FAILED: patch "[PATCH] drm/amd/display: Fix dc stream excess put in" failed to apply to 5.15-stable tree

The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x c5fd4eaad50d620c7e09ac2082b2fb55ee54170e
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026092930-shrubs-hankering-0ed0@gregkh' --subject-prefix 'PATCH 5.15.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From c5fd4eaad50d620c7e09ac2082b2fb55ee54170e Mon Sep 17 00:00:00 2001
From: Wentao Liang <[email protected]>
Date: Wed, 16 Sep 2026 09:49:56 +0000
Subject: [PATCH] drm/amd/display: Fix dc stream excess put in
dm_update_crtc_state()

In dm_update_crtc_state(), when a modeset is required the newly created stream is stored in dm_new_crtc_state->stream and an extra reference is taken with dc_stream_retain(). The reference returned by create_validate_stream_for_sink() is released as an extra reference at the skip_modeset label, leaving the stream owned by the new CRTC state.

If amdgpu_dm_check_crtc_color_mgmt() fails afterwards, the code jumps to the fail label which releases new_stream again. Since the extra reference was already released at skip_modeset, this drops the reference owned by dm_new_crtc_state->stream and the stream is released while the atomic state still points to it, leading to a premature free of the dc stream.

Set new_stream to NULL after releasing the extra reference at the skip_modeset label so that a later goto fail cannot release the reference owned by the new CRTC state.

index 36d2f86f000a..91fdf3de7202 100644
@@ -5583,8 +5583,10 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
 
 skip_modeset:
 	/* Release extra reference */
-	if (new_stream)
+	if (new_stream) {
 		dc_stream_release(new_stream);
+		new_stream = NULL;
+	}
 	new_stream = NULL;
 
 	/*

From: Uwe Kleine-König <[email protected]>

[ Upstream commit 3335a13535312c9fad4d8d1307a621e6617d6ed8 ]

Commit 075e2099c32c ("drm/amd/display: Fix race condition in DPIA AUX transfer") was backported to stable, which I noticed because of git saying

linux-6.1/.git/rebase-apply/patch:37154: space before tab in indent.

while applying patch-6.1.21. While fixing the code location that issued that warning, improve in few more places.

[5.15 dependency adaptation for c5fd4eaad50d620c7e09ac2082b2fb55ee54170e] Keep only the dc_stream_release() indentation cleanup at skip_modeset. Drop the unrelated comment, FreeSync, audio-label and DPIA AUX changes; 5.15 lacks the newer FreeSync rate and DPIA AUX implementation.

Also clear new_stream after releasing its extra reference. The target's parent already contains this assignment and the target hunk retains it as context; whitespace cleanup alone still leaves a cherry-pick conflict. The assignment is safe on 5.15 and prevents the later color-management error path from releasing the reference owned by the new CRTC state. This deliberately brings that reference cleanup into the dependency so the supplied target applies without changes. No functions are added.

Stable-dep-of: c5fd4eaad50d ("drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()")

---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 9a6c0b17745e5..7d628393415da 100644
@@ -10483,7 +10483,8 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
 skip_modeset:
 	/* Release extra reference */
 	if (new_stream)
-		 dc_stream_release(new_stream);
+		dc_stream_release(new_stream);
+	new_stream = NULL;
 
 	/*
 	 * We want to do dc stream updates that do not require a

2.53.0

From: Wentao Liang <[email protected]>

[ Upstream commit c5fd4eaad50d620c7e09ac2082b2fb55ee54170e ]

In dm_update_crtc_state(), when a modeset is required the newly created stream is stored in dm_new_crtc_state->stream and an extra reference is taken with dc_stream_retain(). The reference returned by create_validate_stream_for_sink() is released as an extra reference at the skip_modeset label, leaving the stream owned by the new CRTC state.

If amdgpu_dm_check_crtc_color_mgmt() fails afterwards, the code jumps to the fail label which releases new_stream again. Since the extra reference was already released at skip_modeset, this drops the reference owned by dm_new_crtc_state->stream and the stream is released while the atomic state still points to it, leading to a premature free of the dc stream.

Set new_stream to NULL after releasing the extra reference at the skip_modeset label so that a later goto fail cannot release the reference owned by the new CRTC state.

---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

index 7d628393415da..6478036a025f0 100644
@@ -10482,8 +10482,10 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
 
 skip_modeset:
 	/* Release extra reference */
-	if (new_stream)
+	if (new_stream) {
 		dc_stream_release(new_stream);
+		new_stream = NULL;
+	}
 	new_stream = NULL;
 
 	/*

2.53.0