Skip to content

Fix NULL pointer dereferences in DisplayPort DSC capability checks #1040

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
olejaco wants to merge 1 commit into
base: main
Choose a base branch
from
+13 −4
Open

Fix NULL pointer dereferences in DisplayPort DSC capability checks #1040

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 13 additions & 4 deletions src/common/displayport/src/dp_connectorimpl.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1450,9 +1450,10 @@ bool ConnectorImpl::compoundQueryAttachMSTIsDscPossible
{
if (dev && dev->isDSCPossible())
{
if ((dev->devDoingDscDecompression != dev) ||
((dev->devDoingDscDecompression == dev) &&
(dev->isLogical() && dev->parent)))
if (dev->parent &&
((dev->devDoingDscDecompression != dev) ||
((dev->devDoingDscDecompression == dev) &&
(dev->isLogical() && dev->parent))))
Comment on lines +1453 to +1456
Copy link
Collaborator

@Binary-Eater Binary-Eater Feb 25, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you change the code to the following, is the issue averted? If not, can you dump dev->devDoingDscDecompression right before the crash using DP_PRINTF? If using a release build, you will need to set nvidia_modeset.debug=1 to see the log.

Suggested change
if (dev->parent &&
((dev->devDoingDscDecompression != dev) ||
((dev->devDoingDscDecompression == dev) &&
(dev->isLogical() && dev->parent))))
if (((dev->devDoingDscDecompression != NULL &&
dev->devDoingDscDecompression != dev) ||
((dev->devDoingDscDecompression == dev) &&
(dev->isLogical() && dev->parent))))

Copy link
Author

@olejaco olejaco Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, so I have tested your suggestions.

  1. No NULL ptr crash when only one external monitor connected. Regardless of which dp-port.
  2. Check for dev->devDoingDscDecompression != NULL still caused a nullptr crash. The following last entries of the log:

Feb 26 23:23:53 omarchy kernel: pci_bus 0000:3d: busn_res: [bus 3d-6c] is released
Feb 26 23:23:53 omarchy kernel: pci_bus 0000:3b: busn_res: [bus 3b-6c] is released
Feb 26 23:23:53 omarchy kernel: nvidia-modeset: WARNING: DP> AuxChCtl Failing, if a device is connected you shouldn't be seeing this
Feb 26 23:23:53 omarchy kernel: nvidia-modeset: ERROR: DPCONN> Lost device 0
Feb 26 23:23:53 omarchy kernel: nvidia-modeset: WARNING: DPCONN> Zombie? : 1 000000001f025eb9
Feb 26 23:23:53 omarchy kernel: nvidia-modeset: WARNING: DPCONN> Zombie? : 1 00000000a8ddd29a
Feb 26 23:23:53 omarchy kernel: nvidia-modeset: DP-CONN> dev->devDoingDscDecompression: 00000000969a6008 addr=0 peerDevice=1 plugged=0 multistream=1 videoSink=0 audioSink=0 bDSCPossible=1 bFECSupported=1
Feb 26 23:23:53 omarchy kernel: BUG: kernel NULL pointer dereference, address: 0000000000000409
Feb 26 23:23:53 omarchy kernel: #PF: supervisor read access in kernel mode
Feb 26 23:23:53 omarchy kernel: #PF: error_code(0x0000) - not-present page

Full kerneldump:
kerneldump.txt

Copy link
Author

@olejaco olejaco Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code used for the debug-print:

            DP_USED(sb);
            DP_PRINTF(DP_INFO, "DP-CONN> dev->devDoingDscDecompression: %p addr=%s peerDevice=%u plugged=%d multistream=%d videoSink=%d audioSink=%d bDSCPossible=%d bFECSupported=%d",
                      dev->devDoingDscDecompression,
                      dev->devDoingDscDecompression ? dev->devDoingDscDecompression->address.toString(sb) : "NULL",
                      dev->devDoingDscDecompression ? dev->devDoingDscDecompression->peerDevice : 0,
                      dev->devDoingDscDecompression ? dev->devDoingDscDecompression->plugged : 0,
                      dev->devDoingDscDecompression ? dev->devDoingDscDecompression->multistream : 0,
                      dev->devDoingDscDecompression ? dev->devDoingDscDecompression->videoSink : 0,
                      dev->devDoingDscDecompression ? dev->devDoingDscDecompression->audioSink : 0,
                      dev->devDoingDscDecompression ? dev->devDoingDscDecompression->bDSCPossible : 0,
                      dev->devDoingDscDecompression ? dev->devDoingDscDecompression->bFECSupported : 0);

{
//
// If DSC decoding is going to happen at sink's parent or
Expand Down Expand Up @@ -1546,7 +1547,15 @@ bool ConnectorImpl::compoundQueryAttachMSTDsc(Group * target,
dpMemZero(&dscInfo, sizeof(DSC_INFO));
dpMemZero(&warData, sizeof(WAR_DATA));

// Populate DSC related info for PPS calculations
/// Populate DSC related info for PPS calculations
if (!dev->devDoingDscDecompression)
{
//
// Device torn down during query - DSC no longer valid.
// This can happen during hotplug disconnection race conditions.
//
return false;
}
populateDscCaps(&dscInfo, dev->devDoingDscDecompression, pDscParams->forcedParams);

// populate modeset related info for PPS calculations
Expand Down