Patch "drm/msm: Avoid NULL dereference in msm_disp_state_print_regs()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    drm/msm: Avoid NULL dereference in msm_disp_state_print_regs()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-msm-avoid-null-dereference-in-msm_disp_state_pri.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 4faf93136ee4c636ce67fbf2954c16feb0ffa1fb
Author: Douglas Anderson <dianders@xxxxxxxxxxxx>
Date:   Mon Oct 14 09:36:08 2024 -0700

    drm/msm: Avoid NULL dereference in msm_disp_state_print_regs()
    
    [ Upstream commit 293f53263266bc4340d777268ab4328a97f041fa ]
    
    If the allocation in msm_disp_state_dump_regs() failed then
    `block->state` can be NULL. The msm_disp_state_print_regs() function
    _does_ have code to try to handle it with:
    
      if (*reg)
        dump_addr = *reg;
    
    ...but since "dump_addr" is initialized to NULL the above is actually
    a noop. The code then goes on to dereference `dump_addr`.
    
    Make the function print "Registers not stored" when it sees a NULL to
    solve this. Since we're touching the code, fix
    msm_disp_state_print_regs() not to pointlessly take a double-pointer
    and properly mark the pointer as `const`.
    
    Fixes: 98659487b845 ("drm/msm: add support to take dpu snapshot")
    Signed-off-by: Douglas Anderson <dianders@xxxxxxxxxxxx>
    Reviewed-by: Abhinav Kumar <quic_abhinavk@xxxxxxxxxxx>
    Patchwork: https://patchwork.freedesktop.org/patch/619657/
    Link: https://lore.kernel.org/r/20241014093605.1.Ia1217cecec9ef09eb3c6d125360cc6c8574b0e73@changeid
    Signed-off-by: Abhinav Kumar <quic_abhinavk@xxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
index 8746ceae8fca9..06f2f5a5e267e 100644
--- a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
+++ b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
@@ -46,20 +46,21 @@ static void msm_disp_state_dump_regs(u32 **reg, u32 aligned_len, void __iomem *b
 	}
 }
 
-static void msm_disp_state_print_regs(u32 **reg, u32 len, void __iomem *base_addr,
-		struct drm_printer *p)
+static void msm_disp_state_print_regs(const u32 *dump_addr, u32 len,
+		void __iomem *base_addr, struct drm_printer *p)
 {
 	int i;
-	u32 *dump_addr = NULL;
 	void __iomem *addr;
 	u32 num_rows;
 
+	if (!dump_addr) {
+		drm_printf(p, "Registers not stored\n");
+		return;
+	}
+
 	addr = base_addr;
 	num_rows = len / REG_DUMP_ALIGN;
 
-	if (*reg)
-		dump_addr = *reg;
-
 	for (i = 0; i < num_rows; i++) {
 		drm_printf(p, "0x%lx : %08x %08x %08x %08x\n",
 				(unsigned long)(addr - base_addr),
@@ -86,7 +87,7 @@ void msm_disp_state_print(struct msm_disp_state *state, struct drm_printer *p)
 
 	list_for_each_entry_safe(block, tmp, &state->blocks, node) {
 		drm_printf(p, "====================%s================\n", block->name);
-		msm_disp_state_print_regs(&block->state, block->size, block->base_addr, p);
+		msm_disp_state_print_regs(block->state, block->size, block->base_addr, p);
 	}
 
 	drm_printf(p, "===================dpu drm state================\n");