Re: [PATCH v2 07/13] drm/amdgpu: dm: Convert to atomic_create_state

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-after-free and list corruption in `amdgpu_dm_crtc_init()` error path.
--

commit 0347668ca054c8ea5682a0562b13ea3c763f5fc2
Author: Maxime Ripard <mripard@kernel.org>

drm/amdgpu: dm: Convert to atomic_create_state

This commit converts the AMDGPU DM CRTC implementation to use the
atomic_create_state hook rather than a custom reset hook. It initializes
the state with __drm_atomic_helper_crtc_state_init() and handles the
newly created state during CRTC initialization.

[ ... ]
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
> index 62eac6e65334b..cfe1fbfbab8ea 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
> @@ -781,9 +780,18 @@ int amdgpu_dm_crtc_init(struct amdgpu_display_manager *dm,
>  
>  	drm_crtc_helper_add(&acrtc->base, &amdgpu_dm_crtc_helper_funcs);
>  
> -	/* Create (reset) the plane state */
> -	if (acrtc->base.funcs->reset)
> -		acrtc->base.funcs->reset(&acrtc->base);
> +	/* Create the plane state */
> +	if (acrtc->base.funcs->atomic_create_state) {
> +		struct drm_crtc_state *crtc_state;
> +
> +		crtc_state = acrtc->base.funcs->atomic_create_state(&acrtc->base);
> +		if (IS_ERR(crtc_state)) {
> +			res = PTR_ERR(crtc_state);
> +			goto fail;

[Severity: High]
Does this error path leave dangling pointers in the DRM core lists?

This patch introduces a new failure point that jumps to the fail block after
the CRTC and plane have already been successfully initialized and linked via
drm_crtc_init_with_planes() earlier in amdgpu_dm_crtc_init().

Looking at the fail block in amdgpu_dm_crtc_init():

fail:
        kfree(acrtc);
        kfree(cursor_plane);
        return res;

Freeing acrtc and cursor_plane directly without unregistering them via
drm_crtc_cleanup() and drm_plane_cleanup() leaves freed memory linked in the
DRM mode configuration lists. Subsequent traversals of these lists will
dereference the freed memory, which can cause a kernel panic. 

While the plane cleanup omission existed previously, the CRTC list corruption
was newly introduced in this patch.

> +		}
> +
> +		acrtc->base.state = crtc_state;
> +	}
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-drm-no-more-crtc-reset-v2-0-4500d49a337f@kernel.org?part=7