mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 16:53:20 -04:00
Code Issues Packages Projects Releases Wiki Activity

drm/amd/display: Fix wb_info leak and NULL deref in writeback

Browse Source 
[WHAT]
dc_stream_add_writeback() copies wb_info by value, so free it on all
paths via a single cleanup label. Also bail out early when no pipe_ctx
matches the stream to avoid a NULL pointer dereference.

Assisted-by: Copilot:Claude-Opus-4.8
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Alex Hung
2026-07-20 18:32:59 -06:00
committed by Alex Deucher
parent df94112cee
commit 8b87300e1b
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
View File

@@ -4661,21 +4661,19 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm,
wb_info = kzalloc_obj(*wb_info);
if (!wb_info) {
drm_err(adev_to_drm(adev), "Failed to allocate wb_info\n");
return;
goto cleanup;
}
acrtc = to_amdgpu_crtc(wb_conn->encoder.crtc);
if (!acrtc) {
drm_err(adev_to_drm(adev), "no amdgpu_crtc found\n");
kfree(wb_info);
return;
goto cleanup;
}
afb = to_amdgpu_framebuffer(new_con_state->writeback_job->fb);
if (!afb) {
drm_err(adev_to_drm(adev), "No amdgpu_framebuffer found\n");
kfree(wb_info);
return;
goto cleanup;
}
for (i = 0; i < MAX_PIPES; i++) {
@@ -4685,6 +4683,11 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm,
}
}
if (!pipe) {
drm_err(adev_to_drm(adev), "No pipe found for stream\n");
goto cleanup;
}
/* fill in wb_info */
wb_info->wb_enabled = true;
@@ -4758,6 +4761,9 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm,
WARN_ON(drm_crtc_vblank_get(&acrtc->base));
acrtc->wb_frame_done = false;
acrtc->wb_pending = true;
cleanup:
kfree(wb_info);
}
static void amdgpu_dm_update_hdcp(struct drm_atomic_commit *state)