Re: [PATCH] drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()

Applied.  Thanks!

On Fri, Aug 7, 2026 at 12:35 PM Melissa Wen <[email protected]> wrote:
>
>
>
> On 07/08/2026 16:58, Samuel Pitoiset wrote:
> > amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream when
> > vblank is enabled/queried from DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before
> > a stream is attached to it.
> >
> > BUG: kernel NULL pointer dereference, address: 0000000000000008
> > RIP: amdgpu_dm_crtc_set_vblank+0x6b/0x4d0 [amdgpu]
> > Call Trace:
> >   drm_vblank_enable
> >   drm_vblank_get
> >   drm_crtc_get_sequence_ioctl
> >   drm_ioctl_kernel
> >   drm_ioctl
> >
> > Reproduced by running VKCTS with WSI tests enabled on RADV.
> >
> > Guard the enable path on acrtc_state->stream being non-NULL, matching
> > the existing checks in this function.
> >
> > Fixes: 34d66bc7ff10 ("drm/amd/display: Fix Xorg desktop unresponsive on Replay panel")
> > Signed-off-by: Samuel Pitoiset <[email protected]>
> > ---
> >   drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
> > index 46d85457c77b..62eac6e65334 100644
> > --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
> > +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
> > @@ -268,7 +268,7 @@ static inline int amdgpu_dm_crtc_set_vblank(struct drm_crtc *crtc, bool enable)
> >
> >       irq_type = amdgpu_display_crtc_idx_to_irq_type(adev, acrtc->crtc_id);
> >
> > -     if (enable) {
> > +     if (enable && acrtc_state->stream) {
>
> LGTM.
>
> Reviewed-by: Melissa Wen <[email protected]>
>
> +AMD display folks for visibility
>
> >               struct dc *dc = adev->dm.dc;
> >               struct drm_vblank_crtc *vblank = drm_crtc_vblank_crtc(crtc);
> >               struct psr_settings *psr = &acrtc_state->stream->link->psr_settings;
>