[Why] We directlly clean up proposed_vcpis[] but forget to put malloc_kref of ports which the proposed_vcpis[] are pointing to.

[How] Iterate over proposed_vcpis[] and put malloc_kref of ports which used to have allocated payloads.

Fixes: 8732fe46b20c ("drm/dp_mst: Fix clearing payload state on topology disable") Cc: Sean Paul sean@poorly.run Cc: Wayne Lin Wayne.Lin@amd.com Cc: Ville Syrjälä ville.syrjala@linux.intel.com Cc: stable@vger.kernel.org # v4.4+ Cc: Lyude Paul lyude@redhat.com Cc: Maarten Lankhorst maarten.lankhorst@linux.intel.com Cc: Maxime Ripard mripard@kernel.org Cc: Thomas Zimmermann tzimmermann@suse.de Cc: David Airlie airlied@linux.ie Cc: Daniel Vetter daniel@ffwll.ch Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Wayne Lin Wayne.Lin@amd.com --- drivers/gpu/drm/drm_dp_mst_topology.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index ad0795afc21c..51cd7f74f026 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -3765,12 +3765,26 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms

ret = 0; } else { + int i; + struct drm_dp_vcpi *vcpi; + struct drm_dp_mst_port *port; /* disable MST on the device */ mstb = mgr->mst_primary; mgr->mst_primary = NULL; /* this can fail if the device is gone */ drm_dp_dpcd_writeb(mgr->aux, DP_MSTM_CTRL, 0); ret = 0; + + for (i = 0; i < mgr->max_payloads; i++) { + vcpi = mgr->proposed_vcpis[i]; + if (vcpi) { + port = container_of(vcpi, struct drm_dp_mst_port, + vcpi); + if (port) + drm_dp_mst_put_port_malloc(port); + } + } + memset(mgr->payloads, 0, mgr->max_payloads * sizeof(mgr->payloads[0])); memset(mgr->proposed_vcpis, 0,