I am working through the small CVE backports still missing from 6.6.y. This one addresses CVE-2024-46775. It checks four display-helper results before their output is used.

The fix is already present in 6.12.y, 6.18.y, and 7.2.y, but not in 6.6.y. This fix also affects 6.1.y, which will need a separate backport; this submission contains only the 6.6.y patch.
The target-specific adjustment is recorded in the bracketed note above.

Could you please queue it for 6.6.y?

CVE: CVE-2024-46775
Upstream: 673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c

AI assistance: An LLM helped identify, adapt, and validate this backport; I reviewed the resulting code and validation evidence.

Thanks,
Artem Dinaburg

 drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c               | 7 +++++--
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c        | 3 ++-
 .../drm/amd/display/dc/link/protocols/link_dp_training.c   | 4 ++--
 3 files changed, 9 insertions(+), 5 deletions(-)

drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +5 -2

index 30a79dffbd37ab..b3f02f451535a0 100644
@@ -144,7 +144,9 @@ bool dc_dmub_srv_cmd_run_list(struct dc_dmub_srv *dc_dmub_srv, unsigned int coun
 		if (status == DMUB_STATUS_QUEUE_FULL) {
 			/* Execute and wait for queue to become empty again. */
 			dmub_srv_cmd_execute(dmub);
-			dmub_srv_wait_for_idle(dmub, 100000);
+			status = dmub_srv_wait_for_idle(dmub, 100000);
+			if (status != DMUB_STATUS_OK)
+				return false;
 
 			/* Requeue the command. */
 			status = dmub_srv_cmd_queue(dmub, &cmd_list[i]);

@@ -405,7 +407,8 @@ void dc_dmub_srv_get_visual_confirm_color_cmd(struct dc *dc, struct pipe_ctx *pi
 	union dmub_rb_cmd cmd = { 0 };
 	unsigned int panel_inst = 0;
 
-	dc_get_edp_link_panel_inst(dc, pipe_ctx->stream->link, &panel_inst);
+	if (!dc_get_edp_link_panel_inst(dc, pipe_ctx->stream->link, &panel_inst))
+		return;
 
 	memset(&cmd, 0, sizeof(cmd));

drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c +2 -1

index 6eebcb22e31739..2d87e85fdbac59 100644
@@ -595,7 +595,8 @@ static bool hubbub2_program_watermarks(
 		hubbub1->base.ctx->dc->clk_mgr->clks.p_state_change_support == false)
 		safe_to_lower = true;
 
-	hubbub1_program_pstate_watermarks(hubbub, watermarks, refclk_mhz, safe_to_lower);
+	if (hubbub1_program_pstate_watermarks(hubbub, watermarks, refclk_mhz, safe_to_lower))
+		wm_pending = true;
 
 	REG_SET(DCHUBBUB_ARB_SAT_LEVEL, 0,
 			DCHUBBUB_ARB_SAT_LEVEL, 60 * refclk_mhz);

drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c +2 -2

index 08c2f117241407..539f57858dfec2 100644
@@ -1683,8 +1683,8 @@ bool perform_link_training_with_retries(
 		if (status == LINK_TRAINING_ABORT) {
 			enum dc_connection_type type = dc_connection_none;
 
-			link_detect_connection_type(link, &type);
-			if (type == dc_connection_none) {
+			if (link_detect_connection_type(link, &type) &&
+			    type == dc_connection_none) {
 				DC_LOG_HW_LINK_TRAINING("%s: Aborting training because sink unplugged\n", __func__);
 				break;
 			}

Signature · 1 line

2.39.5

[email protected]

AI review

2026-09-29 03:25 UTC #1 lore raw

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] drm/amd/display: early return in dc_dmub_srv_cmd_run_list() drops diagnostics --

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/amd/display: early return in dc_dmub_srv_cmd_run_list() drops diagnostics --

commit a641a7a2bd113ef9410e77f8cb3dd3d38d42ca71
Author: Alex Hung <[email protected]>

drm/amd/display: Validate function returns

This commit adds checks for function return values to fix Coverity issues. It handles errors from dmub_srv_wait_for_idle, dc_get_edp_link_panel_inst, hubbub1_program_pstate_watermarks, and link_detect_connection_type.

Quoted 15 lines

drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +3 -1

index 30a79dffbd37a..b3f02f451535a 100644
@@ -144,7 +144,9 @@ bool dc_dmub_srv_cmd_run_list(struct dc_dmub_srv *dc_dmub_srv, unsigned int coun
 		if (status == DMUB_STATUS_QUEUE_FULL) {
 			/* Execute and wait for queue to become empty again. */
 			dmub_srv_cmd_execute(dmub);
-			dmub_srv_wait_for_idle(dmub, 100000);
+			status = dmub_srv_wait_for_idle(dmub, 100000);
+			if (status != DMUB_STATUS_OK)
+				return false;
 
 			/* Requeue the command. */
 			status = dmub_srv_cmd_queue(dmub, &cmd_list[i]);

Quoted 1 line

}

[Severity: Medium]
Does this new early return inadvertently bypass the diagnostic data collection?

Looking at dc_dmub_srv_cmd_run_list(), right after this block there is an error handler for when the queue or wait fails:

		if (status != DMUB_STATUS_OK) {
			DC_ERROR("Error queueing DMUB command: status=%d\n", status);
			dc_dmub_srv_log_diagnostic_data(dc_dmub_srv);
			return false;
		}

By returning false directly when dmub_srv_wait_for_idle() fails, we skip dc_dmub_srv_log_diagnostic_data() and the DC_ERROR logging. Could we instead let it fall through or break here so that the existing error handler can collect this diagnostic data?

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

Sasha Levin

maintainer Applied

2026-09-29 18:51 UTC #2 lore raw

In reply to Artem Dinaburg

Quoted 2 lines

This one addresses CVE-2024-46775. It checks four display-helper results before their output is used.

Queued for 6.6, thanks.

Signature · 2 lines

Thanks,
Sasha