Re: [PATCH] drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()

On 07/08/2026 16:58, Samuel Pitoiset wrote:
> amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream when
> vblank is enabled/queried from DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before
> a stream is attached to it.
>
> BUG: kernel NULL pointer dereference, address: 0000000000000008
> RIP: amdgpu_dm_crtc_set_vblank+0x6b/0x4d0 [amdgpu]
> Call Trace:
>   drm_vblank_enable
>   drm_vblank_get
>   drm_crtc_get_sequence_ioctl
>   drm_ioctl_kernel
>   drm_ioctl
>
> Reproduced by running VKCTS with WSI tests enabled on RADV.
>
> Guard the enable path on acrtc_state->stream being non-NULL, matching
> the existing checks in this function.
>
> Fixes: 34d66bc7ff10 ("drm/amd/display: Fix Xorg desktop unresponsive on Replay panel")
> Signed-off-by: Samuel Pitoiset <[email protected]>
> ---
>   drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
> index 46d85457c77b..62eac6e65334 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
> @@ -268,7 +268,7 @@ static inline int amdgpu_dm_crtc_set_vblank(struct drm_crtc *crtc, bool enable)
>   
>   	irq_type = amdgpu_display_crtc_idx_to_irq_type(adev, acrtc->crtc_id);
>   
> -	if (enable) {
> +	if (enable && acrtc_state->stream) {

LGTM.

Reviewed-by: Melissa Wen <[email protected]>

+AMD display folks for visibility

>   		struct dc *dc = adev->dm.dc;
>   		struct drm_vblank_crtc *vblank = drm_crtc_vblank_crtc(crtc);
>   		struct psr_settings *psr = &acrtc_state->stream->link->psr_settings;