On Sun, Jun 28, 2026 at 03:27:40PM +0800, WenTao Liang wrote:
> In dm_update_crtc_state(), the skip_modeset path releases new_stream
> via dc_stream_release() but does not set the pointer to NULL.
>
> If a later error (e.g., color management failure) triggers the fail
> label, the error path calls dc_stream_release() again on the same
> dangling pointer, causing a double release and potential use-after-free.
>
> Fix this by setting new_stream to NULL after the initial release.
>
> Fixes: 9b690ef3c7042 ("drm/amd/display: Avoid full modeset when not required")
> Cc: [email protected]
> Signed-off-by: WenTao Liang <[email protected]>
> ---
> Changes in v2:
> - Correct Fixes hash based on reviewer feedback
Did you forget to include an Assisted-by: tag?
