In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: use proper context for logging

The same as the rest of the code, get ss info from atombios() uses calc pll cs->ctx->logger for logging. But calc pll cs->ctx is initialized only later in calc pll max vco construct(). Therefore, any output using DC LOG SYNC() leads to a NULL pointer deference in get ss info from atombios().

According to Sashiko, the very same problem exists in dce112 get pix clk dividers() and dcn3 get pix clk dividers() too.

To avoid accessing the NULL context, use clk src->base.ctx->logger everywhere. That context in base is initialized earlier in dce110 clk src construct() and dce112 clk src construct(). Before get ss info from atombios() or Sashiko's get pix clk dividers functions above are actually called. This is done by redefining DC LOGGER to CTX->logger.

Before: dce110 clk src construct() did: -> sets clk src->base.ctx = ctx; -> ss info from atombios create() -> get ss info from atombios() <- uses calc pll cs->ctx # BOOM -> calc pll max vco construct() <- sets calc pll cs->ctx

After: dce110 clk src construct() does: -> sets clk src->base.ctx = ctx; -> ss info from atombios create() -> get ss info from atombios() <- uses clk src->base.ctx

(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)