[PATCH 09/59] drm/amd/display: Avoid NULL hubp deref for remaining mpcc_id assignment

From: James Lin <[email protected]>

Previous fix converted most mpcc_id assignments in dc_hw_sequencer.c
from pipe_ctx->plane_res.hubp->inst to plane_res.mpcc_inst, but missed
the update_visual_confirm and power_on_mpc_mem_pwr paths in
hwss_build_fast_sequence(). On DCE ASICs the pipe owns no HUBP, so those
two remaining hubp->inst reads can NULL-deref.

Use mpcc_inst for the remaining two assignments, matching the rest of
the function and avoiding the NULL pointer dereference (same issue
addressed upstream by "avoid NULL hubp deref when filling mpcc_id on
DCE").

Fixes: f0b207067bb3 ("drm/amd/display: Use mpcc_id instead of hubp instance")
Reviewed-by: Tomasz Siemek <[email protected]>
Signed-off-by: James Lin <[email protected]>
Signed-off-by: Alex Hung <[email protected]>
---
 drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
index 8b723c3ca933..47320ac01711 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
@@ -1610,13 +1610,13 @@ void hwss_build_fast_sequence(struct dc *dc,
 				dc->hwss.update_visual_confirm_color) {
 				block_sequence[*num_steps].params.update_visual_confirm_params.dc = dc;
 				block_sequence[*num_steps].params.update_visual_confirm_params.pipe_ctx = current_mpc_pipe;
-				block_sequence[*num_steps].params.update_visual_confirm_params.mpcc_id = current_mpc_pipe->plane_res.hubp->inst;
+				block_sequence[*num_steps].params.update_visual_confirm_params.mpcc_id = current_mpc_pipe->plane_res.mpcc_inst;
 				block_sequence[*num_steps].func = MPC_UPDATE_VISUAL_CONFIRM;
 				(*num_steps)++;
 			}
 			if (current_mpc_pipe->stream->update_flags.bits.out_csc) {
 				block_sequence[*num_steps].params.power_on_mpc_mem_pwr_params.mpc = dc->res_pool->mpc;
-				block_sequence[*num_steps].params.power_on_mpc_mem_pwr_params.mpcc_id = current_mpc_pipe->plane_res.hubp->inst;
+				block_sequence[*num_steps].params.power_on_mpc_mem_pwr_params.mpcc_id = current_mpc_pipe->plane_res.mpcc_inst;
 				block_sequence[*num_steps].params.power_on_mpc_mem_pwr_params.power_on = true;
 				block_sequence[*num_steps].func = MPC_POWER_ON_MPC_MEM_PWR;
 				(*num_steps)++;
-- 
2.43.0