Commit be73e608 authored by Josip Pavic's avatar Josip Pavic Committed by Alex Deucher

drm/amd/display: handle failed allocation during stream construction

[Why]
Failing to allocate a transfer function during stream construction leads
to a null pointer dereference

[How]
Handle the failed allocation by failing the stream construction

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJosip Pavic <Josip.Pavic@amd.com>
Reviewed-by: default avatarAric Cyr <Aric.Cyr@amd.com>
Acked-by: default avatarRodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent b448d30b
...@@ -56,7 +56,7 @@ void update_stream_signal(struct dc_stream_state *stream, struct dc_sink *sink) ...@@ -56,7 +56,7 @@ void update_stream_signal(struct dc_stream_state *stream, struct dc_sink *sink)
} }
} }
static void dc_stream_construct(struct dc_stream_state *stream, static bool dc_stream_construct(struct dc_stream_state *stream,
struct dc_sink *dc_sink_data) struct dc_sink *dc_sink_data)
{ {
uint32_t i = 0; uint32_t i = 0;
...@@ -118,11 +118,17 @@ static void dc_stream_construct(struct dc_stream_state *stream, ...@@ -118,11 +118,17 @@ static void dc_stream_construct(struct dc_stream_state *stream,
update_stream_signal(stream, dc_sink_data); update_stream_signal(stream, dc_sink_data);
stream->out_transfer_func = dc_create_transfer_func(); stream->out_transfer_func = dc_create_transfer_func();
if (stream->out_transfer_func == NULL) {
dc_sink_release(dc_sink_data);
return false;
}
stream->out_transfer_func->type = TF_TYPE_BYPASS; stream->out_transfer_func->type = TF_TYPE_BYPASS;
stream->out_transfer_func->ctx = stream->ctx; stream->out_transfer_func->ctx = stream->ctx;
stream->stream_id = stream->ctx->dc_stream_id_count; stream->stream_id = stream->ctx->dc_stream_id_count;
stream->ctx->dc_stream_id_count++; stream->ctx->dc_stream_id_count++;
return true;
} }
static void dc_stream_destruct(struct dc_stream_state *stream) static void dc_stream_destruct(struct dc_stream_state *stream)
...@@ -164,13 +170,20 @@ struct dc_stream_state *dc_create_stream_for_sink( ...@@ -164,13 +170,20 @@ struct dc_stream_state *dc_create_stream_for_sink(
stream = kzalloc(sizeof(struct dc_stream_state), GFP_KERNEL); stream = kzalloc(sizeof(struct dc_stream_state), GFP_KERNEL);
if (stream == NULL) if (stream == NULL)
return NULL; goto alloc_fail;
dc_stream_construct(stream, sink); if (dc_stream_construct(stream, sink) == false)
goto construct_fail;
kref_init(&stream->refcount); kref_init(&stream->refcount);
return stream; return stream;
construct_fail:
kfree(stream);
alloc_fail:
return NULL;
} }
struct dc_stream_state *dc_copy_stream(const struct dc_stream_state *stream) struct dc_stream_state *dc_copy_stream(const struct dc_stream_state *stream)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment