[PATCH v2] drm/amd/display: set new_stream to NULL after release

[PATCH v2] drm/amd/display: set new_stream to NULL after release

[WenTao Liang]

In dm_update_crtc_state(), the skip_modeset path releases new_stream
via dc_stream_release() but does not set the pointer to NULL.

If a later error (e.g., color management failure) triggers the fail
label, the error path calls dc_stream_release() again on the same
dangling pointer, causing a double release and potential use-after-free.

Fix this by setting new_stream to NULL after the initial release.

Fixes: 9b690ef3c7042 ("drm/amd/display: Avoid full modeset when not required")
Cc: stable@vger.kernel.org
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
Changes in v2:
- Correct Fixes hash based on reviewer feedback
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 5fc5d5608506..acf0b01d6f62 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -11708,6 +11708,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
 	/* Release extra reference */
 	if (new_stream)
 		dc_stream_release(new_stream);
+	new_stream = NULL;
 
 	/*
 	 * We want to do dc stream updates that do not require a
-- 
2.39.5 (Apple Git-154)

Re: [PATCH v2] drm/amd/display: set new_stream to NULL after release

[Greg KH]

On Sun, Jun 28, 2026 at 03:27:40PM +0800, WenTao Liang wrote:
> In dm_update_crtc_state(), the skip_modeset path releases new_stream
> via dc_stream_release() but does not set the pointer to NULL.
> 
> If a later error (e.g., color management failure) triggers the fail
> label, the error path calls dc_stream_release() again on the same
> dangling pointer, causing a double release and potential use-after-free.
> 
> Fix this by setting new_stream to NULL after the initial release.
> 
> Fixes: 9b690ef3c7042 ("drm/amd/display: Avoid full modeset when not required")
> Cc: stable@vger.kernel.org
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
> Changes in v2:
> - Correct Fixes hash based on reviewer feedback

Did you forget to include an Assisted-by: tag?

Re: [PATCH v2] drm/amd/display: set new_stream to NULL after release

[WenTao Liang]

[-- Attachment #1: Type: text/plain, Size: 282 bytes --]



> 2026年6月28日 15:33，Greg KH <gregkh@linuxfoundation.org> 写道：
> 
> Did you forget to include an Assisted-by: tag?

You're right, the Fixes hash correction in v2 was suggested by the reviewer in v1. I'll add a Suggested-by tag in v3. Thanks for pointing this out!

[-- Attachment #2: Type: text/html, Size: 1007 bytes --]

Re: [PATCH v2] drm/amd/display: set new_stream to NULL after release

[Mario Limonciello]

On 6/28/26 02:49, WenTao Liang wrote:
> 
> 
>> 2026年6月28日 15:33，Greg KH <gregkh@linuxfoundation.org> 写道：
>>
>> Did you forget to include an Assisted-by: tag?
> 
> You're right, the Fixes hash correction in v2 was suggested by the 
> reviewer in v1. I'll add a Suggested-by tag in v3. Thanks for pointing 
> this out!

I believe Greg is hypothesizing that this mistaken tag was caused by a 
tool/model and you didn't mention the tool that you used.

https://docs.kernel.org/process/coding-assistants.html#attribution