From: Greg Kroah-Hartman Date: Wed, 5 Aug 2026 12:14:11 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v5.10.263~28 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c2b5ccb728d8864132dc74d67e2184269a441e6d;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: drm-amd-display-increase-hdmi-av-mute-wait-from-2-to-3-frames.patch drm-amd-display-use-proper-context-for-logging.patch drm-amdkfd-fix-missing-authorization-check-in-kfd_ioc_dbg_trap_disable.patch drm-amdkfd-fix-qid-bit-leak-in-pqm_create_queue.patch drm-amdkfd-fix-uint32_t-overflow-in-eop-ring-buffer-size-alignment.patch drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch --- diff --git a/queue-6.18/drm-amd-display-increase-hdmi-av-mute-wait-from-2-to-3-frames.patch b/queue-6.18/drm-amd-display-increase-hdmi-av-mute-wait-from-2-to-3-frames.patch new file mode 100644 index 0000000000..5be7f3e32f --- /dev/null +++ b/queue-6.18/drm-amd-display-increase-hdmi-av-mute-wait-from-2-to-3-frames.patch @@ -0,0 +1,58 @@ +From c216b39fbbc4b007fd6984cffd85039d49a55154 Mon Sep 17 00:00:00 2001 +From: Ray Wu +Date: Fri, 3 Jul 2026 09:14:49 +0800 +Subject: drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames + +From: Ray Wu + +commit c216b39fbbc4b007fd6984cffd85039d49a55154 upstream. + +Some HDMI sinks need additional GCP packets to properly process the +mute state before the timing generator is disabled, especially after +link re-establishment with HDMI 2.0 scrambling enabled. Waiting for +only 2 frames is insufficient for certain monitor firmware, resulting +in garbled display output on resume from suspend. + +Increase the AV mute wait in dcn30_set_avmute() from 2 to 3 frames +to ensure the sink receives enough GCP packets. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5167 +Assisted-by: Cursor:Claude-Opus-4.6 +Reviewed-by: Wayne Lin +Signed-off-by: Ray Wu +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 0c0d5174b09640d8b560764aa5a177630e076e93) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c +@@ -837,13 +837,19 @@ void dcn30_set_avmute(struct pipe_ctx *p + pipe_ctx->stream_res.stream_enc, + enable); + +- /* Wait for two frame to make sure AV mute is sent out */ ++ /* Wait for three frames to make sure AV mute is sent out. ++ * Some HDMI sinks need additional GCP packets to properly ++ * process the mute state, especially after link re-establishment ++ * with HDMI 2.0 scrambling enabled. ++ */ + if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) { ++ int i; ++ + pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); +- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); +- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); +- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); +- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ for (i = 0; i < 3; i++) { ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ } + } + } + } diff --git a/queue-6.18/drm-amd-display-use-proper-context-for-logging.patch b/queue-6.18/drm-amd-display-use-proper-context-for-logging.patch new file mode 100644 index 0000000000..fd4bf21f37 --- /dev/null +++ b/queue-6.18/drm-amd-display-use-proper-context-for-logging.patch @@ -0,0 +1,175 @@ +From 114b42507b6a23d9d24e24e4ef165233332c64d4 Mon Sep 17 00:00:00 2001 +From: "Jiri Slaby (SUSE)" +Date: Thu, 23 Jul 2026 06:25:48 +0200 +Subject: drm/amd/display: use proper context for logging +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiri Slaby (SUSE) + +commit 114b42507b6a23d9d24e24e4ef165233332c64d4 upstream. + +The same as the rest of the code, get_ss_info_from_atombios() uses +calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is +initialized only later in calc_pll_max_vco_construct(). Therefore, any +output using DC_LOG_SYNC() leads to a NULL pointer deference in +get_ss_info_from_atombios(). + +According to Sashiko, the very same problem exists in +dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too. + +To avoid accessing the NULL context, use clk_src->base.ctx->logger +everywhere. That context in base is initialized earlier in +dce110_clk_src_construct() and dce112_clk_src_construct(). Before +get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions +above are actually called. This is done by redefining DC_LOGGER to +CTX->logger. + +Before: +dce110_clk_src_construct() did: + -> sets clk_src->base.ctx = ctx; + -> ss_info_from_atombios_create() + -> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM + -> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx + +After: +dce110_clk_src_construct() does: + -> sets clk_src->base.ctx = ctx; + -> ss_info_from_atombios_create() + -> get_ss_info_from_atombios() <- uses clk_src->base.ctx + +Closes: https://bugzilla.suse.com/show_bug.cgi?id=1271175 +Closes: https://lore.kernel.org/all/a9ee54e6-2413-4156-9bde-d528ae3c63a3@kernel.org/ +Fixes: 1296423bf23c ("drm/amd/display: define DC_LOGGER for logger") +Reviewed-by: Bhawanpreet Lakha +Signed-off-by: Jiri Slaby (SUSE) +Cc: Lakha, Bhawanpreet +Cc: Harry Wentland +Cc: Leo Li +Cc: Rodrigo Siqueira +Cc: Alex Deucher +Cc: "Christian König" +Cc: David Airlie +Cc: Simona Vetter +Cc: amd-gfx@lists.freedesktop.org +Signed-off-by: Alex Deucher +(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 ++++++++---------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c +@@ -45,9 +45,7 @@ + clk_src->base.ctx + + #define DC_LOGGER \ +- calc_pll_cs->ctx->logger +-#define DC_LOGGER_INIT() \ +- struct calc_pll_clock_source *calc_pll_cs = &clk_src->calc_pll ++ CTX->logger + + #undef FN + #define FN(reg_name, field_name) \ +@@ -291,6 +289,7 @@ static bool calc_pll_dividers_in_range( + } + + static uint32_t calculate_pixel_clock_pll_dividers( ++ struct dce110_clk_src *clk_src, + struct calc_pll_clock_source *calc_pll_cs, + struct pll_settings *pll_settings) + { +@@ -479,7 +478,7 @@ static uint32_t dce110_get_pix_clk_divid + { + uint32_t field = 0; + uint32_t pll_calc_error = MAX_PLL_CALC_ERROR; +- DC_LOGGER_INIT(); ++ + /* Check if reference clock is external (not pcie/xtalin) + * HW Dce80 spec: + * 00 - PCIE_REFCLK, 01 - XTALIN, 02 - GENERICA, 03 - GENERICB +@@ -522,12 +521,14 @@ static uint32_t dce110_get_pix_clk_divid + /*Calculate Dividers by HDMI object, no SS case or SS case */ + pll_calc_error = + calculate_pixel_clock_pll_dividers( ++ clk_src, + &clk_src->calc_pll_hdmi, + pll_settings); + else + /*Calculate Dividers by default object, no SS case or SS case */ + pll_calc_error = + calculate_pixel_clock_pll_dividers( ++ clk_src, + &clk_src->calc_pll, + pll_settings); + +@@ -572,7 +573,6 @@ static uint32_t dce110_get_pix_clk_divid + { + struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(cs); + uint32_t pll_calc_error = MAX_PLL_CALC_ERROR; +- DC_LOGGER_INIT(); + + if (pix_clk_params == NULL || pll_settings == NULL + || pix_clk_params->requested_pix_clk_100hz == 0) { +@@ -604,7 +604,6 @@ static uint32_t dce112_get_pix_clk_divid + struct pll_settings *pll_settings) + { + struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(cs); +- DC_LOGGER_INIT(); + + if (pix_clk_params == NULL || pll_settings == NULL + || pix_clk_params->requested_pix_clk_100hz == 0) { +@@ -1370,8 +1369,6 @@ static uint32_t dcn3_get_pix_clk_divider + unsigned long long actual_pix_clk_100Hz = pix_clk_params ? pix_clk_params->requested_pix_clk_100hz : 0; + struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(cs); + +- DC_LOGGER_INIT(); +- + if (pix_clk_params == NULL || pll_settings == NULL + || pix_clk_params->requested_pix_clk_100hz == 0) { + DC_LOG_ERROR( +@@ -1441,7 +1438,6 @@ static const struct clock_source_funcs d + .get_pixel_clk_frequency_100hz = get_pixel_clk_frequency_100hz + }; + +- + static void get_ss_info_from_atombios( + struct dce110_clk_src *clk_src, + enum as_signal_type as_signal, +@@ -1454,7 +1450,7 @@ static void get_ss_info_from_atombios( + struct spread_spectrum_info *ss_info_cur; + struct spread_spectrum_data *ss_data_cur; + uint32_t i; +- DC_LOGGER_INIT(); ++ + if (ss_entries_num == NULL) { + DC_LOG_SYNC( + "Invalid entry !!!\n"); +@@ -1589,6 +1585,7 @@ static void ss_info_from_atombios_create + } + + static bool calc_pll_max_vco_construct( ++ struct dce110_clk_src *clk_src, + struct calc_pll_clock_source *calc_pll_cs, + struct calc_pll_clock_source_init_data *init_data) + { +@@ -1740,6 +1737,7 @@ bool dce110_clk_src_construct( + ss_info_from_atombios_create(clk_src); + + if (!calc_pll_max_vco_construct( ++ clk_src, + &clk_src->calc_pll, + &calc_pll_cs_init_data)) { + ASSERT_CRITICAL(false); +@@ -1754,7 +1752,7 @@ bool dce110_clk_src_construct( + + + if (!calc_pll_max_vco_construct( +- &clk_src->calc_pll_hdmi, &calc_pll_cs_init_data_hdmi)) { ++ clk_src, &clk_src->calc_pll_hdmi, &calc_pll_cs_init_data_hdmi)) { + ASSERT_CRITICAL(false); + goto unexpected_failure; + } diff --git a/queue-6.18/drm-amdkfd-fix-missing-authorization-check-in-kfd_ioc_dbg_trap_disable.patch b/queue-6.18/drm-amdkfd-fix-missing-authorization-check-in-kfd_ioc_dbg_trap_disable.patch new file mode 100644 index 0000000000..8224b8cbc0 --- /dev/null +++ b/queue-6.18/drm-amdkfd-fix-missing-authorization-check-in-kfd_ioc_dbg_trap_disable.patch @@ -0,0 +1,43 @@ +From 99b2fe4f19e3be0a8d0a0b5ea98d855970889653 Mon Sep 17 00:00:00 2001 +From: Gang Ba +Date: Tue, 14 Jul 2026 15:08:57 -0400 +Subject: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE + +From: Gang Ba + +commit 99b2fe4f19e3be0a8d0a0b5ea98d855970889653 upstream. + +Prevent unauthorized termination of active GPU debug sessions. +Previously, users with /dev/kfd access could terminate another process's +debug session without proper ownership or ptrace authorization. + +Signed-off-by: Gang Ba +Reviewed-by: Kent Russell +Signed-off-by: Alex Deucher +(cherry picked from commit 4db4c5ffd5585b72622ecf6ffedf2da258ee23f5) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +@@ -2971,10 +2971,14 @@ static int kfd_ioctl_set_debug_trap(stru + goto out; + } + +- /* Check if target is still PTRACED. */ ++ /* ++ * Verify debugger has permission to debug target process. ++ * For cross-process debugging, require active ptrace relationship. ++ * This applies to ALL operations to prevent unauthorized interference. ++ */ + rcu_read_lock(); +- if (target != p && args->op != KFD_IOC_DBG_TRAP_DISABLE +- && ptrace_parent(target->lead_thread) != current) { ++ if (target != p && ptrace_parent(target->lead_thread) != current ++ && target->debugger_process != p) { + pr_err("PID %i is not PTRACED and cannot be debugged\n", args->pid); + r = -EPERM; + } diff --git a/queue-6.18/drm-amdkfd-fix-qid-bit-leak-in-pqm_create_queue.patch b/queue-6.18/drm-amdkfd-fix-qid-bit-leak-in-pqm_create_queue.patch new file mode 100644 index 0000000000..823a7f09ab --- /dev/null +++ b/queue-6.18/drm-amdkfd-fix-qid-bit-leak-in-pqm_create_queue.patch @@ -0,0 +1,47 @@ +From 38b73293f38658a4685ffcea666462024f858ad9 Mon Sep 17 00:00:00 2001 +From: Vladimir Marioukhine +Date: Mon, 20 Jul 2026 11:53:30 -0400 +Subject: drm/amdkfd: fix QID bit leak in pqm_create_queue() + +From: Vladimir Marioukhine + +commit 38b73293f38658a4685ffcea666462024f858ad9 upstream. + +When MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during +the first queue creation for a process, pqm_create_queue() returns +early via 'return retval' without going through the err_create_queue +cleanup label. + +This means clear_bit(*qid, pqm->queue_slot_bitmap) is never called, +leaving the reserved QID bit permanently set in queue_slot_bitmap. +Over time this leaks QID slots, potentially exhausting all available +queue slots. + +Fix this by replacing 'return retval' with 'goto err_allocate_pqn' +so that clear_bit() is always called on the error path without +touching the uninitialized pqn pointer. + +AILIKFD-813 + +Reported-by: Deucher, Alexander +Signed-off-by: Vladimir Marioukhine +Reviewed-by: Kent Russell +Signed-off-by: Alex Deucher +(cherry picked from commit a107f74c38edbb80d6ab64dcaeeb292c14e9779f) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +@@ -375,7 +375,7 @@ int pqm_create_queue(struct process_queu + false); + if (retval) { + dev_err(dev->adev->dev, "failed to allocate process context bo\n"); +- return retval; ++ goto err_allocate_pqn; + } + memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE); + } diff --git a/queue-6.18/drm-amdkfd-fix-uint32_t-overflow-in-eop-ring-buffer-size-alignment.patch b/queue-6.18/drm-amdkfd-fix-uint32_t-overflow-in-eop-ring-buffer-size-alignment.patch new file mode 100644 index 0000000000..af8f1c8f81 --- /dev/null +++ b/queue-6.18/drm-amdkfd-fix-uint32_t-overflow-in-eop-ring-buffer-size-alignment.patch @@ -0,0 +1,43 @@ +From 83463a96ea3c7d8ae636a4d6a0ba63c9ce410724 Mon Sep 17 00:00:00 2001 +From: William Palacek +Date: Mon, 20 Jul 2026 12:51:34 -0400 +Subject: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment + +From: William Palacek + +commit 83463a96ea3c7d8ae636a4d6a0ba63c9ce410724 upstream. + +eop_ring_buffer_size in struct queue_properties is a u32. In +kfd_queue_acquire_buffers() the expected EOP buffer size is computed as +ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the +addition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to +0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on +size != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD +cp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB +BO, so CP EOP writes can land past the buffer and fault the GPU. + +Cast the operand to u64 so the alignment is computed in 64-bit; the size +check in kfd_queue_buffer_get() then rejects the oversized request. + +Fixes: 42ea9cf2f16b ("drm/amdkfd: Relax size checking during queue buffer get") +Signed-off-by: William Palacek +Reviewed-by: Alysa Liu +Signed-off-by: Alex Deucher +(cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +@@ -285,7 +285,7 @@ int kfd_queue_acquire_buffers(struct kfd + } + err = kfd_queue_buffer_get(vm, (void *)properties->eop_ring_buffer_address, + &properties->eop_buf_bo, +- ALIGN(properties->eop_ring_buffer_size, PAGE_SIZE)); ++ ALIGN((u64)properties->eop_ring_buffer_size, PAGE_SIZE)); + if (err) + goto out_err_unreserve; + } diff --git a/queue-6.18/drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch b/queue-6.18/drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch new file mode 100644 index 0000000000..96f8ea4787 --- /dev/null +++ b/queue-6.18/drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch @@ -0,0 +1,37 @@ +From a9cdc85839e4fe2c760aa4ca6cc341c31ad1918a Mon Sep 17 00:00:00 2001 +From: David Francis +Date: Tue, 21 Jul 2026 09:30:07 -0400 +Subject: drm/amdkfd: Handle invalid event type in CRIU event restore + +From: David Francis + +commit a9cdc85839e4fe2c760aa4ca6cc341c31ad1918a upstream. + +In kfd_criu_restore_event, there was no handling for +the event priv data having an invalid event type. The priv +data here is untrusted and can be invalid. + +In that case, fail with EINVAL. + +Signed-off-by: David Francis +Reviewed-by: Kent Russell +Signed-off-by: Alex Deucher +(cherry picked from commit 2e8e9963cd5c41aa14fd5316bf9ec92e7a0e3097) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_events.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c +@@ -521,6 +521,9 @@ int kfd_criu_restore_event(struct file * + + ret = create_other_event(p, ev, &ev_priv->event_id); + break; ++ default: ++ ret = -EINVAL; ++ break; + } + mutex_unlock(&p->event_mutex); + diff --git a/queue-6.18/drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch b/queue-6.18/drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch new file mode 100644 index 0000000000..1a9c639584 --- /dev/null +++ b/queue-6.18/drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch @@ -0,0 +1,83 @@ +From ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2 Mon Sep 17 00:00:00 2001 +From: William Palacek +Date: Wed, 22 Jul 2026 11:20:56 -0400 +Subject: drm/amdkfd: hold event_mutex while checkpointing CRIU events + +From: William Palacek + +commit ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2 upstream. + +kfd_criu_checkpoint_events() counts the entries in p->event_idr via +kfd_get_num_events(), allocates an array sized to that count, and then +walks the same IDR to fill it. Neither the count nor the walk holds +p->event_mutex. + +The CRIU checkpoint caller holds only p->mutex. Event create and destroy +(kfd_event_create()/kfd_event_destroy()) take p->event_mutex and do not +take p->mutex, so a second thread in the same process can insert or remove +events between the count and the walk. If an event is inserted, the walk +iterates more entries than were counted and writes past the end of the +ev_privs allocation; if an event is removed, the walk dereferences an +entry that is being freed. + +Hold p->event_mutex across the count and the walk so both observe a +consistent view of p->event_idr. The lock is released before +copy_to_user(), which only touches the local buffer. The caller already +holds p->mutex and the create/destroy paths never take p->mutex, so the +p->mutex -> p->event_mutex order is not inverted and no deadlock is +introduced. + +Fixes: 40e8a766a761 ("drm/amdkfd: CRIU checkpoint and restore events") +Signed-off-by: William Palacek +Reviewed-by: Alysa Liu +Signed-off-by: Alex Deucher +(cherry picked from commit ff57e223ab105795b05d3ef3f3c35a5a441bcbaa) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_events.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c +@@ -545,15 +545,27 @@ int kfd_criu_checkpoint_events(struct kf + int ret = 0; + struct kfd_event *ev; + uint32_t ev_id; ++ uint32_t num_events; + +- uint32_t num_events = kfd_get_num_events(p); +- +- if (!num_events) ++ /* Serialize the count and the walk below against concurrent event ++ * create/destroy. Those paths take only p->event_mutex, not the ++ * p->mutex held by the CRIU checkpoint caller, so without this the ++ * event_idr can grow between kfd_get_num_events() and the loop and the ++ * walk writes past the ev_privs allocation. ++ */ ++ mutex_lock(&p->event_mutex); ++ ++ num_events = kfd_get_num_events(p); ++ if (!num_events) { ++ mutex_unlock(&p->event_mutex); + return 0; ++ } + + ev_privs = kvzalloc(num_events * sizeof(*ev_privs), GFP_KERNEL); +- if (!ev_privs) ++ if (!ev_privs) { ++ mutex_unlock(&p->event_mutex); + return -ENOMEM; ++ } + + + idr_for_each_entry(&p->event_idr, ev, ev_id) { +@@ -594,6 +606,8 @@ int kfd_criu_checkpoint_events(struct kf + i++; + } + ++ mutex_unlock(&p->event_mutex); ++ + ret = copy_to_user(user_priv_data + *priv_data_offset, + ev_privs, num_events * sizeof(*ev_privs)); + if (ret) { diff --git a/queue-6.18/series b/queue-6.18/series index 9338cdaba8..83e3e8d459 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -321,3 +321,10 @@ drm-amdgpu-move-debug_vm-handling-to-amdgpu_cs_parser_fini.patch drm-amdgpu-restore-umd-profile-pstate-after-runtime-resume.patch drm-amdgpu-cap-gtt-size-to-physical-ram-on-apus.patch drm-amd-pm-fix-torn-gpu-metrics-reads.patch +drm-amd-display-increase-hdmi-av-mute-wait-from-2-to-3-frames.patch +drm-amd-display-use-proper-context-for-logging.patch +drm-amdkfd-fix-missing-authorization-check-in-kfd_ioc_dbg_trap_disable.patch +drm-amdkfd-fix-qid-bit-leak-in-pqm_create_queue.patch +drm-amdkfd-fix-uint32_t-overflow-in-eop-ring-buffer-size-alignment.patch +drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch +drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch