> If a later error (e.g., color management failure) triggers the fail > label, the error path calls dc_stream_release() again on the same > dangling pointer, causing a double release and potential use-after-free.
5.15 carries the same double release of new_stream in dm_update_crtc_state() and has no fix for it, so taking 6.1 and 5.10 alone would make a 5.10 to 5.15 upgrade a regression. Could you send a v2 covering 5.15 as well? -- Thanks, Sasha
