diff options
| author | Alex Hung <alex.hung@amd.com> | 2026-07-20 18:32:59 -0600 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2026-08-06 09:58:35 -0400 |
| commit | 8b87300e1b2a747a608c5036ea57bb9dcd91d82b (patch) | |
| tree | 2f84bd856f93d1c5390aba83657edeadb5dccf88 /drivers/gpu/drm/amd | |
| parent | df94112ceebfb20bc7f6524769c74d5e6e8dcc2d (diff) | |
| download | linux-8b87300e1b2a747a608c5036ea57bb9dcd91d82b.tar.gz linux-8b87300e1b2a747a608c5036ea57bb9dcd91d82b.zip | |
drm/amd/display: Fix wb_info leak and NULL deref in writeback
[WHAT]
dc_stream_add_writeback() copies wb_info by value, so free it on all
paths via a single cleanup label. Also bail out early when no pipe_ctx
matches the stream to avoid a NULL pointer dereference.
Assisted-by: Copilot:Claude-Opus-4.8
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd')
| -rw-r--r-- | drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 437350ec46da..f19df26e48e0 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -4661,21 +4661,19 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm, wb_info = kzalloc_obj(*wb_info); if (!wb_info) { drm_err(adev_to_drm(adev), "Failed to allocate wb_info\n"); - return; + goto cleanup; } acrtc = to_amdgpu_crtc(wb_conn->encoder.crtc); if (!acrtc) { drm_err(adev_to_drm(adev), "no amdgpu_crtc found\n"); - kfree(wb_info); - return; + goto cleanup; } afb = to_amdgpu_framebuffer(new_con_state->writeback_job->fb); if (!afb) { drm_err(adev_to_drm(adev), "No amdgpu_framebuffer found\n"); - kfree(wb_info); - return; + goto cleanup; } for (i = 0; i < MAX_PIPES; i++) { @@ -4685,6 +4683,11 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm, } } + if (!pipe) { + drm_err(adev_to_drm(adev), "No pipe found for stream\n"); + goto cleanup; + } + /* fill in wb_info */ wb_info->wb_enabled = true; @@ -4758,6 +4761,9 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm, WARN_ON(drm_crtc_vblank_get(&acrtc->base)); acrtc->wb_frame_done = false; acrtc->wb_pending = true; + +cleanup: + kfree(wb_info); } static void amdgpu_dm_update_hdcp(struct drm_atomic_commit *state) |