drm/msm/dp: fix NULL pointer deref in msm_dp_snapshot() for unmapped MST streams - #1050
Open
YongxingMou wants to merge 4 commits into
Open
drm/msm/dp: fix NULL pointer deref in msm_dp_snapshot() for unmapped MST streams#1050YongxingMou wants to merge 4 commits into
YongxingMou wants to merge 4 commits into
Conversation
…MST" This reverts commit cd58926. This is reverted because a newer version of this patch is being introduced.
YongxingMou
requested review from
a team,
jingyiwang42,
Nicolas Dechesne (ndechesne) and
Trilok Soni (trsoni)
September 7, 2026 10:43
|
Merge Check Failed: No CR Numbers Found Error: No Change Request numbers were found. Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests. |
added 3 commits
September 7, 2026 18:49
…gister blocks" This reverts commit c8a9835. This is reverted because a newer version of this patch is being introduced.
…locks Add support for additional pixel register blocks (p1, p2, p3) to enable 4-stream MST pixel clocks. Introduce the helper functions msm_dp_read_pn and msm_dp_write_pn for pixel register programming. All pixel clocks share the same register layout but use different base addresses. Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com> Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> Link: https://lore.kernel.org/all/20260831-msm-dp-mst-v6-5-c91d35d6fb9e@oss.qualcomm.com/
DisplayPort MST uses multiple stream-specific register spaces. Streams 0 and 1 share the primary link register block with different register offsets, while streams 2 and 3 use dedicated MST link register blocks. Add stream-aware register access helpers that translate stream-specific register offsets and route accesses to the appropriate register space based on the stream id. Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com> Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> Link: https://lore.kernel.org/all/20260831-msm-dp-mst-v6-7-c91d35d6fb9e@oss.qualcomm.com/
YongxingMou
force-pushed
the
for-dp-snap-fix
branch
from
September 7, 2026 10:52
49ba46f to
da47e70
Compare
|
Merge Check Failed: No CR Numbers Found Error: No Change Request numbers were found. Please add Change Request numbers to your pull request description in the format CRs-Fixed: 12345 or link GitHub issues that are associated with Change Requests. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
msm_dp_snapshot() unconditionally dumped pixel_base[0..3]/mst2link_base/
mst3link_base. On single-stream platforms, or when DT doesn't declare
the optional p1/p2/p3 pixel or mst2link/mst3link regions, these stay
NULL, so triggering a snapshot (e.g. DP hang/devcoredump) caused a NULL
pointer dereference.
Fix by explicitly setting pixel_base[i]/mst2link_base/mst3link_base to
NULL when the DT resource is legitimately absent (-EINVAL), and skip
dumping a block in msm_dp_snapshot() when its base is NULL or the
stream's pixel clock isn't enabled (via new msm_dp_ctrl_stream_clks_on()).
CR-Fixed: 4589764