return NULL;
 }
 
 struct dc_stream_state *dc_copy_stream(const struct dc_stream_state *stream)