[PATCH] drm/amd/display: fix refcount leak in detect_link_and_local_sink()

[PATCH] drm/amd/display: fix refcount leak in detect_link_and_local_sink()

[Wentao Liang]

In detect_link_and_local_sink(), prev_sink is retained via
dc_sink_retain() to keep it alive while probing for a new sink.
When the link type is DisplayPort and the USB-C alt mode
transition times out (i.e. wait_for_entering_dp_alt_mode()
returns false), the function returns false without releasing
the prev_sink reference acquired earlier.  All other error paths
after the retain properly release the reference.

Fix this by calling dc_sink_release(prev_sink) before returning
on the DP alt mode timeout path.

Cc: stable@vger.kernel.org
Fixes: 54618888d1ea ("drm/amd/display: break down dc_link.c")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/amd/display/dc/link/link_detection.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/link/link_detection.c b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
index 794dd6a95918..4473d93b783a 100644
--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
@@ -1069,8 +1069,10 @@ static bool detect_link_and_local_sink(struct dc_link *link,
 			    link->link_enc->features.flags.bits.DP_IS_USB_C == 1) {
 
 				/* if alt mode times out, return false */
-				if (!wait_for_entering_dp_alt_mode(link))
+				if (!wait_for_entering_dp_alt_mode(link)) {
+					dc_sink_release(prev_sink);
 					return false;
+				}
 			}
 
 			if (!detect_dp(link, &sink_caps, reason)) {
-- 
2.34.1

Re: [PATCH] drm/amd/display: fix refcount leak in detect_link_and_local_sink()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The patch introduces a NULL pointer dereference by calling `dc_sink_release(prev_sink)` without checking if `prev_sink` is NULL when DP alt mode times out.
--

commit 341dc989b4f07001883ab7ee04e6a4e4cda21615
Author: Wentao Liang <vulab@iscas.ac.cn>

drm/amd/display: fix refcount leak in detect_link_and_local_sink()

Fix a refcount leak by releasing prev_sink on the DP alt mode timeout path
in detect_link_and_local_sink().

> diff --git a/drivers/gpu/drm/amd/display/dc/link/link_detection.c b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
> index a3212fd151d16..0d1352bf1da29 100644
> --- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c
> +++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
> @@ -1164,8 +1164,10 @@ static bool detect_link_and_local_sink(struct dc_link *link,
>  			    link->link_enc->features.flags.bits.DP_IS_USB_C == 1) {
>  
>  				/* if alt mode times out, return false */
> -				if (!wait_for_entering_dp_alt_mode(link))
> +				if (!wait_for_entering_dp_alt_mode(link)) {
> +					dc_sink_release(prev_sink);

[Severity: High]
Does this code introduce a NULL pointer dereference?

Earlier in detect_link_and_local_sink(), prev_sink is initialized from
link->local_sink, which can be NULL if no display was previously connected.
The other error paths in this function check if (prev_sink) before calling
dc_sink_release().

If prev_sink is NULL, calling dc_sink_release() will crash because it directly
dereferences the sink pointer:

drivers/gpu/drm/amd/display/dc/core/dc_sink.c:dc_sink_release() {
	kref_put(&sink->refcount, dc_sink_free);
}

>  					return false;
> +				}
>  			}
>  
>  			if (!detect_dp(link, &sink_caps, reason)) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260606091731.21183-1-vulab@iscas.ac.cn?part=1