CVE-2024-47720

This commit adds a null check for the setoutputgamma function pointer in the dcn30setoutputtransferfunc function. Previously, setoutputgamma was being checked for nullity at line 386, but then it was being dereferenced without any nullity check at line 401. This could potentially lead to a null pointer dereference error if setoutputgamma is indeed null.

To fix this, we now ensure that setoutputgamma is not null before dereferencing it. We do this by adding a nullity check for setoutputgamma before the call to setoutputgamma at line 401. If setoutputgamma is null, we log an error message and do not call the function.

This fix prevents a potential null pointer dereference error.

drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30hwseq.c:401 dcn30setoutputtransferfunc() error: we previously assumed 'mpc->funcs->setoutput_gamma' could be null (see line 386)

drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30hwseq.c 373 bool dcn30setoutputtransferfunc(struct dc *dc, 374 struct pipectx pipe_ctx, 375 const struct dc_stream_state *stream) 376 { 377 int mpcc_id = pipe_ctx->plane_res.hubp->inst; 378 struct mpc *mpc = pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc; 379 const struct pwl_params *params = NULL; 380 bool ret = false; 381 382 / program OGAM or 3DLUT only for the top pipe/ 383 if (pipe_ctx->top_pipe == NULL) { 384 /program rmu shaper and 3dlut in MPC*/ 385 ret = dcn30setmpcshaper3dlut(pipectx, stream); 386 if (ret == false && mpc->funcs->setoutput_gamma) { ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL

387                         if (stream->out_transfer_func.type == TF_TYPE_HWPWL)
388                                 params = &stream->out_transfer_func.pwl;
389                         else if (pipe_ctx->stream->out_transfer_func.type ==
390                                         TF_TYPE_DISTRIBUTED_POINTS &&
391                                         cm3_helper_translate_curve_to_hw_format(
392                                         &stream->out_transfer_func,
393                                         &mpc->blender_params, false))
394                                 params = &mpc->blender_params;
395                          /* there are no ROM LUTs in OUTGAM */
396                         if (stream->out_transfer_func.type == TF_TYPE_PREDEFINED)
397                                 BREAK_TO_DEBUGGER();
398                 }
399         }
400

--> 401 mpc->funcs->setoutputgamma(mpc, mpcc_id, params); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash

402         return ret;
403 }

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

d99f13878d6f9c286b13860d8bf0b4db9ffb189a

Fixed

44948d3cb943602ba4a0b5ed3c91ae0525838fb1

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

d99f13878d6f9c286b13860d8bf0b4db9ffb189a

Fixed

64886a4e6f1dce843c0889505cf0673b5211e16a

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

d99f13878d6f9c286b13860d8bf0b4db9ffb189a

Fixed

ddf9ff244d704e1903533f7be377615ed34b83e7

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

d99f13878d6f9c286b13860d8bf0b4db9ffb189a

Fixed

84edd5a3f5fa6aafa4afcaf9f101f46426c620c9

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

d99f13878d6f9c286b13860d8bf0b4db9ffb189a

Fixed

72ee32d0907364104fbcf4f68dd5ae63cd8eae9e

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

d99f13878d6f9c286b13860d8bf0b4db9ffb189a

Fixed

08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2

Affected versions

v5.*

v5.10

v5.10-rc1

v5.10-rc2

v5.10-rc3

v5.10-rc4

v5.10-rc5

v5.10-rc6

v5.10-rc7

v5.11

v5.11-rc1

v5.11-rc2

v5.11-rc3

v5.11-rc4

v5.11-rc5

v5.11-rc6

v5.11-rc7

v5.12

v5.12-rc1

v5.12-rc1-dontuse

v5.12-rc2

v5.12-rc3

v5.12-rc4

v5.12-rc5

v5.12-rc6

v5.12-rc7

v5.12-rc8

v5.13

v5.13-rc1

v5.13-rc2

v5.13-rc3

v5.13-rc4

v5.13-rc5

v5.13-rc6

v5.13-rc7

v5.14

v5.14-rc1

v5.14-rc2

v5.14-rc3

v5.14-rc4

v5.14-rc5

v5.14-rc6

v5.14-rc7

v5.15

v5.15-rc1

v5.15-rc2

v5.15-rc3

v5.15-rc4

v5.15-rc5

v5.15-rc6

v5.15-rc7

v5.15.1

v5.15.10

v5.15.100

v5.15.101

v5.15.102

v5.15.103

v5.15.104

v5.15.105

v5.15.106

v5.15.107

v5.15.108

v5.15.109

v5.15.11

v5.15.110

v5.15.111

v5.15.112

v5.15.113

v5.15.114

v5.15.115

v5.15.116

v5.15.117

v5.15.118

v5.15.119

v5.15.12

v5.15.120

v5.15.121

v5.15.122

v5.15.123

v5.15.124

v5.15.125

v5.15.126

v5.15.127

v5.15.128

v5.15.129

v5.15.13

v5.15.130

v5.15.131

v5.15.132

v5.15.133

v5.15.134

v5.15.135

v5.15.136

v5.15.137

v5.15.138

v5.15.139

v5.15.14

v5.15.140

v5.15.141

v5.15.142

v5.15.143

v5.15.144

v5.15.145

v5.15.146

v5.15.147

v5.15.148

v5.15.149

v5.15.15

v5.15.150

v5.15.151

v5.15.152

v5.15.153

v5.15.154

v5.15.155

v5.15.156

v5.15.157

v5.15.158

v5.15.159

v5.15.16

v5.15.160

v5.15.161

v5.15.162

v5.15.163

v5.15.164

v5.15.165

v5.15.166

v5.15.167

v5.15.17

v5.15.18

v5.15.19

v5.15.2

v5.15.20

v5.15.21

v5.15.22

v5.15.23

v5.15.24

v5.15.25

v5.15.26

v5.15.27

v5.15.28

v5.15.29

v5.15.3

v5.15.30

v5.15.31

v5.15.32

v5.15.33

v5.15.34

v5.15.35

v5.15.36

v5.15.37

v5.15.38

v5.15.39

v5.15.4

v5.15.40

v5.15.41

v5.15.42

v5.15.43

v5.15.44

v5.15.45

v5.15.46

v5.15.47

v5.15.48

v5.15.49

v5.15.5

v5.15.50

v5.15.51

v5.15.52

v5.15.53

v5.15.54

v5.15.55

v5.15.56

v5.15.57

v5.15.58

v5.15.59

v5.15.6

v5.15.60

v5.15.61

v5.15.62

v5.15.63

v5.15.64

v5.15.65

v5.15.66

v5.15.67

v5.15.68

v5.15.69

v5.15.7

v5.15.70

v5.15.71

v5.15.72

v5.15.73

v5.15.74

v5.15.75

v5.15.76

v5.15.77

v5.15.78

v5.15.79

v5.15.8

v5.15.80

v5.15.81

v5.15.82

v5.15.83

v5.15.84

v5.15.85

v5.15.86

v5.15.87

v5.15.88

v5.15.89

v5.15.9

v5.15.90

v5.15.91

v5.15.92

v5.15.93

v5.15.94

v5.15.95

v5.15.96

v5.15.97

v5.15.98

v5.15.99

v5.16

v5.16-rc1

v5.16-rc2

v5.16-rc3

v5.16-rc4

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.17

v5.17-rc1

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v5.7

v5.7-rc3

v5.7-rc4

v5.7-rc5

v5.7-rc6

v5.7-rc7

v5.8

v5.8-rc1

v5.8-rc2

v5.8-rc3

v5.8-rc4

v5.8-rc5

v5.8-rc6

v5.8-rc7

v5.9

v5.9-rc1

v5.9-rc2

v5.9-rc3

v5.9-rc4

v5.9-rc5

v5.9-rc6

v5.9-rc7

v5.9-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.10

v6.1.100

v6.1.101

v6.1.102

v6.1.103

v6.1.104

v6.1.105

v6.1.106

v6.1.107

v6.1.108

v6.1.109

v6.1.11

v6.1.110

v6.1.111

v6.1.112

v6.1.12

v6.1.13

v6.1.14

v6.1.15

v6.1.16

v6.1.17

v6.1.18

v6.1.19

v6.1.2

v6.1.20

v6.1.21

v6.1.22

v6.1.23

v6.1.24

v6.1.25

v6.1.26

v6.1.27

v6.1.28

v6.1.29

v6.1.3

v6.1.30

v6.1.31

v6.1.32

v6.1.33

v6.1.34

v6.1.35

v6.1.36

v6.1.37

v6.1.38

v6.1.39

v6.1.4

v6.1.40

v6.1.41

v6.1.42

v6.1.43

v6.1.44

v6.1.45

v6.1.46

v6.1.47

v6.1.48

v6.1.49

v6.1.5

v6.1.50

v6.1.51

v6.1.52

v6.1.53

v6.1.54

v6.1.55

v6.1.56

v6.1.57

v6.1.58

v6.1.59

v6.1.6

v6.1.60

v6.1.61

v6.1.62

v6.1.63

v6.1.64

v6.1.65

v6.1.66

v6.1.67

v6.1.68

v6.1.69

v6.1.7

v6.1.70

v6.1.71

v6.1.72

v6.1.73

v6.1.74

v6.1.75

v6.1.76

v6.1.77

v6.1.78

v6.1.79

v6.1.8

v6.1.80

v6.1.81

v6.1.82

v6.1.83

v6.1.84

v6.1.85

v6.1.86

v6.1.87

v6.1.88

v6.1.89

v6.1.9

v6.1.90

v6.1.91

v6.1.92

v6.1.93

v6.1.94

v6.1.95

v6.1.96

v6.1.97

v6.1.98

v6.1.99

v6.10

v6.10-rc1

v6.10-rc2

v6.10-rc3

v6.10-rc4

v6.10-rc5

v6.10-rc6

v6.10-rc7

v6.10.1

v6.10.10

v6.10.11

v6.10.12

v6.10.2

v6.10.3

v6.10.4

v6.10.5

v6.10.6

v6.10.7

v6.10.8

v6.10.9

v6.11

v6.11-rc1

v6.11-rc2

v6.11-rc3

v6.11-rc4

v6.11-rc5

v6.11-rc6

v6.11-rc7

v6.11.1

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.6

v6.6-rc1

v6.6-rc2

v6.6-rc3

v6.6-rc4

v6.6-rc5

v6.6-rc6

v6.6-rc7

v6.6.1

v6.6.10

v6.6.11

v6.6.12

v6.6.13

v6.6.14

v6.6.15

v6.6.16

v6.6.17

v6.6.18

v6.6.19

v6.6.2

v6.6.20

v6.6.21

v6.6.22

v6.6.23

v6.6.24

v6.6.25

v6.6.26

v6.6.27

v6.6.28

v6.6.29

v6.6.3

v6.6.30

v6.6.31

v6.6.32

v6.6.33

v6.6.34

v6.6.35

v6.6.36

v6.6.37

v6.6.38

v6.6.39

v6.6.4

v6.6.40

v6.6.41

v6.6.42

v6.6.43

v6.6.44

v6.6.45

v6.6.46

v6.6.47

v6.6.48

v6.6.49

v6.6.5

v6.6.50

v6.6.51

v6.6.52

v6.6.53

v6.6.6

v6.6.7

v6.6.8

v6.6.9

v6.7

v6.7-rc1

v6.7-rc2

v6.7-rc3

v6.7-rc4

v6.7-rc5

v6.7-rc6

v6.7-rc7

v6.7-rc8

v6.8

v6.8-rc1

v6.8-rc2

v6.8-rc3

v6.8-rc4

v6.8-rc5

v6.8-rc6

v6.8-rc7

v6.9

v6.9-rc1

v6.9-rc2

v6.9-rc3

v6.9-rc4

v6.9-rc5

v6.9-rc6

v6.9-rc7

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "id": "CVE-2024-47720-028a3868",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64886a4e6f1dce843c0889505cf0673b5211e16a",
        "signature_version": "v1",
        "target": {
            "file": "drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "290920904263519079782759745271432694135",
                "178004838236867860786616352069877191110",
                "175848584986446230056019158401352758852",
                "233797576161868386235322425104154225518"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-47720-21ab68c4",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2",
        "signature_version": "v1",
        "target": {
            "file": "drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "290920904263519079782759745271432694135",
                "178004838236867860786616352069877191110",
                "175848584986446230056019158401352758852",
                "233797576161868386235322425104154225518"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-47720-24c29f31",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72ee32d0907364104fbcf4f68dd5ae63cd8eae9e",
        "signature_version": "v1",
        "target": {
            "file": "drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "290920904263519079782759745271432694135",
                "178004838236867860786616352069877191110",
                "175848584986446230056019158401352758852",
                "233797576161868386235322425104154225518"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-47720-29524891",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64886a4e6f1dce843c0889505cf0673b5211e16a",
        "signature_version": "v1",
        "target": {
            "function": "dcn30_set_output_transfer_func",
            "file": "drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c"
        },
        "digest": {
            "function_hash": "69463521494299297983062630558801372246",
            "length": 847.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-47720-417d4138",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddf9ff244d704e1903533f7be377615ed34b83e7",
        "signature_version": "v1",
        "target": {
            "file": "drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "290920904263519079782759745271432694135",
                "178004838236867860786616352069877191110",
                "175848584986446230056019158401352758852",
                "233797576161868386235322425104154225518"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-47720-5186cd93",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddf9ff244d704e1903533f7be377615ed34b83e7",
        "signature_version": "v1",
        "target": {
            "function": "dcn30_set_output_transfer_func",
            "file": "drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c"
        },
        "digest": {
            "function_hash": "69463521494299297983062630558801372246",
            "length": 847.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-47720-64b64f50",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44948d3cb943602ba4a0b5ed3c91ae0525838fb1",
        "signature_version": "v1",
        "target": {
            "function": "dcn30_set_output_transfer_func",
            "file": "drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c"
        },
        "digest": {
            "function_hash": "69463521494299297983062630558801372246",
            "length": 847.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-47720-91179463",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44948d3cb943602ba4a0b5ed3c91ae0525838fb1",
        "signature_version": "v1",
        "target": {
            "file": "drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "290920904263519079782759745271432694135",
                "178004838236867860786616352069877191110",
                "175848584986446230056019158401352758852",
                "233797576161868386235322425104154225518"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-47720-bd893a48",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72ee32d0907364104fbcf4f68dd5ae63cd8eae9e",
        "signature_version": "v1",
        "target": {
            "function": "dcn30_set_output_transfer_func",
            "file": "drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c"
        },
        "digest": {
            "function_hash": "21568014353412024973597368488548913447",
            "length": 821.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-47720-be31a60d",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2",
        "signature_version": "v1",
        "target": {
            "function": "dcn30_set_output_transfer_func",
            "file": "drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c"
        },
        "digest": {
            "function_hash": "21568014353412024973597368488548913447",
            "length": 821.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-47720-f47babbe",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84edd5a3f5fa6aafa4afcaf9f101f46426c620c9",
        "signature_version": "v1",
        "target": {
            "file": "drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "290920904263519079782759745271432694135",
                "178004838236867860786616352069877191110",
                "175848584986446230056019158401352758852",
                "233797576161868386235322425104154225518"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-47720-fc948fa7",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84edd5a3f5fa6aafa4afcaf9f101f46426c620c9",
        "signature_version": "v1",
        "target": {
            "function": "dcn30_set_output_transfer_func",
            "file": "drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c"
        },
        "digest": {
            "function_hash": "21568014353412024973597368488548913447",
            "length": 821.0
        },
        "deprecated": false
    }
]

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.9.0

Fixed

5.15.168

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.113

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.54

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.10.13

Type: ECOSYSTEM
Events: Introduced

6.11.0

Fixed

6.11.2