[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 1b686053c06ffb9f4524b288110cf2a831ff7a25
WARNING: Author mismatch between patch and upstream commit:
Backport author: Xiangyu Chen <xiangyu.chen@xxxxxxxxxxxxxxxxx>
Commit author: Rodrigo Siqueira <Rodrigo.Siqueira@xxxxxxx>
Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.11.y | Present (different SHA1: 2002ccb93004)
6.6.y | Not found
Note: The patch differs from the upstream commit:
---
--- - 2024-11-27 11:04:55.475015908 -0500
+++ /tmp/tmp.cuRpI3alDe 2024-11-27 11:04:55.465385699 -0500
@@ -1,3 +1,5 @@
+[ Upstream commit 1b686053c06ffb9f4524b288110cf2a831ff7a25 ]
+
[why & how]
Change the order of the pipe_ctx->plane_state check to ensure that
plane_state is not null before accessing it.
@@ -7,32 +9,26 @@
Signed-off-by: Tom Chung <chiahsuan.chung@xxxxxxx>
Tested-by: Daniel Wheeler <daniel.wheeler@xxxxxxx>
Signed-off-by: Alex Deucher <alexander.deucher@xxxxxxx>
+[Xiangyu: BP to fix CVE: CVE-2024-49906, modified the source path]
+Signed-off-by: Xiangyu Chen <xiangyu.chen@xxxxxxxxxxxxx>
---
- .../gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
-diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
-index 425432ca497f1..a68da1a7092d5 100644
---- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
-+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
-@@ -1932,6 +1932,11 @@ static void dcn20_program_pipe(
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+index 2861268ccd23..a825fd6c7fa6 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+@@ -1742,13 +1742,17 @@ static void dcn20_program_pipe(
(pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.bits.hdr_mult))
hws->funcs.set_hdr_multiplier(pipe_ctx);
+- if (pipe_ctx->update_flags.bits.enable ||
+- (pipe_ctx->plane_state &&
+ if ((pipe_ctx->plane_state && pipe_ctx->plane_state->update_flags.bits.hdr_mult) ||
+ pipe_ctx->update_flags.bits.enable)
+ hws->funcs.set_hdr_multiplier(pipe_ctx);
+
-+
- if (hws->funcs.populate_mcm_luts) {
- if (pipe_ctx->plane_state) {
- hws->funcs.populate_mcm_luts(dc, pipe_ctx, pipe_ctx->plane_state->mcm_luts,
-@@ -1939,13 +1944,13 @@ static void dcn20_program_pipe(
- pipe_ctx->plane_state->lut_bank_a = !pipe_ctx->plane_state->lut_bank_a;
- }
- }
-- if (pipe_ctx->update_flags.bits.enable ||
-- (pipe_ctx->plane_state &&
+ if ((pipe_ctx->plane_state &&
pipe_ctx->plane_state->update_flags.bits.in_transfer_func_change) ||
(pipe_ctx->plane_state &&
@@ -44,3 +40,6 @@
hws->funcs.set_input_transfer_func(dc, pipe_ctx, pipe_ctx->plane_state);
/* dcn10_translate_regamma_to_hw_format takes 750us to finish
+--
+2.25.1
+
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.6.y | Failed | N/A |
