--- /dev/null
+From c216b39fbbc4b007fd6984cffd85039d49a55154 Mon Sep 17 00:00:00 2001
+From: Ray Wu <ray.wu@amd.com>
+Date: Fri, 3 Jul 2026 09:14:49 +0800
+Subject: drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
+
+From: Ray Wu <ray.wu@amd.com>
+
+commit c216b39fbbc4b007fd6984cffd85039d49a55154 upstream.
+
+Some HDMI sinks need additional GCP packets to properly process the
+mute state before the timing generator is disabled, especially after
+link re-establishment with HDMI 2.0 scrambling enabled. Waiting for
+only 2 frames is insufficient for certain monitor firmware, resulting
+in garbled display output on resume from suspend.
+
+Increase the AV mute wait in dcn30_set_avmute() from 2 to 3 frames
+to ensure the sink receives enough GCP packets.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5167
+Assisted-by: Cursor:Claude-Opus-4.6
+Reviewed-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 0c0d5174b09640d8b560764aa5a177630e076e93)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
+@@ -837,13 +837,19 @@ void dcn30_set_avmute(struct pipe_ctx *p
+ pipe_ctx->stream_res.stream_enc,
+ enable);
+
+- /* Wait for two frame to make sure AV mute is sent out */
++ /* Wait for three frames to make sure AV mute is sent out.
++ * Some HDMI sinks need additional GCP packets to properly
++ * process the mute state, especially after link re-establishment
++ * with HDMI 2.0 scrambling enabled.
++ */
+ if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) {
++ int i;
++
+ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
+- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK);
+- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
+- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK);
+- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
++ for (i = 0; i < 3; i++) {
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK);
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
++ }
+ }
+ }
+ }
--- /dev/null
+From 114b42507b6a23d9d24e24e4ef165233332c64d4 Mon Sep 17 00:00:00 2001
+From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
+Date: Thu, 23 Jul 2026 06:25:48 +0200
+Subject: drm/amd/display: use proper context for logging
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+
+commit 114b42507b6a23d9d24e24e4ef165233332c64d4 upstream.
+
+The same as the rest of the code, get_ss_info_from_atombios() uses
+calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is
+initialized only later in calc_pll_max_vco_construct(). Therefore, any
+output using DC_LOG_SYNC() leads to a NULL pointer deference in
+get_ss_info_from_atombios().
+
+According to Sashiko, the very same problem exists in
+dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.
+
+To avoid accessing the NULL context, use clk_src->base.ctx->logger
+everywhere. That context in base is initialized earlier in
+dce110_clk_src_construct() and dce112_clk_src_construct(). Before
+get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions
+above are actually called. This is done by redefining DC_LOGGER to
+CTX->logger.
+
+Before:
+dce110_clk_src_construct() did:
+ -> sets clk_src->base.ctx = ctx;
+ -> ss_info_from_atombios_create()
+ -> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM
+ -> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx
+
+After:
+dce110_clk_src_construct() does:
+ -> sets clk_src->base.ctx = ctx;
+ -> ss_info_from_atombios_create()
+ -> get_ss_info_from_atombios() <- uses clk_src->base.ctx
+
+Closes: https://bugzilla.suse.com/show_bug.cgi?id=1271175
+Closes: https://lore.kernel.org/all/a9ee54e6-2413-4156-9bde-d528ae3c63a3@kernel.org/
+Fixes: 1296423bf23c ("drm/amd/display: define DC_LOGGER for logger")
+Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
+Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+Cc: Lakha, Bhawanpreet <Bhawanpreet.Lakha@amd.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Leo Li <sunpeng.li@amd.com>
+Cc: Rodrigo Siqueira <siqueira@igalia.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: "Christian König" <christian.koenig@amd.com>
+Cc: David Airlie <airlied@gmail.com>
+Cc: Simona Vetter <simona@ffwll.ch>
+Cc: amd-gfx@lists.freedesktop.org
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 ++++++++----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
+@@ -45,9 +45,7 @@
+ clk_src->base.ctx
+
+ #define DC_LOGGER \
+- calc_pll_cs->ctx->logger
+-#define DC_LOGGER_INIT() \
+- struct calc_pll_clock_source *calc_pll_cs = &clk_src->calc_pll
++ CTX->logger
+
+ #undef FN
+ #define FN(reg_name, field_name) \
+@@ -291,6 +289,7 @@ static bool calc_pll_dividers_in_range(
+ }
+
+ static uint32_t calculate_pixel_clock_pll_dividers(
++ struct dce110_clk_src *clk_src,
+ struct calc_pll_clock_source *calc_pll_cs,
+ struct pll_settings *pll_settings)
+ {
+@@ -479,7 +478,7 @@ static uint32_t dce110_get_pix_clk_divid
+ {
+ uint32_t field = 0;
+ uint32_t pll_calc_error = MAX_PLL_CALC_ERROR;
+- DC_LOGGER_INIT();
++
+ /* Check if reference clock is external (not pcie/xtalin)
+ * HW Dce80 spec:
+ * 00 - PCIE_REFCLK, 01 - XTALIN, 02 - GENERICA, 03 - GENERICB
+@@ -522,12 +521,14 @@ static uint32_t dce110_get_pix_clk_divid
+ /*Calculate Dividers by HDMI object, no SS case or SS case */
+ pll_calc_error =
+ calculate_pixel_clock_pll_dividers(
++ clk_src,
+ &clk_src->calc_pll_hdmi,
+ pll_settings);
+ else
+ /*Calculate Dividers by default object, no SS case or SS case */
+ pll_calc_error =
+ calculate_pixel_clock_pll_dividers(
++ clk_src,
+ &clk_src->calc_pll,
+ pll_settings);
+
+@@ -572,7 +573,6 @@ static uint32_t dce110_get_pix_clk_divid
+ {
+ struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(cs);
+ uint32_t pll_calc_error = MAX_PLL_CALC_ERROR;
+- DC_LOGGER_INIT();
+
+ if (pix_clk_params == NULL || pll_settings == NULL
+ || pix_clk_params->requested_pix_clk_100hz == 0) {
+@@ -604,7 +604,6 @@ static uint32_t dce112_get_pix_clk_divid
+ struct pll_settings *pll_settings)
+ {
+ struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(cs);
+- DC_LOGGER_INIT();
+
+ if (pix_clk_params == NULL || pll_settings == NULL
+ || pix_clk_params->requested_pix_clk_100hz == 0) {
+@@ -1370,8 +1369,6 @@ static uint32_t dcn3_get_pix_clk_divider
+ unsigned long long actual_pix_clk_100Hz = pix_clk_params ? pix_clk_params->requested_pix_clk_100hz : 0;
+ struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(cs);
+
+- DC_LOGGER_INIT();
+-
+ if (pix_clk_params == NULL || pll_settings == NULL
+ || pix_clk_params->requested_pix_clk_100hz == 0) {
+ DC_LOG_ERROR(
+@@ -1441,7 +1438,6 @@ static const struct clock_source_funcs d
+ .get_pixel_clk_frequency_100hz = get_pixel_clk_frequency_100hz
+ };
+
+-
+ static void get_ss_info_from_atombios(
+ struct dce110_clk_src *clk_src,
+ enum as_signal_type as_signal,
+@@ -1454,7 +1450,7 @@ static void get_ss_info_from_atombios(
+ struct spread_spectrum_info *ss_info_cur;
+ struct spread_spectrum_data *ss_data_cur;
+ uint32_t i;
+- DC_LOGGER_INIT();
++
+ if (ss_entries_num == NULL) {
+ DC_LOG_SYNC(
+ "Invalid entry !!!\n");
+@@ -1589,6 +1585,7 @@ static void ss_info_from_atombios_create
+ }
+
+ static bool calc_pll_max_vco_construct(
++ struct dce110_clk_src *clk_src,
+ struct calc_pll_clock_source *calc_pll_cs,
+ struct calc_pll_clock_source_init_data *init_data)
+ {
+@@ -1740,6 +1737,7 @@ bool dce110_clk_src_construct(
+ ss_info_from_atombios_create(clk_src);
+
+ if (!calc_pll_max_vco_construct(
++ clk_src,
+ &clk_src->calc_pll,
+ &calc_pll_cs_init_data)) {
+ ASSERT_CRITICAL(false);
+@@ -1754,7 +1752,7 @@ bool dce110_clk_src_construct(
+
+
+ if (!calc_pll_max_vco_construct(
+- &clk_src->calc_pll_hdmi, &calc_pll_cs_init_data_hdmi)) {
++ clk_src, &clk_src->calc_pll_hdmi, &calc_pll_cs_init_data_hdmi)) {
+ ASSERT_CRITICAL(false);
+ goto unexpected_failure;
+ }
--- /dev/null
+From 99b2fe4f19e3be0a8d0a0b5ea98d855970889653 Mon Sep 17 00:00:00 2001
+From: Gang Ba <Gang.Ba@amd.com>
+Date: Tue, 14 Jul 2026 15:08:57 -0400
+Subject: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
+
+From: Gang Ba <Gang.Ba@amd.com>
+
+commit 99b2fe4f19e3be0a8d0a0b5ea98d855970889653 upstream.
+
+Prevent unauthorized termination of active GPU debug sessions.
+Previously, users with /dev/kfd access could terminate another process's
+debug session without proper ownership or ptrace authorization.
+
+Signed-off-by: Gang Ba <Gang.Ba@amd.com>
+Reviewed-by: Kent Russell <kent.russell@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 4db4c5ffd5585b72622ecf6ffedf2da258ee23f5)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -2971,10 +2971,14 @@ static int kfd_ioctl_set_debug_trap(stru
+ goto out;
+ }
+
+- /* Check if target is still PTRACED. */
++ /*
++ * Verify debugger has permission to debug target process.
++ * For cross-process debugging, require active ptrace relationship.
++ * This applies to ALL operations to prevent unauthorized interference.
++ */
+ rcu_read_lock();
+- if (target != p && args->op != KFD_IOC_DBG_TRAP_DISABLE
+- && ptrace_parent(target->lead_thread) != current) {
++ if (target != p && ptrace_parent(target->lead_thread) != current
++ && target->debugger_process != p) {
+ pr_err("PID %i is not PTRACED and cannot be debugged\n", args->pid);
+ r = -EPERM;
+ }
--- /dev/null
+From 38b73293f38658a4685ffcea666462024f858ad9 Mon Sep 17 00:00:00 2001
+From: Vladimir Marioukhine <Vladimir.Marioukhine@amd.com>
+Date: Mon, 20 Jul 2026 11:53:30 -0400
+Subject: drm/amdkfd: fix QID bit leak in pqm_create_queue()
+
+From: Vladimir Marioukhine <Vladimir.Marioukhine@amd.com>
+
+commit 38b73293f38658a4685ffcea666462024f858ad9 upstream.
+
+When MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during
+the first queue creation for a process, pqm_create_queue() returns
+early via 'return retval' without going through the err_create_queue
+cleanup label.
+
+This means clear_bit(*qid, pqm->queue_slot_bitmap) is never called,
+leaving the reserved QID bit permanently set in queue_slot_bitmap.
+Over time this leaks QID slots, potentially exhausting all available
+queue slots.
+
+Fix this by replacing 'return retval' with 'goto err_allocate_pqn'
+so that clear_bit() is always called on the error path without
+touching the uninitialized pqn pointer.
+
+AILIKFD-813
+
+Reported-by: Deucher, Alexander <alexander.deucher@amd.com>
+Signed-off-by: Vladimir Marioukhine <Vladimir.Marioukhine@amd.com>
+Reviewed-by: Kent Russell <kent.russell@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit a107f74c38edbb80d6ab64dcaeeb292c14e9779f)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+@@ -375,7 +375,7 @@ int pqm_create_queue(struct process_queu
+ false);
+ if (retval) {
+ dev_err(dev->adev->dev, "failed to allocate process context bo\n");
+- return retval;
++ goto err_allocate_pqn;
+ }
+ memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE);
+ }
--- /dev/null
+From 83463a96ea3c7d8ae636a4d6a0ba63c9ce410724 Mon Sep 17 00:00:00 2001
+From: William Palacek <William.Palacek@amd.com>
+Date: Mon, 20 Jul 2026 12:51:34 -0400
+Subject: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
+
+From: William Palacek <William.Palacek@amd.com>
+
+commit 83463a96ea3c7d8ae636a4d6a0ba63c9ce410724 upstream.
+
+eop_ring_buffer_size in struct queue_properties is a u32. In
+kfd_queue_acquire_buffers() the expected EOP buffer size is computed as
+ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the
+addition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to
+0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on
+size != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD
+cp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB
+BO, so CP EOP writes can land past the buffer and fault the GPU.
+
+Cast the operand to u64 so the alignment is computed in 64-bit; the size
+check in kfd_queue_buffer_get() then rejects the oversized request.
+
+Fixes: 42ea9cf2f16b ("drm/amdkfd: Relax size checking during queue buffer get")
+Signed-off-by: William Palacek <William.Palacek@amd.com>
+Reviewed-by: Alysa Liu <Alysa.Liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+@@ -285,7 +285,7 @@ int kfd_queue_acquire_buffers(struct kfd
+ }
+ err = kfd_queue_buffer_get(vm, (void *)properties->eop_ring_buffer_address,
+ &properties->eop_buf_bo,
+- ALIGN(properties->eop_ring_buffer_size, PAGE_SIZE));
++ ALIGN((u64)properties->eop_ring_buffer_size, PAGE_SIZE));
+ if (err)
+ goto out_err_unreserve;
+ }
--- /dev/null
+From a9cdc85839e4fe2c760aa4ca6cc341c31ad1918a Mon Sep 17 00:00:00 2001
+From: David Francis <David.Francis@amd.com>
+Date: Tue, 21 Jul 2026 09:30:07 -0400
+Subject: drm/amdkfd: Handle invalid event type in CRIU event restore
+
+From: David Francis <David.Francis@amd.com>
+
+commit a9cdc85839e4fe2c760aa4ca6cc341c31ad1918a upstream.
+
+In kfd_criu_restore_event, there was no handling for
+the event priv data having an invalid event type. The priv
+data here is untrusted and can be invalid.
+
+In that case, fail with EINVAL.
+
+Signed-off-by: David Francis <David.Francis@amd.com>
+Reviewed-by: Kent Russell <kent.russell@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 2e8e9963cd5c41aa14fd5316bf9ec92e7a0e3097)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_events.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+@@ -521,6 +521,9 @@ int kfd_criu_restore_event(struct file *
+
+ ret = create_other_event(p, ev, &ev_priv->event_id);
+ break;
++ default:
++ ret = -EINVAL;
++ break;
+ }
+ mutex_unlock(&p->event_mutex);
+
--- /dev/null
+From ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2 Mon Sep 17 00:00:00 2001
+From: William Palacek <William.Palacek@amd.com>
+Date: Wed, 22 Jul 2026 11:20:56 -0400
+Subject: drm/amdkfd: hold event_mutex while checkpointing CRIU events
+
+From: William Palacek <William.Palacek@amd.com>
+
+commit ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2 upstream.
+
+kfd_criu_checkpoint_events() counts the entries in p->event_idr via
+kfd_get_num_events(), allocates an array sized to that count, and then
+walks the same IDR to fill it. Neither the count nor the walk holds
+p->event_mutex.
+
+The CRIU checkpoint caller holds only p->mutex. Event create and destroy
+(kfd_event_create()/kfd_event_destroy()) take p->event_mutex and do not
+take p->mutex, so a second thread in the same process can insert or remove
+events between the count and the walk. If an event is inserted, the walk
+iterates more entries than were counted and writes past the end of the
+ev_privs allocation; if an event is removed, the walk dereferences an
+entry that is being freed.
+
+Hold p->event_mutex across the count and the walk so both observe a
+consistent view of p->event_idr. The lock is released before
+copy_to_user(), which only touches the local buffer. The caller already
+holds p->mutex and the create/destroy paths never take p->mutex, so the
+p->mutex -> p->event_mutex order is not inverted and no deadlock is
+introduced.
+
+Fixes: 40e8a766a761 ("drm/amdkfd: CRIU checkpoint and restore events")
+Signed-off-by: William Palacek <William.Palacek@amd.com>
+Reviewed-by: Alysa Liu <Alysa.Liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ff57e223ab105795b05d3ef3f3c35a5a441bcbaa)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_events.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+@@ -545,15 +545,27 @@ int kfd_criu_checkpoint_events(struct kf
+ int ret = 0;
+ struct kfd_event *ev;
+ uint32_t ev_id;
++ uint32_t num_events;
+
+- uint32_t num_events = kfd_get_num_events(p);
+-
+- if (!num_events)
++ /* Serialize the count and the walk below against concurrent event
++ * create/destroy. Those paths take only p->event_mutex, not the
++ * p->mutex held by the CRIU checkpoint caller, so without this the
++ * event_idr can grow between kfd_get_num_events() and the loop and the
++ * walk writes past the ev_privs allocation.
++ */
++ mutex_lock(&p->event_mutex);
++
++ num_events = kfd_get_num_events(p);
++ if (!num_events) {
++ mutex_unlock(&p->event_mutex);
+ return 0;
++ }
+
+ ev_privs = kvzalloc(num_events * sizeof(*ev_privs), GFP_KERNEL);
+- if (!ev_privs)
++ if (!ev_privs) {
++ mutex_unlock(&p->event_mutex);
+ return -ENOMEM;
++ }
+
+
+ idr_for_each_entry(&p->event_idr, ev, ev_id) {
+@@ -594,6 +606,8 @@ int kfd_criu_checkpoint_events(struct kf
+ i++;
+ }
+
++ mutex_unlock(&p->event_mutex);
++
+ ret = copy_to_user(user_priv_data + *priv_data_offset,
+ ev_privs, num_events * sizeof(*ev_privs));
+ if (ret) {
drm-amdgpu-restore-umd-profile-pstate-after-runtime-resume.patch
drm-amdgpu-cap-gtt-size-to-physical-ram-on-apus.patch
drm-amd-pm-fix-torn-gpu-metrics-reads.patch
+drm-amd-display-increase-hdmi-av-mute-wait-from-2-to-3-frames.patch
+drm-amd-display-use-proper-context-for-logging.patch
+drm-amdkfd-fix-missing-authorization-check-in-kfd_ioc_dbg_trap_disable.patch
+drm-amdkfd-fix-qid-bit-leak-in-pqm_create_queue.patch
+drm-amdkfd-fix-uint32_t-overflow-in-eop-ring-buffer-size-alignment.patch
+drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch
+drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
