From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 9 Oct 2025 13:33:58 +0000 (+0200)
Subject: 5.10-stable patches
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=36875ae18c9355073ddc0b5c6aae29e2d5376505;p=thirdparty%2Fkernel%2Fstable-queue.git

5.10-stable patches

added patches:
	drm-amd-display-fix-potential-null-dereference.patch
	drm-amd-display-remove-redundant-safeguards-for-dmub-srv-destroy.patch
---

diff --git a/queue-5.10/drm-amd-display-fix-potential-null-dereference.patch b/queue-5.10/drm-amd-display-fix-potential-null-dereference.patch
new file mode 100644
index 0000000000..6177b7b7ab
--- /dev/null
+++ b/queue-5.10/drm-amd-display-fix-potential-null-dereference.patch
@@ -0,0 +1,38 @@
+From 52f1783ff4146344342422c1cd94fcb4ce39b6fe Mon Sep 17 00:00:00 2001
+From: Igor Artemiev <Igor.A.Artemiev@mcst.ru>
+Date: Mon, 3 Apr 2023 16:10:37 +0300
+Subject: drm/amd/display: Fix potential null dereference
+
+From: Igor Artemiev <Igor.A.Artemiev@mcst.ru>
+
+commit 52f1783ff4146344342422c1cd94fcb4ce39b6fe upstream.
+
+The adev->dm.dc pointer can be NULL and dereferenced in amdgpu_dm_fini()
+without checking.
+
+Add a NULL pointer check before calling dc_dmub_srv_destroy().
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 9a71c7d31734 ("drm/amd/display: Register DMUB service with DC")
+Signed-off-by: Igor Artemiev <Igor.A.Artemiev@mcst.ru>
+Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Eslam Khafagy <eslam.medhat1993@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1142,7 +1142,8 @@ static void amdgpu_dm_fini(struct amdgpu
+ 		dc_deinit_callbacks(adev->dm.dc);
+ #endif
+ 
+-	dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
++	if (adev->dm.dc)
++		dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
+ 
+ 	if (adev->dm.dmub_bo)
+ 		amdgpu_bo_free_kernel(&adev->dm.dmub_bo,
diff --git a/queue-5.10/drm-amd-display-remove-redundant-safeguards-for-dmub-srv-destroy.patch b/queue-5.10/drm-amd-display-remove-redundant-safeguards-for-dmub-srv-destroy.patch
new file mode 100644
index 0000000000..5ed63ad4c8
--- /dev/null
+++ b/queue-5.10/drm-amd-display-remove-redundant-safeguards-for-dmub-srv-destroy.patch
@@ -0,0 +1,43 @@
+From 3beac533b8daa18358dabbe5059c417d192b2a93 Mon Sep 17 00:00:00 2001
+From: Roman Li <roman.li@amd.com>
+Date: Mon, 10 May 2021 11:29:29 -0400
+Subject: drm/amd/display: Remove redundant safeguards for dmub-srv destroy()
+
+From: Roman Li <roman.li@amd.com>
+
+commit 3beac533b8daa18358dabbe5059c417d192b2a93 upstream.
+
+[Why]
+dc_dmub_srv_destroy() has internal null-check and null assignment.
+No need to duplicate them externally.
+
+[How]
+Remove redundant safeguards.
+
+Signed-off-by: Lang Yu <Lang.Yu@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Eslam Khafagy <eslam.medhat1993@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |    6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1141,10 +1141,8 @@ static void amdgpu_dm_fini(struct amdgpu
+ 	if (adev->dm.dc)
+ 		dc_deinit_callbacks(adev->dm.dc);
+ #endif
+-	if (adev->dm.dc->ctx->dmub_srv) {
+-		dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
+-		adev->dm.dc->ctx->dmub_srv = NULL;
+-	}
++
++	dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
+ 
+ 	if (adev->dm.dmub_bo)
+ 		amdgpu_bo_free_kernel(&adev->dm.dmub_bo,
diff --git a/queue-5.10/series b/queue-5.10/series
index a0b9d67481..78783cb2c8 100644
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -14,3 +14,5 @@ serial-stm32-allow-selecting-console-when-the-driver-is-module.patch
 staging-axis-fifo-fix-maximum-tx-packet-length-check.patch
 staging-axis-fifo-flush-rx-fifo-on-read-errors.patch
 driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch
+drm-amd-display-remove-redundant-safeguards-for-dmub-srv-destroy.patch
+drm-amd-display-fix-potential-null-dereference.patch