Re: [PATCH 0/3] drm/amd/display: fix NULL derefs on MST HPD and teardown

[Arthur Liberman]

Sorry, the cover letter still had the placeholder text. The summary is:

MST hotplug and topology teardown can run while the CRTCs are still
enabled. That oopses in two amdgpu paths, and a third path turns the
link off during detection.

HPD detect of an MST daisy-chain reaches dc_stream_get_status() from
link_set_all_streams_dpms_off_for_link() with a NULL stream. The
helpers load stream->ctx with no NULL check. Return NULL when stream
is NULL, and skip a NULL entry in the DPMS-off loop.

verify_link_capability() DPMS-offs every live stream unless the link
is embedded, training is skipped, or dpcd_caps.is_mst_capable is set.
detect_link_and_local_sink() re-reads DPCD first and can clear
is_mst_capable while the CRTCs are still on, so detect takes the
destructive path before MST rediscovery. Keep the non-destructive
verify while the link still has DPMS-on master pipes.

dm_dp_mst_atomic_check() calls drm_dp_atomic_release_time_slots()
after an MST topology restart has cleared mst_root or the output port
connector. That is the amdgpu side of a NULL deref in the helper
during kwin_wayland atomic check. Call the helper only while
mst_root, the port, and port->connector are still present.

The matching drm_dp_mst helper fix is sent separately to dri-devel.

Reproduced on a Raphael iGPU (Ryzen 9 9950X) with a USB-C to
DisplayPort MST daisy-chain.