diff options
| author | Wentao Liang <vulab@iscas.ac.cn> | 2026-09-16 09:49:56 +0000 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2026-09-23 12:56:51 -0400 |
| commit | 102a47065a62dc8f6bbbb47cf082a2934282eb08 (patch) | |
| tree | f9c58acecd76acc6b232b8c255b59fb6ab3ae61a /drivers/gpu/drm/amd/display/amdgpu_dm | |
| parent | c99a13b20092c343d5aa3b8941777578c1715e54 (diff) | |
| download | linux-next-102a47065a62dc8f6bbbb47cf082a2934282eb08.tar.gz linux-next-102a47065a62dc8f6bbbb47cf082a2934282eb08.zip | |
drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
In dm_update_crtc_state(), when a modeset is required the newly created
stream is stored in dm_new_crtc_state->stream and an extra reference is
taken with dc_stream_retain(). The reference returned by
create_validate_stream_for_sink() is released as an extra reference at
the skip_modeset label, leaving the stream owned by the new CRTC state.
If amdgpu_dm_check_crtc_color_mgmt() fails afterwards, the code jumps
to the fail label which releases new_stream again. Since the extra
reference was already released at skip_modeset, this drops the
reference owned by dm_new_crtc_state->stream and the stream is
released while the atomic state still points to it, leading to a
premature free of the dc stream.
Set new_stream to NULL after releasing the extra reference at the
skip_modeset label so that a later goto fail cannot release the
reference owned by the new CRTC state.
Fixes: 7cd4b70091a5 ("drm/amd/display: Rework CRTC color management")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/display/amdgpu_dm')
| -rw-r--r-- | drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index b5fef1f0b86b..86c7e16ba9c5 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -5714,8 +5714,10 @@ STATIC_IFN_KUNIT int dm_update_crtc_state(struct amdgpu_display_manager *dm, skip_modeset: /* Release extra reference */ - if (new_stream) + if (new_stream) { dc_stream_release(new_stream); + new_stream = NULL; + } new_stream = NULL; /* |