Rodrigo Siqueira

The issue is related to a double free problem in the Linux kernel's amdgpu module. Specifically, the `link destruct()` function in the `drivers/gpu/drm/amd/display/dc/link/link factory.c` file is vulnerable to repeated freeing of previously freed memory. This could potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability occurs when unloading the amdgpu module, and it involves the `dcn10 link encoder destroy()` and `link destroy()` functions.

The issue is related to a null pointer dereference in the `dcn20 resource.c` file of the Linux kernel's `drm/amd/display` module. This vulnerability can cause a hang when running MPV on a DCN401 dGPU with specific settings, such as `mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all`, and then enabling fullscreen playback. The call trace shows a kernel NULL pointer dereference at address 0000000000000000.

A NULL pointer dereference vulnerability has been resolved in the Linux kernel, specifically in the drm/amd/display component. The issue occurs when the color log tries to read the gamut remap information from DCN401, which is not initialized in the dcn401 dpp funcs, leading to a null pointer dereference. This vulnerability is addressed by adding a proper guard to access the gamut remap callback in case the specific ASIC did not implement this function. The vulnerability can be triggered by running the command `cat /sys/kernel/debug/dri/0/amdgpu dm dtn log`.

A dynamic memory safety error detector (KASAN) catches and generates error messages "BUG: KASAN: slab-out-of-bounds" as the writeback connector does not support certain features which are not initialized. The issue occurs in the drm/amd/display component when it attempts to write back data. To resolve this, the connector type is checked, and if it is DRM MODE CONNECTOR WRITEBACK, the operation is skipped.