From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794326598; b=ycbtOvBmvjRA6BqK+cQ5h42l50wKKrDwOHIzgM9gk1JVnLjYhzEYxS1KcNoi65tSfnN+ bUZAzpeVgk9WRbFD9ffyNpZxaC6UsQbCyF7E5R0H2U7wc0LUs+t3AxrhyRHUqQDCCVzEN OfmOkEOMMZwddyG0IgPT+c4zfNmm6OwJ2Wg7x7mFv9oiF39UqidOUV3DThUT/bW/BpiYO JErwlLFu7uqGXdt6aG6O2JtB10uzgMKowkHdFD7INYRVojI90JVfDvPTLfHvC6+/9Xq8J 0B51zyizXWvizbU52kB2OlP+fPhXBCYPjlI5GsetUiIFREBcLvfaL2DeLM9N60uq30Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794326598; h=Received:DKIM-Signature:From:Date:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding:Message-Id:References:In-Reply-To:To:Cc: X-Mailer:X-Developer-Signature:X-Developer-Key; bh=IK06K6MQBECuIUNklXJJ1e7MILzdFrcFN8KSljlqPhY=; b=V+FmokKJkpSt598L/rsv0irwXJ5kdyobaEag3TSdum+3nMIApnQTq8orM82tYXEwMpvT B8oANyKoHZpuKf08yY5tzYB1NGPm1jEdwGQeIhUC1pwgxfz6I0wI83fU6MnR04CiN+D5P ZlIdEUDQ7PSKhFoeKPv8bJGcXh7CpSRosxD7OPYRbcYG3I2MF5MfAyDdbHb9xVytzoNc9 SlwXeWqXv+av3pFUTLCXCDSoxBURGEaBR4wWrrrIo2PsPbRjcGX/VBnKv6KmwnBQ0O6e6 DXGvjNCvBmnBAjFXgyzo4Eby3PdgSh6QLt1XSAcG/XR1tec9OloJh5S6Z/CJij8u/Ug== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=NGxugDUk; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3EC560A263B for ; Tue, 10 Nov 2026 16:03:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=NGxugDUk Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58BC61F008A2; Tue, 10 Nov 2026 16:03:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794326597; bh=IK06K6MQBECuIUNklXJJ1e7MILzdFrcFN8KSljlqPhY=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=NGxugDUkg4VjFeeky/SgVUxyTWSVKoRWjGLbsnQlCMHHjMsto+tubmwbk/4KyE1EU NRT99j2cMmrVbuxIMXIowq22P+thyoNKFy5qYHJUk5z95MgO1g7GoZsRX4F+fB4+f3 eAVh4MxWaKPjAVsA4W5m6M5Bgh8H4TWIgEPuXxtFTJHwQSKfNg4nNHrpUzzdEdOmIm 4ZiWkdXy+Wxjh/fFy2K/v35nOWiCJ/QwKaUYGyECR0DNe/B4BVPKdf7eJhp4no03Vo 6lv0zyV6io1dZG3xGckXLhyJQK3WyG5clJpsZcRqAW83kRWsJRSYyEM+E0nz65E3DD 6cN+rtUmqCn1A== From: Maxime Ripard Date: Tue, 10 Nov 2026 17:02:53 +0100 Subject: [PATCH v9 06/10] drm/amd/display: Take over the current stream and dc_state X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261110-drm-reset-state-flag-v9-6-ddb0e26324a0@kernel.org> References: <20261110-drm-reset-state-flag-v9-0-ddb0e26324a0@kernel.org> In-Reply-To: <20261110-drm-reset-state-flag-v9-0-ddb0e26324a0@kernel.org> To: Maarten Lankhorst , Thomas Zimmermann , David Airlie , Simona Vetter , Louis Chauvet , Haneen Mohammed , Melissa Wen Cc: Daniel Stone , Harry Wentland , Jocelyn Falempe , =?utf-8?q?Jonas_=C3=85dahl?= , =?utf-8?q?Michel_D=C3=A4nzer?= , Pekka Paalanen , Sebastian Wick , Simon Ser , Victoria Brekenfeld , Xaver Hugl , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Maxime Ripard , Leo Li , Rodrigo Siqueira , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= , amd-gfx@lists.freedesktop.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=4877; i=mripard@kernel.org; h=from:subject:message-id; bh=+2bQgIjtV6naBU0maTRuT8nAW4TJ+nxq4tsm5xK+MVY=; b=owGbwMvMwCmsHn9OcpHtvjLG02pJDFmfHfRWr5qVpNYQkRGQc0TY7bF6sePpT5r6KpONLnVcd I/lPh/QMZWFQZiTQVZMkeWJTNjp5e2LqxzsV/6AmcPKBDKEgYtTACbyZjZjwxsZu1X8GZIR+pt3 bt4wScR52p3mTv679zWm5/4XXmF8sNmsIHxS/+Q1Ta8TL/5S436oz1infrjGuePU8yIms+Pc+lY uLFHtjhIGz/bJzs0T939QHpaioOsr17eHV8iiti73mNC6NwA= X-Developer-Key: i=mripard@kernel.org; a=openpgp; fpr=BE5675C37E818C8B5764241C254BCFC56BF6CE8D drm_atomic_commit_fill_with_defaults() builds its commits out of states created through atomic_create_state() instead of duplicating the current state. A created state comes with no stream nor dc_state, while a duplicated state carries the ones in use, with their reference. The update passes of amdgpu_dm_atomic_check() release the stream and dc_state in use and clear the pointer of the new state, on top of the reference the current state drops when it gets destroyed. Those releases are only balanced if the new state brought a reference of its own, so a commit that disables or reconfigures a live CRTC or plane through a created state over-releases and frees the stream early, leading to a use-after-free when the current state gets destroyed. The paths that keep a CRTC or a plane enabled without a modeset also work on the stream and dc_state through the new state, and hit BUG_ON(dm_new_crtc_state->stream == NULL) since it never had one. Take the stream and dc_state of the current state over, with a reference, at the beginning of amdgpu_dm_atomic_check(), like a duplicated state would have carried them. This has to happen before the update passes clear the stream of the new states: past that point, a state whose stream was cleared can't be told apart from a created one. Signed-off-by: Maxime Ripard --- To: Harry Wentland To: Leo Li To: Rodrigo Siqueira To: Alex Deucher To: Christian König Cc: amd-gfx@lists.freedesktop.org --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 50 +++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 0ea45ab12119..b2eddb87dd5c 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -6279,10 +6279,60 @@ STATIC_IFN_KUNIT int amdgpu_dm_atomic_check(struct drm_device *dev, struct drm_dp_mst_topology_state *mst_state; struct dsc_mst_fairness_vars vars[MAX_PIPES] = {0}; trace_amdgpu_dm_atomic_check_begin(state); + /* + * A CRTC or a plane that stays enabled keeps its stream and + * dc_state: a duplicated state carries them over, with their + * reference, but a state created through atomic_create_state() + * comes with neither. Take them over from the current state, + * with a reference, like a duplicated state would. + * + * The reference is needed when the update passes below + * reconfigure the CRTC or plane: they release the stream and + * dc_state in use and clear the pointer of the new state then, + * on top of the reference the current state drops when it gets + * destroyed, so that release is only balanced if the new state + * brought a reference of its own. The pointer is needed when + * they don't: the paths that keep a CRTC or a plane enabled + * without a modeset work on the stream and dc_state through + * the new state. + * + * A stream or a dc_state in the current state means the CRTC + * or the plane is enabled, since they are cleared when it gets + * disabled, so the conditions below already single out the + * live objects. They deliberately don't check whether this + * commit keeps them enabled on top of that: the update passes + * release the stream and dc_state of the CRTC or plane being + * disabled too, so their new state has to bring the reference + * just the same. + * + * This has to run before the update passes below clear the + * stream of the new states: past that point, a state whose + * stream was cleared can't be told apart from a created one. + */ + for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) { + dm_old_crtc_state = to_dm_crtc_state(old_crtc_state); + dm_new_crtc_state = to_dm_crtc_state(new_crtc_state); + + if (!dm_new_crtc_state->stream && dm_old_crtc_state->stream) { + dm_new_crtc_state->stream = dm_old_crtc_state->stream; + dc_stream_retain(dm_new_crtc_state->stream); + } + } + + for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) { + struct dm_plane_state *dm_old_plane_state = to_dm_plane_state(old_plane_state); + struct dm_plane_state *dm_new_plane_state = to_dm_plane_state(new_plane_state); + + if (!dm_new_plane_state->dc_state && dm_old_plane_state->dc_state) { + dm_new_plane_state->dc_state = dm_old_plane_state->dc_state; + dc_plane_state_retain(dm_new_plane_state->dc_state); + } + } + ret = drm_atomic_helper_check_modeset(dev, state); if (ret) { drm_dbg_atomic(dev, "drm_atomic_helper_check_modeset() failed: %pe\n", ERR_PTR(ret)); goto fail; } -- 2.56.0