[PATCH] drm/display: fix NULL deref in MST time slot release

[Arthur Liberman]

>From 3252a2098213f539a17de92a7b7af11461d0c5c5 Mon Sep 17 00:00:00 2001
Message-ID: 
<3252a2098213f539a17de92a7b7af11461d0c5c5.1790085016.git.arthur_liber...@hotmail.com>
From: Arthur Liberman <arthur_liber...@hotmail.com>
Date: Mon, 21 Sep 2026 16:36:47 +0300
Subject: [PATCH] drm/display: fix NULL deref in MST time slot release

drm_dp_atomic_release_time_slots() is documented as safe to call after
the MST port is gone. After topology teardown or reprobe (unplug,
start/stop TM), port or port->connector can be NULL. Atomic check then
oopses from kwin_wayland:

  RIP: drm_dp_atomic_release_time_slots
  CR2: 0x80

Return 0 if port or port->connector is NULL, and if the old or new
connector state is missing.

Fixes: a5c2c0d164e9 ("drm/display/dp_mst: Add nonblocking helpers for DP MST")
Cc: sta...@vger.kernel.org
Assisted-by: Cursor:xai-grok-4.6
Signed-off-by: Arthur Liberman <arthur_liber...@hotmail.com>
---
 drivers/gpu/drm/display/drm_dp_mst_topology.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c 
b/drivers/gpu/drm/display/drm_dp_mst_topology.c
index 7ce9e212770a..31b30706cda3 100644
--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
@@ -4536,12 +4536,23 @@ int drm_dp_atomic_release_time_slots(struct 
drm_atomic_commit *state,
        struct drm_connector_state *old_conn_state, *new_conn_state;
        bool update_payload = true;
 
+       /*
+        * Port may outlive its DRM connector across MST teardown/reprobe
+        * (unplug, topology restart). The helper is documented as safe to
+        * call in that case.
+        */
+       if (!port || !port->connector)
+               return 0;
+
        old_conn_state = drm_atomic_get_old_connector_state(state, 
port->connector);
-       if (!old_conn_state->crtc)
+       if (!old_conn_state || !old_conn_state->crtc)
                return 0;
 
        /* If the CRTC isn't disabled by this state, don't release it's payload 
*/
        new_conn_state = drm_atomic_get_new_connector_state(state, 
port->connector);
+       if (!new_conn_state)
+               return 0;
+
        if (new_conn_state->crtc) {
                struct drm_crtc_state *crtc_state =
                        drm_atomic_get_new_crtc_state(state, 
new_conn_state->crtc);

base-commit: 8a43738e56d9eb76a573cabab4c9c0e73eab23b2
-- 
2.55.0