DF-3995 / fix.diff
--- a/sys/dev/drm/amd/display/dc/core/dc_link.c +++ b/sys/dev/drm/amd/display/dc/core/dc_link.c @@ -356,9 +356,10 @@ bool dc_link_is_dp_sink_present(struct dc /* Note: this GpioMode_Input will be converted * to GpioConfigType_I2cAuxDualMode in GPIO component, * which indicates we need additional delay */ if (GPIO_RESULT_OK != dal_ddc_open( ddc, GPIO_MODE_INPUT, GPIO_DDC_CONFIG_TYPE_MODE_I2C)) { - dal_gpio_destroy_ddc(&ddc); + /* 'ddc' is BORROWED from ddc_service (ddc_service->ddc_pin, + * created in dc_link_ddc.c construct() and destroyed by its + * owner in dal_ddc_service_destroy()). Do NOT free it here: + * freeing leaves ddc_service->ddc_pin dangling (use-after-free + * on every later DDC/AUX transaction) and double-frees at + * driver teardown. */ return present; } |