Tim Huang

The issue is related to a double free problem in the Linux kernel's amdgpu module. Specifically, the `link destruct()` function in the `drivers/gpu/drm/amd/display/dc/link/link factory.c` file is vulnerable to repeated freeing of previously freed memory. This could potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability occurs when unloading the amdgpu module, and it involves the `dcn10 link encoder destroy()` and `link destroy()` functions.

A null pointer dereference issue has been resolved in the Linux kernel, specifically in the drm/amd/pm module for vega10 hwmgr. The fix involves checking return values and conducting null pointer handling to avoid null pointer dereferences.

The issue is related to a random hang in S4 for SMU v13.0.4/11. During multiple S4 stress tests, GC/RLC/PMFW get into an invalid state, resulting in hard hangs. Adding a GFX reset as a workaround before sending the MP1 UNLOAD message avoids this failure.

The issue arises when user space sets an invalid ta type, resulting in an empty pointer context. To prevent dereferencing a null pointer, it is necessary to check the pointer context before using it.

The issue is related to an out-of-bounds read warning in the `drm/amdgpu` module of the Linux kernel. Specifically, the function `amdgpu atombios init mc reg table()` in the `drivers/gpu/drm/amd/amdgpu/amdgpu atombios.c` file is affected. This vulnerability may allow an attacker to impact the confidentiality and availability of protected information. The warning is related to the `mc data[i-1]` read, which may be out-of-bounds.