⬢ DragonFlyBSD Kernel Audit
DF-3995 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/amd/display/dc/core/dc_link.c
+++ b/sys/dev/drm/amd/display/dc/core/dc_link.c
@@ -356,9 +356,10 @@ bool dc_link_is_dp_sink_present(struct dc
 	/* Note: this GpioMode_Input will be converted
 	 * to GpioConfigType_I2cAuxDualMode in GPIO component,
 	 * which indicates we need additional delay */
 
 	if (GPIO_RESULT_OK != dal_ddc_open(
 		ddc, GPIO_MODE_INPUT, GPIO_DDC_CONFIG_TYPE_MODE_I2C)) {
-		dal_gpio_destroy_ddc(&ddc);
+		/* 'ddc' is BORROWED from ddc_service (ddc_service->ddc_pin,
+		 * created in dc_link_ddc.c construct() and destroyed by its
+		 * owner in dal_ddc_service_destroy()).  Do NOT free it here:
+		 * freeing leaves ddc_service->ddc_pin dangling (use-after-free
+		 * on every later DDC/AUX transaction) and double-frees at
+		 * driver teardown. */
 
 		return present;
 	}