The skip_modeset path calls dc_stream_release(new_stream) but does not set new_stream to NULL. If a subsequent error (e.g., color management failure) triggers goto fail, the fail label executes a second dc_stream_release on the same pointer, causing a use-after-free or excess put on the stream reference.
Cc: [email protected] Fixes: 3ce51649cdf2 ("drm/amdgpu/display: add quirk handling for stutter mode") Signed-off-by: WenTao Liang <[email protected]> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 5fc5d5608506..acf0b01d6f62 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -11708,6 +11708,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, /* Release extra reference */ if (new_stream) dc_stream_release(new_stream); + new_stream = NULL; /* * We want to do dc stream updates that do not require a -- 2.39.5 (Apple Git-154)
