RE: [PATCH] drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()

[Deucher, Alexander]

Public

Applied.  Thanks!

> -----Original Message-----
> From: Wentao Liang <vulab@xxxxxxxxxxx>
> Sent: Wednesday, September 16, 2026 5:50 AM
> To: Lakha, Bhawanpreet <Bhawanpreet.Lakha@xxxxxxx>
> Cc: airlied@xxxxxxxxx; Deucher, Alexander <Alexander.Deucher@xxxxxxx>;
> amd-gfx@xxxxxxxxxxxxxxxxxxxxx; Koenig, Christian
> <Christian.Koenig@xxxxxxx>; dri-devel@xxxxxxxxxxxxxxxxxxxxx; Wentland,
> Harry <Harry.Wentland@xxxxxxx>; linux-kernel@xxxxxxxxxxxxxxx; Kazlauskas,
> Nicholas <Nicholas.Kazlauskas@xxxxxxx>; simona@xxxxxxxx;
> siqueira@xxxxxxxxxx; Li, Sun peng (Leo) <Sunpeng.Li@xxxxxxx>; Wentao
> Liang <vulab@xxxxxxxxxxx>; stable@xxxxxxxxxxxxxxx
> Subject: [PATCH] drm/amd/display: Fix dc stream excess put in
> dm_update_crtc_state()
>
> In dm_update_crtc_state(), when a modeset is required the newly created
> stream is stored in dm_new_crtc_state->stream and an extra reference is
> taken with dc_stream_retain().  The reference returned by
> create_validate_stream_for_sink() is released as an extra reference at the
> skip_modeset label, leaving the stream owned by the new CRTC state.
>
> If amdgpu_dm_check_crtc_color_mgmt() fails afterwards, the code jumps to
> the fail label which releases new_stream again.  Since the extra reference was
> already released at skip_modeset, this drops the reference owned by
> dm_new_crtc_state->stream and the stream is released while the atomic state
> still points to it, leading to a premature free of the dc stream.
>
> Set new_stream to NULL after releasing the extra reference at the
> skip_modeset label so that a later goto fail cannot release the reference owned
> by the new CRTC state.
>
> Fixes: 7cd4b70091a5 ("drm/amd/display: Rework CRTC color management")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>  drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> index 5fc5d5608506..28300a3e757a 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> @@ -11706,8 +11706,10 @@ static int dm_update_crtc_state(struct
> amdgpu_display_manager *dm,
>
>  skip_modeset:
>       /* Release extra reference */
> -     if (new_stream)
> +     if (new_stream) {
>               dc_stream_release(new_stream);
> +             new_stream = NULL;
> +     }
>
>       /*
>        * We want to do dc stream updates that do not require a
> --
> 2.34.1