[PATCH] drm/display: fix NULL deref in MST time slot release

[Arthur Liberman]

>From 3252a2098213f539a17de92a7b7af11461d0c5c5 Mon Sep 17 00:00:00 2001
Message-ID: <3252a2098213f539a17de92a7b7af11461d0c5c5.1790085016.git.arthur_liberman@xxxxxxxxxxx>
From: Arthur Liberman <arthur_liberman@xxxxxxxxxxx>
Date: Mon, 21 Sep 2026 16:36:47 +0300
Subject: [PATCH] drm/display: fix NULL deref in MST time slot release

drm_dp_atomic_release_time_slots() is documented as safe to call after
the MST port is gone. After topology teardown or reprobe (unplug,
start/stop TM), port or port->connector can be NULL. Atomic check then
oopses from kwin_wayland:

  RIP: drm_dp_atomic_release_time_slots
  CR2: 0x80

Return 0 if port or port->connector is NULL, and if the old or new
connector state is missing.

Fixes: a5c2c0d164e9 ("drm/display/dp_mst: Add nonblocking helpers for DP MST")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Cursor:xai-grok-4.6
Signed-off-by: Arthur Liberman <arthur_liberman@xxxxxxxxxxx>
---
 drivers/gpu/drm/display/drm_dp_mst_topology.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
index 7ce9e212770a..31b30706cda3 100644
--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
@@ -4536,12 +4536,23 @@ int drm_dp_atomic_release_time_slots(struct drm_atomic_commit *state,
 	struct drm_connector_state *old_conn_state, *new_conn_state;
 	bool update_payload = true;
 
+	/*
+	 * Port may outlive its DRM connector across MST teardown/reprobe
+	 * (unplug, topology restart). The helper is documented as safe to
+	 * call in that case.
+	 */
+	if (!port || !port->connector)
+		return 0;
+
 	old_conn_state = drm_atomic_get_old_connector_state(state, port->connector);
-	if (!old_conn_state->crtc)
+	if (!old_conn_state || !old_conn_state->crtc)
 		return 0;
 
 	/* If the CRTC isn't disabled by this state, don't release it's payload */
 	new_conn_state = drm_atomic_get_new_connector_state(state, port->connector);
+	if (!new_conn_state)
+		return 0;
+
 	if (new_conn_state->crtc) {
 		struct drm_crtc_state *crtc_state =
 			drm_atomic_get_new_crtc_state(state, new_conn_state->crtc);

base-commit: 8a43738e56d9eb76a573cabab4c9c0e73eab23b2
-- 
2.55.0