]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
authorSamuel Pitoiset <samuel.pitoiset@gmail.com>
Fri, 7 Aug 2026 14:58:55 +0000 (16:58 +0200)
committerAlex Deucher <alexander.deucher@amd.com>
Wed, 12 Aug 2026 14:21:06 +0000 (10:21 -0400)
commitf2a1c4c6fe0a6fcde02e59dde546dba28d283635
tree09dfe584a7ca2229481f4e636f66f2fe0192d538
parent5e9d136ad74df4edec67e502ce267597064d8f86
drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()

amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream when
vblank is enabled/queried from DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before
a stream is attached to it.

BUG: kernel NULL pointer dereference, address: 0000000000000008
RIP: amdgpu_dm_crtc_set_vblank+0x6b/0x4d0 [amdgpu]
Call Trace:
 drm_vblank_enable
 drm_vblank_get
 drm_crtc_get_sequence_ioctl
 drm_ioctl_kernel
 drm_ioctl

Reproduced by running VKCTS with WSI tests enabled on RADV.

Guard the enable path on acrtc_state->stream being non-NULL, matching
the existing checks in this function.

Fixes: 34d66bc7ff10 ("drm/amd/display: Fix Xorg desktop unresponsive on Replay panel")
Reviewed-by: Melissa Wen <mwen@igalia.com>
Signed-off-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 7b1b31bf6942e6f43509b48da23f8e27269aac39)
Cc: stable@vger.kernel.org
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c