⬢ DragonFlyBSD Kernel Audit
DF-4748 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -385,6 +385,14 @@
 
 	aconnector->port = NULL;
 	if (aconnector->dc_sink) {
+		/*
+		 * An enabled dc_stream_state holds its own reference to this
+		 * dc_sink (dc_stream.c destruct()), so the sink can outlive
+		 * this connector. The dm_helpers dereference sink->priv
+		 * (amdgpu_dm_helpers.c:197/289/317); NULL it out before we
+		 * drop our reference and the connector memory is freed.
+		 */
+		aconnector->dc_sink->priv = NULL;
 		amdgpu_dm_update_freesync_caps(connector, NULL);
 		dc_link_remove_remote_sink(aconnector->dc_link, aconnector->dc_sink);
 		dc_sink_release(aconnector->dc_sink);