From: Alex Hung <[email protected]> [WHAT] dc_stream_add_writeback() copies wb_info by value, so free it on all paths via a single cleanup label. Also bail out early when no pipe_ctx matches the stream to avoid a NULL pointer dereference.
Assisted-by: Copilot:Claude-Opus-4.8 Reviewed-by: Harry Wentland <[email protected]> Signed-off-by: Alex Hung <[email protected]> Signed-off-by: Roman Li <[email protected]> --- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 0dcf829c1d07..52c1ffad985b 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -4647,21 +4647,19 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm, wb_info = kzalloc_obj(*wb_info); if (!wb_info) { drm_err(adev_to_drm(adev), "Failed to allocate wb_info\n"); - return; + goto cleanup; } acrtc = to_amdgpu_crtc(wb_conn->encoder.crtc); if (!acrtc) { drm_err(adev_to_drm(adev), "no amdgpu_crtc found\n"); - kfree(wb_info); - return; + goto cleanup; } afb = to_amdgpu_framebuffer(new_con_state->writeback_job->fb); if (!afb) { drm_err(adev_to_drm(adev), "No amdgpu_framebuffer found\n"); - kfree(wb_info); - return; + goto cleanup; } for (i = 0; i < MAX_PIPES; i++) { @@ -4671,6 +4669,11 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm, } } + if (!pipe) { + drm_err(adev_to_drm(adev), "No pipe found for stream\n"); + goto cleanup; + } + /* fill in wb_info */ wb_info->wb_enabled = true; @@ -4744,6 +4747,9 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm, WARN_ON(drm_crtc_vblank_get(&acrtc->base)); acrtc->wb_frame_done = false; acrtc->wb_pending = true; + +cleanup: + kfree(wb_info); } static void amdgpu_dm_update_hdcp(struct drm_atomic_commit *state) -- 2.34.1
