[lvc-project] [PATCH 6.1 1/1] drm/amd/display: fix NULL deref in dcn21_set_backlight_level()

[Nikita Zhandarovich]

'panel_cntl' structure used to control the display panel could be null,
dereferencing it could lead to a null pointer access.

Fix the issue by testing the 'panel_cntl' value in question before
attempting to access it properly.

Also, for safety sake, emulate upstream commit e96fddb32931
("drm/amd/display: Fix 'panel_cntl' could be null in
'dcn21_set_backlight_level()'") focusing on the same issue
and add rearrange similar checks for 'abm' and 'tg' values, at the
same time removing redundant check before a call to
dmub_abm_set_pipe().

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: e922057b556d ("drm/amd/display: Added support for multiple eDP BL control")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich at fintech.ru>
---
 drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
index 69cc192a7e71..f53918dfd798 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
@@ -202,16 +202,21 @@ bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx,
 	union dmub_rb_cmd cmd;
 	struct dc_context *dc = pipe_ctx->stream->ctx;
 	struct abm *abm = pipe_ctx->stream_res.abm;
-	uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
+	struct timing_generator *tg = pipe_ctx->stream_res.tg;
 	struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
+	uint32_t otg_inst;
+
+	if (!abm || !tg || !panel_cntl)
+		return false;
+
+	otg_inst = tg->inst;
 
 	if (dc->dc->res_pool->dmcu) {
 		dce110_set_backlight_level(pipe_ctx, backlight_pwm_u16_16, frame_ramp);
 		return true;
 	}
 
-	if (abm && panel_cntl)
-		dmub_abm_set_pipe(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst);
+	dmub_abm_set_pipe(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst);
 
 	memset(&cmd, 0, sizeof(cmd));
 	cmd.abm_set_backlight.header.type = DMUB_CMD__ABM;