[PATCH AUTOSEL 6.1 08/17] drm/amd/display: Add NULL check for 'afb' before dereferencing in amdgpu_dm_plane_handle_cursor_update

[Sasha Levin]

From: Srinivasan Shanmugam <srinivasan.shanmu...@amd.com>

[ Upstream commit 38e6f715b02b572f74677eb2f29d3b4bc6f1ddff ]

This commit adds a null check for the 'afb' variable in the
amdgpu_dm_plane_handle_cursor_update function. Previously, 'afb' was
assumed to be null, but was used later in the code without a null check.
This could potentially lead to a null pointer dereference.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1298 
amdgpu_dm_plane_handle_cursor_update() error: we previously assumed 'afb' could 
be null (see line 1252)

Cc: Tom Chung <chiahsuan.ch...@amd.com>
Cc: Rodrigo Siqueira <rodrigo.sique...@amd.com>
Cc: Roman Li <roman...@amd.com>
Cc: Hersen Wu <hersenxs...@amd.com>
Cc: Alex Hung <alex.h...@amd.com>
Cc: Aurabindo Pillai <aurabindo.pil...@amd.com>
Cc: Harry Wentland <harry.wentl...@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmu...@amd.com>
Reviewed-by: Harry Wentland <harry.wentl...@amd.com>
Signed-off-by: Alex Deucher <alexander.deuc...@amd.com>
Signed-off-by: Sasha Levin <sas...@kernel.org>
---
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c  | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
index cd6e99cf74a06..984a5affc5af1 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
@@ -1225,14 +1225,22 @@ void handle_cursor_update(struct drm_plane *plane,
 {
        struct amdgpu_device *adev = drm_to_adev(plane->dev);
        struct amdgpu_framebuffer *afb = 
to_amdgpu_framebuffer(plane->state->fb);
-       struct drm_crtc *crtc = afb ? plane->state->crtc : 
old_plane_state->crtc;
-       struct dm_crtc_state *crtc_state = crtc ? to_dm_crtc_state(crtc->state) 
: NULL;
-       struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
-       uint64_t address = afb ? afb->address : 0;
+       struct drm_crtc *crtc;
+       struct dm_crtc_state *crtc_state;
+       struct amdgpu_crtc *amdgpu_crtc;
+       u64 address;
        struct dc_cursor_position position = {0};
        struct dc_cursor_attributes attributes;
        int ret;
 
+       if (!afb)
+               return;
+
+       crtc = plane->state->crtc ? plane->state->crtc : old_plane_state->crtc;
+       crtc_state = crtc ? to_dm_crtc_state(crtc->state) : NULL;
+       amdgpu_crtc = to_amdgpu_crtc(crtc);
+       address = afb->address;
+
        if (!plane->state->fb && !old_plane_state->fb)
                return;
 
-- 
2.43.0