DF-3980 — dcn10: opp NULL check placed after its dereference in hwss1_plane_atomic_disconnect (latent)

File: sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:889,897 Severity: Info (latent — currently unreachable; upstream-identical) Hardware: DCN10 — absent from the audit guest; source-level certainty.

hwss1_plane_atomic_disconnect() reads pipe_ctx->stream_res.opp into a local at :887, dereferences it at :889 (&(opp->mpc_tree_params), then get_mpcc_for_dpp/remove_mpcc on that pointer), and only afterwards tests if (opp != NULL) at :897 before touching it again. The check is dead code: it can never protect the earlier dereferences.

Unreachable today: the two callers both guarantee a non-NULL OPP — dcn10_init_hw sets pipe_ctx->stream_res.opp = dc->res_pool->opps[i] (:1076) immediately before invoking the hook (:1078), and dcn10_apply_ctx_for_surface calls it only for old pipes that had a plane attached (:2387-2391), which by resource mapping have stream_res.opp assigned. Upstream Linux v5.4 carries byte-identical code, so a future caller that relaxes the invariant trips the NULL deref.

Fix: hoist the check to the top of the function (if (opp == NULL) return;) — matching the style of dcn10_wait_for_mpcc_disconnect's if (!pipe_ctx->stream_res.opp) return; (:2579-2580).

Files

• df3980_opp_order.c — documentation stub
• VERDICT.md, manifest.json, verdict.json

DF-3980 — VERDICT

Status: inconclusive (hardware-gated — no DCN10 GPU on the audit guest; additionally the defect is unreachable by construction today), source certainty only.

Root cause: hwss1_plane_atomic_disconnect() at sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:889 dereferences opp (&(opp->mpc_tree_params) and subsequent get_mpcc_for_dpp / remove_mpcc through that pointer) before the NULL guard at :897 (if (opp != NULL)), which is therefore dead. If any future caller invokes the hook with pipe_ctx->stream_res.opp == NULL, the kernel NULL-derefs at :889.

Current callers (both safe): 1. dcn10_init_hw :1078 — assigns pipe_ctx->stream_res.opp at :1076 first. 2. dcn10_apply_ctx_for_surface :2391 — only for old pipes with old_pipe_ctx->plane_state set (:2387), which have OPP resources mapped.

Upstream parity: Linux v5.4 hwss1_plane_atomic_disconnect is byte-identical in this respect (deref at its :986, dead check at :994) — a carried-in latent defect, not a port regression.

Fix: hoist if (opp == NULL) return; to the top of the function (same pattern as dcn10_wait_for_mpcc_disconnect :2579-2580 in this file).

Classification rationale: Info — latent NULL-deref, no reachable trigger today, no memory corruption; filed as hardening with the exact one-line fix.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)