Re: [PATCH 2/2] drm/i915/dp_mst: Fix configuring TUs for a disconnected stream

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] NULL pointer dereference when accessing `crtc_state` for disconnected MST streams during a partial atomic commit.
--

commit 2c1463a6e51d57b066fd631411fc6eb110086a46
Author: Imre Deak <imre.deak@intel.com>

drm/i915/dp_mst: Fix configuring TUs for a disconnected stream

This commit fixes the TU configuration for a disconnected MST stream by reusing
the maximum link BPP limit from the stream's old state. This ensures the link's
sum of TUs stays within limits instead of destroying the link state completely,
as userspace may disable them one-by-one in a deferred way.

Cc: stable@vger.kernel.org # v6.10+
Link: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16073
Link: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16384

[ ... ]

> diff --git a/drivers/gpu/drm/i915/display/intel_link_bw.c b/drivers/gpu/drm/i915/display/intel_link_bw.c
> index b47474a3e9fec..e71e76d6fd3e0 100644
> --- a/drivers/gpu/drm/i915/display/intel_link_bw.c
> +++ b/drivers/gpu/drm/i915/display/intel_link_bw.c
> @@ -64,7 +64,8 @@ void intel_link_bw_init_limits(struct intel_atomic_state *state,
>  			intel_atomic_get_new_crtc_state(state, crtc);
>  		int forced_bpp_x16 = get_forced_link_bpp_x16(state, crtc);
>  
> -		if (state->base.duplicated && crtc_state) {
> +		if ((state->base.duplicated && crtc_state) ||
> +		    intel_dp_mst_stream_disconnected(state, crtc)) {
>  			limits->max_bpp_x16[pipe] = crtc_state->max_link_bpp_x16;

[Severity: High]
Could this lead to a NULL pointer dereference in intel_link_bw_init_limits()
if crtc_state is NULL?

If userspace issues an atomic commit that modifies a non-routing property
on a disconnected connector, the connector is added to the atomic state
but its CRTC might not be. In this scenario, intel_atomic_get_new_crtc_state()
returns NULL.

Since intel_dp_mst_stream_disconnected() evaluates to true when the connector
is unregistered, this block is entered even when crtc_state is NULL.

This results in an unconditional dereference of crtc_state when assigning
crtc_state->max_link_bpp_x16, which is reachable from unprivileged userspace
via the DRM atomic ioctl and could crash the system.

>  			if (intel_dsc_enabled_on_link(crtc_state))
>  				limits->link_dsc_pipes |= BIT(pipe);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907174413.741851-1-imre.deak@intel.com?part=2