Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] NULL pointer dereference when accessing `crtc_state` for disconnected MST streams during a partial atomic commit. --
commit 2c1463a6e51d57b066fd631411fc6eb110086a46 Author: Imre Deak <[email protected]> drm/i915/dp_mst: Fix configuring TUs for a disconnected stream This commit fixes the TU configuration for a disconnected MST stream by reusing the maximum link BPP limit from the stream's old state. This ensures the link's sum of TUs stays within limits instead of destroying the link state completely, as userspace may disable them one-by-one in a deferred way. Cc: [email protected] # v6.10+ Link: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16073 Link: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16384 [ ... ] > diff --git a/drivers/gpu/drm/i915/display/intel_link_bw.c > b/drivers/gpu/drm/i915/display/intel_link_bw.c > index b47474a3e9fec..e71e76d6fd3e0 100644 > --- a/drivers/gpu/drm/i915/display/intel_link_bw.c > +++ b/drivers/gpu/drm/i915/display/intel_link_bw.c > @@ -64,7 +64,8 @@ void intel_link_bw_init_limits(struct intel_atomic_state > *state, > intel_atomic_get_new_crtc_state(state, crtc); > int forced_bpp_x16 = get_forced_link_bpp_x16(state, crtc); > > - if (state->base.duplicated && crtc_state) { > + if ((state->base.duplicated && crtc_state) || > + intel_dp_mst_stream_disconnected(state, crtc)) { > limits->max_bpp_x16[pipe] = > crtc_state->max_link_bpp_x16; [Severity: High] Could this lead to a NULL pointer dereference in intel_link_bw_init_limits() if crtc_state is NULL? If userspace issues an atomic commit that modifies a non-routing property on a disconnected connector, the connector is added to the atomic state but its CRTC might not be. In this scenario, intel_atomic_get_new_crtc_state() returns NULL. Since intel_dp_mst_stream_disconnected() evaluates to true when the connector is unregistered, this block is entered even when crtc_state is NULL. This results in an unconditional dereference of crtc_state when assigning crtc_state->max_link_bpp_x16, which is reachable from unprivileged userspace via the DRM atomic ioctl and could crash the system. > if (intel_dsc_enabled_on_link(crtc_state)) > limits->link_dsc_pipes |= BIT(pipe); -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2
