[PATCH 09/59] drm/amd/display: Avoid NULL hubp deref for remaining mpcc_id assignment

[Alex Hung]

From: James Lin <pinglei....@amd.com>

Previous fix converted most mpcc_id assignments in dc_hw_sequencer.c
from pipe_ctx->plane_res.hubp->inst to plane_res.mpcc_inst, but missed
the update_visual_confirm and power_on_mpc_mem_pwr paths in
hwss_build_fast_sequence(). On DCE ASICs the pipe owns no HUBP, so those
two remaining hubp->inst reads can NULL-deref.

Use mpcc_inst for the remaining two assignments, matching the rest of
the function and avoiding the NULL pointer dereference (same issue
addressed upstream by "avoid NULL hubp deref when filling mpcc_id on
DCE").

Fixes: f0b207067bb3 ("drm/amd/display: Use mpcc_id instead of hubp instance")
Reviewed-by: Tomasz Siemek <tomasz.sie...@amd.com>
Signed-off-by: James Lin <pinglei....@amd.com>
Signed-off-by: Alex Hung <alex.h...@amd.com>
---
 drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c 
b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
index 8b723c3ca933..47320ac01711 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
@@ -1610,13 +1610,13 @@ void hwss_build_fast_sequence(struct dc *dc,
                                dc->hwss.update_visual_confirm_color) {
                                
block_sequence[*num_steps].params.update_visual_confirm_params.dc = dc;
                                
block_sequence[*num_steps].params.update_visual_confirm_params.pipe_ctx = 
current_mpc_pipe;
-                               
block_sequence[*num_steps].params.update_visual_confirm_params.mpcc_id = 
current_mpc_pipe->plane_res.hubp->inst;
+                               
block_sequence[*num_steps].params.update_visual_confirm_params.mpcc_id = 
current_mpc_pipe->plane_res.mpcc_inst;
                                block_sequence[*num_steps].func = 
MPC_UPDATE_VISUAL_CONFIRM;
                                (*num_steps)++;
                        }
                        if 
(current_mpc_pipe->stream->update_flags.bits.out_csc) {
                                
block_sequence[*num_steps].params.power_on_mpc_mem_pwr_params.mpc = 
dc->res_pool->mpc;
-                               
block_sequence[*num_steps].params.power_on_mpc_mem_pwr_params.mpcc_id = 
current_mpc_pipe->plane_res.hubp->inst;
+                               
block_sequence[*num_steps].params.power_on_mpc_mem_pwr_params.mpcc_id = 
current_mpc_pipe->plane_res.mpcc_inst;
                                
block_sequence[*num_steps].params.power_on_mpc_mem_pwr_params.power_on = true;
                                block_sequence[*num_steps].func = 
MPC_POWER_ON_MPC_MEM_PWR;
                                (*num_steps)++;
-- 
2.43.0