Daniel Wheeler

The issue is related to the handling of plane refcount in the Linux kernel's drm/amd/display module. The mechanism to backup and restore plane states does not maintain the refcount, which can cause problems if the refcount of the plane changes between backup and restore operations. This can lead to memory leaks if the refcount was supposed to go down, or double frees/invalid memory accesses if the refcount was supposed to go up. The fix involves caching and re-applying the current refcount when restoring plane states.

The issue concerns memory corruption caused by array indices being out of bounds. To address this, checks have been added to ensure array indices stay within bounds, specifically in the drm/amd/display component of the Linux kernel.

The issue occurs when a monitor connected after an MST hub is unplugged, resulting in a null pointer dereference. This happens because `dc sink` is released immediately in `early unregister()` or `detect ctx()`, and committing a new state that refers to information stored in `dc sink` causes a null pointer dereference. The problem is resolved by removing a redundant checking condition and resetting `dsc aux` to NULL when the connector is disconnected.

The issue is related to a double free problem in the Linux kernel's amdgpu module. Specifically, the `link destruct()` function in the `drivers/gpu/drm/amd/display/dc/link/link factory.c` file is vulnerable to repeated freeing of previously freed memory. This could potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability occurs when unloading the amdgpu module, and it involves the `dcn10 link encoder destroy()` and `link destroy()` functions.

The issue is related to a bounds check in the Linux kernel's drm/amd/display component, specifically for dcn35 DcfClocks. The problem arises because `NumFclkLevelsEnabled` is used instead of the designated `NumDcfClkLevelsEnabled` for the bounds check, potentially causing an array index out-of-bounds access.

The issue is related to the drm/amd/display component of the Linux kernel, where two problems have been fixed: a comparison with a wider integer type in a loop condition that can cause infinite loops, and a pointer dereference before a null check.

There is a potential memory access violation while iterating through an array of dcn35 clks. This issue can be resolved by limiting iteration per array size.

The issue is related to a NULL dereference of the timing generator in the drm/amd/display component of the Linux kernel. This can be exploited to cause a denial of service. The vulnerability occurs when the assigned timing generator is NULL, and its functions are accessed without proper checks. To prevent this, the kernel now checks whether the assigned timing generator is NULL before accessing its functions.