* [PATCH 5.10/6.1] drm/amd/display: set new_stream to NULL after release
@ 2026-09-14 8:16 Roman Demidov
2026-09-15 2:03 ` Sasha Levin
0 siblings, 1 reply; 2+ messages in thread
From: Roman Demidov @ 2026-09-14 8:16 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman
Cc: Roman Demidov, Harry Wentland, Leo Li, Rodrigo Siqueira,
Alex Deucher, Christian König, Xinhui Pan, David Airlie,
Simona Vetter, Sasha Levin, Wayne Lin, Timur Kristóf,
Fangzhi Zuo, Mario Limonciello, Srinivasan Shanmugam,
Ivan Lipski, Melissa Wen, Alex Hung, Mario Limonciello (AMD),
Thomas Zimmermann, Sunil Khatri, Andrey Grodzovsky,
Bhawanpreet Lakha, amd-gfx, dri-devel, linux-kernel,
WenTao Liang, George Zhang
From: WenTao Liang <vulab@iscas.ac.cn>
commit 9fa26b9eed6195bf840f39ac183b9a6237548755 upstream.
In dm_update_crtc_state(), the skip_modeset path releases new_stream
via dc_stream_release() but does not set the pointer to NULL.
If a later error (e.g., color management failure) triggers the fail
label, the error path calls dc_stream_release() again on the same
dangling pointer, causing a double release and potential use-after-free.
Fix this by setting new_stream to NULL after the initial release.
Fixes: 9b690ef3c704 ("drm/amd/display: Avoid full modeset when not required")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Reviewed-by: George Zhang <george.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Roman Demidov <roman.demidov.nn@gmail.com>
---
Backport fix for CVE-2026-68236
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index bb5e3a6086f2..deaf98957cb7 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -9293,6 +9293,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
/* Release extra reference */
if (new_stream)
dc_stream_release(new_stream);
+ new_stream = NULL;
/*
* We want to do dc stream updates that do not require a
--
2.53.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH 5.10/6.1] drm/amd/display: set new_stream to NULL after release
2026-09-14 8:16 [PATCH 5.10/6.1] drm/amd/display: set new_stream to NULL after release Roman Demidov
@ 2026-09-15 2:03 ` Sasha Levin
0 siblings, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2026-09-15 2:03 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman
Cc: Sasha Levin, Roman Demidov, Harry Wentland, Leo Li,
Rodrigo Siqueira, Alex Deucher, Christian König, Xinhui Pan,
David Airlie, Simona Vetter, Wayne Lin, Timur Kristóf,
Fangzhi Zuo, Mario Limonciello, Srinivasan Shanmugam,
Ivan Lipski, Melissa Wen, Alex Hung, Mario Limonciello (AMD),
Thomas Zimmermann, Sunil Khatri, Andrey Grodzovsky,
Bhawanpreet Lakha, amd-gfx, dri-devel, linux-kernel,
WenTao Liang, George Zhang
> If a later error (e.g., color management failure) triggers the fail
> label, the error path calls dc_stream_release() again on the same
> dangling pointer, causing a double release and potential use-after-free.
5.15 carries the same double release of new_stream in dm_update_crtc_state()
and has no fix for it, so taking 6.1 and 5.10 alone would make a 5.10 to 5.15
upgrade a regression.
Could you send a v2 covering 5.15 as well?
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-15 2:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-14 8:16 [PATCH 5.10/6.1] drm/amd/display: set new_stream to NULL after release Roman Demidov
2026-09-15 2:03 ` Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®