[PATCH v2] drm/display: fix MST branch device refcount leak on DPCD write failure

[PATCH v2] drm/display: fix MST branch device refcount leak on DPCD write failure

[WenTao Liang]

drm_dp_add_mst_branch_device initializes mstb with refcount 1, and
drm_dp_mst_topology_get_mstb increments it to 2. When
drm_dp_dpcd_write_byte fails, out_unlock performs only one
drm_dp_mst_topology_put_mstb, leaving the other reference stored in
mgr->mst_primary. Since MST was not successfully enabled, no disable path
will clean it up.

Suggested-by: Greg KH <gregkh@linuxfoundation.org>
Fixes: 7a3cbf590e63 ("drm/mst: Some style improvements in drm_dp_mst_topology_mgr_set_mst()")
Cc: stable@vger.kernel.org
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
Changes in v2:
- Fix patch format based on reviewer feedback
---
 drivers/gpu/drm/display/drm_dp_mst_topology.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
index 8757972e8e24..db9441c80cd5 100644
--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
@@ -3679,8 +3679,10 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms
 					     DP_MST_EN |
 					     DP_UP_REQ_EN |
 					     DP_UPSTREAM_IS_SRC);
-		if (ret < 0)
+		if (ret < 0) {
+			mgr->mst_primary = NULL;
 			goto out_unlock;
+		}
 
 		/* Write reset payload */
 		drm_dp_dpcd_clear_payload(mgr->aux);
-- 
2.39.5 (Apple Git-154)

RE: [PATCH v2] drm/display: fix MST branch device refcount leak on DPCD write failure

[Kandpal, Suraj]

> Subject: [PATCH v2] drm/display: fix MST branch device refcount leak on DPCD
> write failure
> 
> drm_dp_add_mst_branch_device initializes mstb with refcount 1, and
> drm_dp_mst_topology_get_mstb increments it to 2. When
> drm_dp_dpcd_write_byte fails, out_unlock performs only one
> drm_dp_mst_topology_put_mstb, leaving the other reference stored in
> mgr->mst_primary. Since MST was not successfully enabled, no disable
> mgr->path
> will clean it up.
> 
> Suggested-by: Greg KH <gregkh@linuxfoundation.org>
> Fixes: 7a3cbf590e63 ("drm/mst: Some style improvements in
> drm_dp_mst_topology_mgr_set_mst()")
> Cc: stable@vger.kernel.org
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>

LGTM,
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>

> ---
> Changes in v2:
> - Fix patch format based on reviewer feedback
> ---
>  drivers/gpu/drm/display/drm_dp_mst_topology.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c
> b/drivers/gpu/drm/display/drm_dp_mst_topology.c
> index 8757972e8e24..db9441c80cd5 100644
> --- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
> +++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
> @@ -3679,8 +3679,10 @@ int drm_dp_mst_topology_mgr_set_mst(struct
> drm_dp_mst_topology_mgr *mgr, bool ms
>  					     DP_MST_EN |
>  					     DP_UP_REQ_EN |
>  					     DP_UPSTREAM_IS_SRC);
> -		if (ret < 0)
> +		if (ret < 0) {
> +			mgr->mst_primary = NULL;
>  			goto out_unlock;
> +		}
> 
>  		/* Write reset payload */
>  		drm_dp_dpcd_clear_payload(mgr->aux);
> --
> 2.39.5 (Apple Git-154)

Re: [PATCH v2] drm/display: fix MST branch device refcount leak on DPCD write failure

[Greg KH]

On Sun, Jun 28, 2026 at 09:33:44PM +0800, WenTao Liang wrote:
> drm_dp_add_mst_branch_device initializes mstb with refcount 1, and
> drm_dp_mst_topology_get_mstb increments it to 2. When
> drm_dp_dpcd_write_byte fails, out_unlock performs only one
> drm_dp_mst_topology_put_mstb, leaving the other reference stored in
> mgr->mst_primary. Since MST was not successfully enabled, no disable path
> will clean it up.
> 
> Suggested-by: Greg KH <gregkh@linuxfoundation.org>

I did?  Where did I do that?

> Fixes: 7a3cbf590e63 ("drm/mst: Some style improvements in drm_dp_mst_topology_mgr_set_mst()")
> Cc: stable@vger.kernel.org
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>

Again, you need to document the tools you used to find/fix this with
assisted-by, right?  Please read our documentation for when you use
LLMs.

thanks,

greg k-h