Hamza Mahfooz

The issue is related to the handling of plane refcount in the Linux kernel's drm/amd/display module. The mechanism to backup and restore plane states does not maintain the refcount, which can cause problems if the refcount of the plane changes between backup and restore operations. This can lead to memory leaks if the refcount was supposed to go down, or double frees/invalid memory accesses if the refcount was supposed to go up. The fix involves caching and re-applying the current refcount when restoring plane states.

The issue is related to the `dc state copy internal` function in the Linux kernel's `drm/amd/display` module. It concerns a double free vulnerability that occurs when a `dml` allocation fails, causing subsequent calls to `dc state copy internal` to shallow copy invalid memory. If the new state is released, a double free would occur, potentially allowing an attacker to impact the confidentiality, integrity, and availability of protected information.

A NULL pointer dereference vulnerability has been resolved in the Linux kernel, specifically in the drm/amd/display component. The issue occurs when the color log tries to read the gamut remap information from DCN401, which is not initialized in the dcn401 dpp funcs, leading to a null pointer dereference. This vulnerability is addressed by adding a proper guard to access the gamut remap callback in case the specific ASIC did not implement this function. The vulnerability can be triggered by running the command `cat /sys/kernel/debug/dri/0/amdgpu dm dtn log`.