--- /dev/null
+From 11020c11e30d6f8962bc3050662630a42904365b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jun 2026 14:38:10 +0200
+Subject: drm/vc4: fix krealloc() memory leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander A. Klimov <grandmaster@al2klimov.de>
+
+[ Upstream commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b ]
+
+Don't just overwrite the original pointer passed to krealloc()
+with its return value without checking latter:
+
+ MEM = krealloc(MEM, SZ, GFP);
+
+If krealloc() returns NULL, that erases the pointer
+to the still allocated memory, hence leaks this memory.
+Instead, use a temporary variable, check it's not NULL
+and only then assign it to the original pointer:
+
+ TMP = krealloc(MEM, SZ, GFP);
+ if (!TMP) return;
+ MEM = TMP;
+
+While on it, use krealloc_array().
+
+Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
+Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+index 7cf82b071de290..82543a23ec0638 100644
+--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+@@ -288,15 +288,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
+ {
+ uint32_t o = validated_shader->num_uniform_addr_offsets;
+ uint32_t num_uniforms = validated_shader->uniforms_size / 4;
++ u32 *offsets;
+
+- validated_shader->uniform_addr_offsets =
+- krealloc(validated_shader->uniform_addr_offsets,
+- (o + 1) *
+- sizeof(*validated_shader->uniform_addr_offsets),
+- GFP_KERNEL);
+- if (!validated_shader->uniform_addr_offsets)
++ offsets = krealloc_array(validated_shader->uniform_addr_offsets,
++ o + 1,
++ sizeof(*validated_shader->uniform_addr_offsets),
++ GFP_KERNEL);
++ if (!offsets)
+ return false;
+
++ validated_shader->uniform_addr_offsets = offsets;
+ validated_shader->uniform_addr_offsets[o] = num_uniforms;
+ validated_shader->num_uniform_addr_offsets++;
+
+--
+2.53.0
+
net-mvpp2-add-metadata-support-for-xdp-mode.patch
net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch
net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
+drm-vc4-fix-krealloc-memory-leak.patch
--- /dev/null
+From a9e1aa25b8336098b4b2e7158c7987cd811bc227 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jun 2026 14:38:10 +0200
+Subject: drm/vc4: fix krealloc() memory leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander A. Klimov <grandmaster@al2klimov.de>
+
+[ Upstream commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b ]
+
+Don't just overwrite the original pointer passed to krealloc()
+with its return value without checking latter:
+
+ MEM = krealloc(MEM, SZ, GFP);
+
+If krealloc() returns NULL, that erases the pointer
+to the still allocated memory, hence leaks this memory.
+Instead, use a temporary variable, check it's not NULL
+and only then assign it to the original pointer:
+
+ TMP = krealloc(MEM, SZ, GFP);
+ if (!TMP) return;
+ MEM = TMP;
+
+While on it, use krealloc_array().
+
+Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
+Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+index 9745f8810eca6d..c2c6767ae55862 100644
+--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+@@ -288,15 +288,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
+ {
+ uint32_t o = validated_shader->num_uniform_addr_offsets;
+ uint32_t num_uniforms = validated_shader->uniforms_size / 4;
++ u32 *offsets;
+
+- validated_shader->uniform_addr_offsets =
+- krealloc(validated_shader->uniform_addr_offsets,
+- (o + 1) *
+- sizeof(*validated_shader->uniform_addr_offsets),
+- GFP_KERNEL);
+- if (!validated_shader->uniform_addr_offsets)
++ offsets = krealloc_array(validated_shader->uniform_addr_offsets,
++ o + 1,
++ sizeof(*validated_shader->uniform_addr_offsets),
++ GFP_KERNEL);
++ if (!offsets)
+ return false;
+
++ validated_shader->uniform_addr_offsets = offsets;
+ validated_shader->uniform_addr_offsets[o] = num_uniforms;
+ validated_shader->num_uniform_addr_offsets++;
+
+--
+2.53.0
+
net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch
net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
netfilter-ctnetlink-ensure-safe-access-to-master-con.patch
+drm-vc4-fix-krealloc-memory-leak.patch
--- /dev/null
+From 4bd22aac8c593d4561b5c0b2ba6b2bc04fdf6805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2026 23:01:51 +0800
+Subject: clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration
+ time
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pengyu Luo <mitltlatltl@gmail.com>
+
+[ Upstream commit 5285b046757844435d1db96c1b5c3a6621b2979a ]
+
+Parking disp{0,1}_cc_mdss_mdp_clk_src clk broke simplefb on HUAWEI
+Gaokun3, the image will stuck at grey for seconds until msm takes
+over framebuffer. Use clk_rcg2_shared_no_init_park_ops to skip it.
+
+Signed-off-by: Pengyu Luo <mitltlatltl@gmail.com>
+Tested-by: Jérôme de Bretagne <jerome.debretagne@gmail.com>
+Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration")
+Link: https://lore.kernel.org/r/20260303150152.90685-1-mitltlatltl@gmail.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-sc8280xp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/dispcc-sc8280xp.c b/drivers/clk/qcom/dispcc-sc8280xp.c
+index c23cbb983d29ea..43d26616bd27bd 100644
+--- a/drivers/clk/qcom/dispcc-sc8280xp.c
++++ b/drivers/clk/qcom/dispcc-sc8280xp.c
+@@ -978,7 +978,7 @@ static struct clk_rcg2 disp0_cc_mdss_mdp_clk_src = {
+ .name = "disp0_cc_mdss_mdp_clk_src",
+ .parent_data = disp0_cc_parent_data_5,
+ .num_parents = ARRAY_SIZE(disp0_cc_parent_data_5),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_shared_no_init_park_ops,
+ },
+ };
+
+@@ -992,7 +992,7 @@ static struct clk_rcg2 disp1_cc_mdss_mdp_clk_src = {
+ .name = "disp1_cc_mdss_mdp_clk_src",
+ .parent_data = disp1_cc_parent_data_5,
+ .num_parents = ARRAY_SIZE(disp1_cc_parent_data_5),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_shared_no_init_park_ops,
+ },
+ };
+
+--
+2.53.0
+
--- /dev/null
+From bbbdecb73e02a14e6587b55e2864c20a18a97585 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Apr 2026 14:33:51 +0200
+Subject: clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from
+ getting parked
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+[ Upstream commit bc27dbefae6ed11376d991a2921eff806ffef67c ]
+
+Parking disp_cc_mdss_mdp_clk_src at 19.2MHz causing the EFI GOP framebuffer
+to stop functioning. The EFI GOP framebuffer should keep working until
+the msm display driver loads, to help with boot debugging and to ensure
+display output when the msm module is not in the initramfs.
+
+Switch disp_cc_mdss_mdp_clk_src over to clk_rcg2_shared_no_init_park_ops
+to keep the EFI GOP working after binding the x1e80100-dispcc driver.
+
+Suggested-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration")
+Link: https://lore.kernel.org/r/20260425123351.6292-1-johannes.goede@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-x1e80100.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/dispcc-x1e80100.c b/drivers/clk/qcom/dispcc-x1e80100.c
+index 40069eba41f241..5c00a0f8448931 100644
+--- a/drivers/clk/qcom/dispcc-x1e80100.c
++++ b/drivers/clk/qcom/dispcc-x1e80100.c
+@@ -580,7 +580,7 @@ static struct clk_rcg2 disp_cc_mdss_mdp_clk_src = {
+ .parent_data = disp_cc_parent_data_6,
+ .num_parents = ARRAY_SIZE(disp_cc_parent_data_6),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_shared_no_init_park_ops,
+ },
+ };
+
+--
+2.53.0
+
--- /dev/null
+From 3b54953048de83057c7dc690eff912a49cf76955 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 May 2026 17:14:57 +0000
+Subject: clk: samsung: gs101: Fix missing USI7_USI DIV clock in
+ peric0_clk_regs
+
+From: Kuan-Wei Chiu <visitorckw@gmail.com>
+
+[ Upstream commit 78ee734b36284d82454e87a92094fdb926985b47 ]
+
+In the peric0_clk_regs array, the divider register offset for USI6 was
+accidentally listed twice, while the divider for USI7 was omitted.
+
+Missing this DIV register causes the USI7 clock divider setting to be
+lost and reset to its hardware default value during a suspend/resume
+cycle.
+
+Replace the duplicated USI6 DIV entry with the correct USI7 DIV
+register.
+
+Fixes: 893f133a040b ("clk: samsung: gs101: add support for cmu_peric0")
+Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
+Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Link: https://patch.msgid.link/20260505171457.1960837-1-visitorckw@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-gs101.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/samsung/clk-gs101.c b/drivers/clk/samsung/clk-gs101.c
+index fa628fab28ac4e..7cc6a1173d44fb 100644
+--- a/drivers/clk/samsung/clk-gs101.c
++++ b/drivers/clk/samsung/clk-gs101.c
+@@ -3602,7 +3602,7 @@ static const unsigned long peric0_clk_regs[] __initconst = {
+ CLK_CON_DIV_DIV_CLK_PERIC0_USI4_USI,
+ CLK_CON_DIV_DIV_CLK_PERIC0_USI5_USI,
+ CLK_CON_DIV_DIV_CLK_PERIC0_USI6_USI,
+- CLK_CON_DIV_DIV_CLK_PERIC0_USI6_USI,
++ CLK_CON_DIV_DIV_CLK_PERIC0_USI7_USI,
+ CLK_CON_DIV_DIV_CLK_PERIC0_USI8_USI,
+ CLK_CON_BUF_CLKBUF_PERIC0_IP,
+ CLK_CON_GAT_CLK_BLK_PERIC0_UID_PERIC0_CMU_PERIC0_IPCLKPORT_PCLK,
+--
+2.53.0
+
--- /dev/null
+From 11f87838f0276479725b5bb3abb4ecb7dd6c2d5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jun 2026 14:38:10 +0200
+Subject: drm/vc4: fix krealloc() memory leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander A. Klimov <grandmaster@al2klimov.de>
+
+[ Upstream commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b ]
+
+Don't just overwrite the original pointer passed to krealloc()
+with its return value without checking latter:
+
+ MEM = krealloc(MEM, SZ, GFP);
+
+If krealloc() returns NULL, that erases the pointer
+to the still allocated memory, hence leaks this memory.
+Instead, use a temporary variable, check it's not NULL
+and only then assign it to the original pointer:
+
+ TMP = krealloc(MEM, SZ, GFP);
+ if (!TMP) return;
+ MEM = TMP;
+
+While on it, use krealloc_array().
+
+Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
+Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+index afb1a4d8268465..792e2d90aecf10 100644
+--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+@@ -288,15 +288,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
+ {
+ uint32_t o = validated_shader->num_uniform_addr_offsets;
+ uint32_t num_uniforms = validated_shader->uniforms_size / 4;
++ u32 *offsets;
+
+- validated_shader->uniform_addr_offsets =
+- krealloc(validated_shader->uniform_addr_offsets,
+- (o + 1) *
+- sizeof(*validated_shader->uniform_addr_offsets),
+- GFP_KERNEL);
+- if (!validated_shader->uniform_addr_offsets)
++ offsets = krealloc_array(validated_shader->uniform_addr_offsets,
++ o + 1,
++ sizeof(*validated_shader->uniform_addr_offsets),
++ GFP_KERNEL);
++ if (!offsets)
+ return false;
+
++ validated_shader->uniform_addr_offsets = offsets;
+ validated_shader->uniform_addr_offsets[o] = num_uniforms;
+ validated_shader->num_uniform_addr_offsets++;
+
+--
+2.53.0
+
--- /dev/null
+From 73b2271da6d2ac09a787005013db16832a0dfcf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jun 2026 15:27:43 +0300
+Subject: drm/virtio: Fix driver removal with disabled KMS
+
+From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+
+[ Upstream commit f329e8325e054bd6d84d10904f8dd51137281b92 ]
+
+DRM atomic and modesetting aren't initialized if virtio-gpu driver built
+with disabled KMS, leading to access of uninitialized data on driver
+removal/unbinding and crashing kernel. Fix it by skipping shutting down
+atomic core with unavailable KMS.
+
+Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support")
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Tested-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
+Reviewed-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
+Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_drv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c
+index e5a2665e50eac4..44d99e89bb9b65 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_drv.c
++++ b/drivers/gpu/drm/virtio/virtgpu_drv.c
+@@ -118,7 +118,10 @@ static void virtio_gpu_remove(struct virtio_device *vdev)
+ struct drm_device *dev = vdev->priv;
+
+ drm_dev_unplug(dev);
+- drm_atomic_helper_shutdown(dev);
++
++ if (drm_core_check_feature(dev, DRIVER_ATOMIC))
++ drm_atomic_helper_shutdown(dev);
++
+ virtio_gpu_deinit(dev);
+ drm_dev_put(dev);
+ }
+--
+2.53.0
+
--- /dev/null
+From be61c33eb89ccca14309b323aeb9fe22d5cfb4c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jun 2026 10:27:05 -0700
+Subject: drm/xe: fix refcount leak in xe_range_fence_insert()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit ba36786b21d19082e696eda85bfcd49e7071944a ]
+
+xe_range_fence_insert() acquires a reference on fence via
+dma_fence_get() and stores it in rfence->fence. It then calls
+dma_fence_add_callback() and handles two cases: when the callback
+is successfully registered (err == 0) the fence is transferred to
+the tree for later cleanup; when the fence is already signaled
+(err == -ENOENT) it manually drops the extra reference with
+dma_fence_put(fence).
+
+However, dma_fence_add_callback() can fail with other errors
+(e.g. -EINVAL) and in that case the code falls through to the free:
+label without releasing the acquired reference, leaking it.
+
+Fix the leak by adding an else branch that calls dma_fence_put()
+before jumping to free: for any error other than -ENOENT.
+
+Fixes: 845f64bdbfc9 ("drm/xe: Introduce a range-fence utility")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20260610172705.3450560-1-matthew.brost@intel.com
+(cherry picked from commit 98c4a4201290823c2c5c7ba21692bd9a64b61021)
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_range_fence.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_range_fence.c b/drivers/gpu/drm/xe/xe_range_fence.c
+index 372378e89e9892..3d8fa194a7b0eb 100644
+--- a/drivers/gpu/drm/xe/xe_range_fence.c
++++ b/drivers/gpu/drm/xe/xe_range_fence.c
+@@ -77,6 +77,8 @@ int xe_range_fence_insert(struct xe_range_fence_tree *tree,
+ } else if (err == 0) {
+ xe_range_fence_tree_insert(rfence, &tree->root);
+ return 0;
++ } else {
++ dma_fence_put(fence);
+ }
+
+ free:
+--
+2.53.0
+
xfrm-hold-device-only-for-the-asynchronous-decryptio.patch
xfrm-hold-dev-ref-until-after-transport_finish-nf_ho.patch
kvm-vmx-update-svi-during-runtime-apicv-activation.patch
+clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch
+clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch
+clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch
+drm-virtio-fix-driver-removal-with-disabled-kms.patch
+drm-vc4-fix-krealloc-memory-leak.patch
+drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch
--- /dev/null
+From d72290a8cfffb9a5d4c65ba6edb697b6e7c9ef45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jun 2026 08:11:27 -0700
+Subject: accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
+
+From: Lizhi Hou <lizhi.hou@amd.com>
+
+[ Upstream commit 2f41af638c92bac6f1f9275ea2d1901baef578f3 ]
+
+aie2_populate_range() jumps back to the again label without calling
+mmput(mm), leaking a reference to the mm_struct.
+
+Add the missing mmput() before jumping to again.
+
+Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
+Link: https://patch.msgid.link/20260610151127.2994185-1-lizhi.hou@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/amdxdna/aie2_ctx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
+index 4610f491f0881c..80de2906a26fcb 100644
+--- a/drivers/accel/amdxdna/aie2_ctx.c
++++ b/drivers/accel/amdxdna/aie2_ctx.c
+@@ -828,6 +828,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
+
+ if (ret == -EBUSY) {
+ amdxdna_umap_put(mapp);
++ mmput(mm);
+ goto again;
+ }
+
+@@ -838,11 +839,13 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
+ if (mmu_interval_read_retry(&mapp->notifier, mapp->range.notifier_seq)) {
+ up_write(&xdna->notifier_lock);
+ amdxdna_umap_put(mapp);
++ mmput(mm);
+ goto again;
+ }
+ mapp->invalid = false;
+ up_write(&xdna->notifier_lock);
+ amdxdna_umap_put(mapp);
++ mmput(mm);
+ goto again;
+
+ put_mm:
+--
+2.53.0
+
--- /dev/null
+From aaf55ed73ae88c751bf9868f16ae4e9a6aa7c7fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2026 23:01:51 +0800
+Subject: clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration
+ time
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pengyu Luo <mitltlatltl@gmail.com>
+
+[ Upstream commit 5285b046757844435d1db96c1b5c3a6621b2979a ]
+
+Parking disp{0,1}_cc_mdss_mdp_clk_src clk broke simplefb on HUAWEI
+Gaokun3, the image will stuck at grey for seconds until msm takes
+over framebuffer. Use clk_rcg2_shared_no_init_park_ops to skip it.
+
+Signed-off-by: Pengyu Luo <mitltlatltl@gmail.com>
+Tested-by: Jérôme de Bretagne <jerome.debretagne@gmail.com>
+Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration")
+Link: https://lore.kernel.org/r/20260303150152.90685-1-mitltlatltl@gmail.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-sc8280xp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/dispcc-sc8280xp.c b/drivers/clk/qcom/dispcc-sc8280xp.c
+index e91dfed0f37e9b..acc927c2142ab5 100644
+--- a/drivers/clk/qcom/dispcc-sc8280xp.c
++++ b/drivers/clk/qcom/dispcc-sc8280xp.c
+@@ -977,7 +977,7 @@ static struct clk_rcg2 disp0_cc_mdss_mdp_clk_src = {
+ .name = "disp0_cc_mdss_mdp_clk_src",
+ .parent_data = disp0_cc_parent_data_5,
+ .num_parents = ARRAY_SIZE(disp0_cc_parent_data_5),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_shared_no_init_park_ops,
+ },
+ };
+
+@@ -991,7 +991,7 @@ static struct clk_rcg2 disp1_cc_mdss_mdp_clk_src = {
+ .name = "disp1_cc_mdss_mdp_clk_src",
+ .parent_data = disp1_cc_parent_data_5,
+ .num_parents = ARRAY_SIZE(disp1_cc_parent_data_5),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_shared_no_init_park_ops,
+ },
+ };
+
+--
+2.53.0
+
--- /dev/null
+From 337e329b6645dc62cd6b542e35d6f5fc3abe1d5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Apr 2026 14:33:51 +0200
+Subject: clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from
+ getting parked
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+[ Upstream commit bc27dbefae6ed11376d991a2921eff806ffef67c ]
+
+Parking disp_cc_mdss_mdp_clk_src at 19.2MHz causing the EFI GOP framebuffer
+to stop functioning. The EFI GOP framebuffer should keep working until
+the msm display driver loads, to help with boot debugging and to ensure
+display output when the msm module is not in the initramfs.
+
+Switch disp_cc_mdss_mdp_clk_src over to clk_rcg2_shared_no_init_park_ops
+to keep the EFI GOP working after binding the x1e80100-dispcc driver.
+
+Suggested-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration")
+Link: https://lore.kernel.org/r/20260425123351.6292-1-johannes.goede@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-x1e80100.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/dispcc-x1e80100.c b/drivers/clk/qcom/dispcc-x1e80100.c
+index 40069eba41f241..5c00a0f8448931 100644
+--- a/drivers/clk/qcom/dispcc-x1e80100.c
++++ b/drivers/clk/qcom/dispcc-x1e80100.c
+@@ -580,7 +580,7 @@ static struct clk_rcg2 disp_cc_mdss_mdp_clk_src = {
+ .parent_data = disp_cc_parent_data_6,
+ .num_parents = ARRAY_SIZE(disp_cc_parent_data_6),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_shared_no_init_park_ops,
+ },
+ };
+
+--
+2.53.0
+
--- /dev/null
+From 13a8b71893444b2c77873a3322a147543638247e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 May 2026 17:14:57 +0000
+Subject: clk: samsung: gs101: Fix missing USI7_USI DIV clock in
+ peric0_clk_regs
+
+From: Kuan-Wei Chiu <visitorckw@gmail.com>
+
+[ Upstream commit 78ee734b36284d82454e87a92094fdb926985b47 ]
+
+In the peric0_clk_regs array, the divider register offset for USI6 was
+accidentally listed twice, while the divider for USI7 was omitted.
+
+Missing this DIV register causes the USI7 clock divider setting to be
+lost and reset to its hardware default value during a suspend/resume
+cycle.
+
+Replace the duplicated USI6 DIV entry with the correct USI7 DIV
+register.
+
+Fixes: 893f133a040b ("clk: samsung: gs101: add support for cmu_peric0")
+Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
+Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Link: https://patch.msgid.link/20260505171457.1960837-1-visitorckw@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-gs101.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/samsung/clk-gs101.c b/drivers/clk/samsung/clk-gs101.c
+index 70b26db9b95ad0..cd2bf64e08c529 100644
+--- a/drivers/clk/samsung/clk-gs101.c
++++ b/drivers/clk/samsung/clk-gs101.c
+@@ -3602,7 +3602,7 @@ static const unsigned long peric0_clk_regs[] __initconst = {
+ CLK_CON_DIV_DIV_CLK_PERIC0_USI4_USI,
+ CLK_CON_DIV_DIV_CLK_PERIC0_USI5_USI,
+ CLK_CON_DIV_DIV_CLK_PERIC0_USI6_USI,
+- CLK_CON_DIV_DIV_CLK_PERIC0_USI6_USI,
++ CLK_CON_DIV_DIV_CLK_PERIC0_USI7_USI,
+ CLK_CON_DIV_DIV_CLK_PERIC0_USI8_USI,
+ CLK_CON_BUF_CLKBUF_PERIC0_IP,
+ CLK_CON_GAT_CLK_BLK_PERIC0_UID_PERIC0_CMU_PERIC0_IPCLKPORT_PCLK,
+--
+2.53.0
+
--- /dev/null
+From 9bdee58aaf99074b634bda59bbfd8f6ec02e7612 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 May 2026 17:57:58 +0300
+Subject: drm/i915/edp: Check supported link rates DPCD read
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 2673cefa99ca918e7ac5b0388ff578a83656c896 ]
+
+intel_edp_set_sink_rates() reads DP_SUPPORTED_LINK_RATES into a local
+stack array and then parses the array unconditionally. If the read
+fails, the array contents are not valid and may result in bogus sink
+link rates being used.
+
+Use drm_dp_dpcd_read_data() and clear the sink rate array on failure,
+so the existing parser falls back to the default sink rate handling.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 68f357cb7347 ("drm/i915/dp: generate and cache sink rate array for all DP, not just eDP 1.4")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patch.msgid.link/20260529145759.1640646-1-n.zhandarovich@fintech.ru
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit bd61c7756b34157e093028225a69383b4b1203cc)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_dp.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
+index a44fbac1e5e272..c7886b36477067 100644
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -4372,10 +4372,17 @@ intel_edp_set_sink_rates(struct intel_dp *intel_dp)
+
+ if (intel_dp->edp_dpcd[0] >= DP_EDP_14) {
+ __le16 sink_rates[DP_MAX_SUPPORTED_RATES];
++ int ret;
+ int i;
+
+- drm_dp_dpcd_read(&intel_dp->aux, DP_SUPPORTED_LINK_RATES,
+- sink_rates, sizeof(sink_rates));
++ ret = drm_dp_dpcd_read_data(&intel_dp->aux,
++ DP_SUPPORTED_LINK_RATES,
++ sink_rates, sizeof(sink_rates));
++ if (ret < 0) {
++ drm_dbg_kms(display->drm,
++ "Unable to read eDP supported link rates, using default rates\n");
++ memset(sink_rates, 0, sizeof(sink_rates));
++ }
+
+ for (i = 0; i < ARRAY_SIZE(sink_rates); i++) {
+ int rate;
+--
+2.53.0
+
--- /dev/null
+From 68bdf9038ba8fc01ee998dfdeaf5c0e7d0c46acc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jun 2026 14:38:10 +0200
+Subject: drm/vc4: fix krealloc() memory leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander A. Klimov <grandmaster@al2klimov.de>
+
+[ Upstream commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b ]
+
+Don't just overwrite the original pointer passed to krealloc()
+with its return value without checking latter:
+
+ MEM = krealloc(MEM, SZ, GFP);
+
+If krealloc() returns NULL, that erases the pointer
+to the still allocated memory, hence leaks this memory.
+Instead, use a temporary variable, check it's not NULL
+and only then assign it to the original pointer:
+
+ TMP = krealloc(MEM, SZ, GFP);
+ if (!TMP) return;
+ MEM = TMP;
+
+While on it, use krealloc_array().
+
+Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
+Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+index 2d74e786914cb3..7ce3ec0906c33b 100644
+--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+@@ -288,15 +288,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
+ {
+ uint32_t o = validated_shader->num_uniform_addr_offsets;
+ uint32_t num_uniforms = validated_shader->uniforms_size / 4;
++ u32 *offsets;
+
+- validated_shader->uniform_addr_offsets =
+- krealloc(validated_shader->uniform_addr_offsets,
+- (o + 1) *
+- sizeof(*validated_shader->uniform_addr_offsets),
+- GFP_KERNEL);
+- if (!validated_shader->uniform_addr_offsets)
++ offsets = krealloc_array(validated_shader->uniform_addr_offsets,
++ o + 1,
++ sizeof(*validated_shader->uniform_addr_offsets),
++ GFP_KERNEL);
++ if (!offsets)
+ return false;
+
++ validated_shader->uniform_addr_offsets = offsets;
+ validated_shader->uniform_addr_offsets[o] = num_uniforms;
+ validated_shader->num_uniform_addr_offsets++;
+
+--
+2.53.0
+
--- /dev/null
+From 56bb0cd779a1890eb6c50b111d25ab27e8f9da04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jun 2026 15:27:43 +0300
+Subject: drm/virtio: Fix driver removal with disabled KMS
+
+From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+
+[ Upstream commit f329e8325e054bd6d84d10904f8dd51137281b92 ]
+
+DRM atomic and modesetting aren't initialized if virtio-gpu driver built
+with disabled KMS, leading to access of uninitialized data on driver
+removal/unbinding and crashing kernel. Fix it by skipping shutting down
+atomic core with unavailable KMS.
+
+Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support")
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Tested-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
+Reviewed-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
+Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_drv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c
+index 71c6ccad4b99b4..d9556e1b67b10b 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_drv.c
++++ b/drivers/gpu/drm/virtio/virtgpu_drv.c
+@@ -123,7 +123,10 @@ static void virtio_gpu_remove(struct virtio_device *vdev)
+ struct drm_device *dev = vdev->priv;
+
+ drm_dev_unplug(dev);
+- drm_atomic_helper_shutdown(dev);
++
++ if (drm_core_check_feature(dev, DRIVER_ATOMIC))
++ drm_atomic_helper_shutdown(dev);
++
+ virtio_gpu_deinit(dev);
+ drm_dev_put(dev);
+ }
+--
+2.53.0
+
--- /dev/null
+From c6ad8f2608d98c46eac9fb9e0e684abc5faaa178 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jun 2026 10:27:05 -0700
+Subject: drm/xe: fix refcount leak in xe_range_fence_insert()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit ba36786b21d19082e696eda85bfcd49e7071944a ]
+
+xe_range_fence_insert() acquires a reference on fence via
+dma_fence_get() and stores it in rfence->fence. It then calls
+dma_fence_add_callback() and handles two cases: when the callback
+is successfully registered (err == 0) the fence is transferred to
+the tree for later cleanup; when the fence is already signaled
+(err == -ENOENT) it manually drops the extra reference with
+dma_fence_put(fence).
+
+However, dma_fence_add_callback() can fail with other errors
+(e.g. -EINVAL) and in that case the code falls through to the free:
+label without releasing the acquired reference, leaking it.
+
+Fix the leak by adding an else branch that calls dma_fence_put()
+before jumping to free: for any error other than -ENOENT.
+
+Fixes: 845f64bdbfc9 ("drm/xe: Introduce a range-fence utility")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20260610172705.3450560-1-matthew.brost@intel.com
+(cherry picked from commit 98c4a4201290823c2c5c7ba21692bd9a64b61021)
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_range_fence.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_range_fence.c b/drivers/gpu/drm/xe/xe_range_fence.c
+index 372378e89e9892..3d8fa194a7b0eb 100644
+--- a/drivers/gpu/drm/xe/xe_range_fence.c
++++ b/drivers/gpu/drm/xe/xe_range_fence.c
+@@ -77,6 +77,8 @@ int xe_range_fence_insert(struct xe_range_fence_tree *tree,
+ } else if (err == 0) {
+ xe_range_fence_tree_insert(rfence, &tree->root);
+ return 0;
++ } else {
++ dma_fence_put(fence);
+ }
+
+ free:
+--
+2.53.0
+
net-txgbe-initialize-module-info-buffer.patch
ipv6-fix-a-potential-npd-in-cleanup_prefix_route.patch
kvm-vmx-update-svi-during-runtime-apicv-activation.patch
+clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch
+clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch
+clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch
+drm-i915-edp-check-supported-link-rates-dpcd-read.patch
+drm-virtio-fix-driver-removal-with-disabled-kms.patch
+drm-vc4-fix-krealloc-memory-leak.patch
+drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch
+accel-amdxdna-fix-mm_struct-reference-leak-in-aie2_p.patch
--- /dev/null
+From 5f838b3285059607f7df4dde12b1a18d4ffc31b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2026 23:01:51 +0800
+Subject: clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration
+ time
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pengyu Luo <mitltlatltl@gmail.com>
+
+[ Upstream commit 5285b046757844435d1db96c1b5c3a6621b2979a ]
+
+Parking disp{0,1}_cc_mdss_mdp_clk_src clk broke simplefb on HUAWEI
+Gaokun3, the image will stuck at grey for seconds until msm takes
+over framebuffer. Use clk_rcg2_shared_no_init_park_ops to skip it.
+
+Signed-off-by: Pengyu Luo <mitltlatltl@gmail.com>
+Tested-by: Jérôme de Bretagne <jerome.debretagne@gmail.com>
+Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration")
+Link: https://lore.kernel.org/r/20260303150152.90685-1-mitltlatltl@gmail.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-sc8280xp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/dispcc-sc8280xp.c b/drivers/clk/qcom/dispcc-sc8280xp.c
+index 7f8819ece5eb01..40fc57eb9f7981 100644
+--- a/drivers/clk/qcom/dispcc-sc8280xp.c
++++ b/drivers/clk/qcom/dispcc-sc8280xp.c
+@@ -978,7 +978,7 @@ static struct clk_rcg2 disp0_cc_mdss_mdp_clk_src = {
+ .name = "disp0_cc_mdss_mdp_clk_src",
+ .parent_data = disp0_cc_parent_data_5,
+ .num_parents = ARRAY_SIZE(disp0_cc_parent_data_5),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_shared_no_init_park_ops,
+ },
+ };
+
+@@ -992,7 +992,7 @@ static struct clk_rcg2 disp1_cc_mdss_mdp_clk_src = {
+ .name = "disp1_cc_mdss_mdp_clk_src",
+ .parent_data = disp1_cc_parent_data_5,
+ .num_parents = ARRAY_SIZE(disp1_cc_parent_data_5),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_shared_no_init_park_ops,
+ },
+ };
+
+--
+2.53.0
+
--- /dev/null
+From 39936784062825e2c103e1f209f4adc326703146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jun 2026 14:38:10 +0200
+Subject: drm/vc4: fix krealloc() memory leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander A. Klimov <grandmaster@al2klimov.de>
+
+[ Upstream commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b ]
+
+Don't just overwrite the original pointer passed to krealloc()
+with its return value without checking latter:
+
+ MEM = krealloc(MEM, SZ, GFP);
+
+If krealloc() returns NULL, that erases the pointer
+to the still allocated memory, hence leaks this memory.
+Instead, use a temporary variable, check it's not NULL
+and only then assign it to the original pointer:
+
+ TMP = krealloc(MEM, SZ, GFP);
+ if (!TMP) return;
+ MEM = TMP;
+
+While on it, use krealloc_array().
+
+Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
+Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+index 9745f8810eca6d..c2c6767ae55862 100644
+--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+@@ -288,15 +288,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
+ {
+ uint32_t o = validated_shader->num_uniform_addr_offsets;
+ uint32_t num_uniforms = validated_shader->uniforms_size / 4;
++ u32 *offsets;
+
+- validated_shader->uniform_addr_offsets =
+- krealloc(validated_shader->uniform_addr_offsets,
+- (o + 1) *
+- sizeof(*validated_shader->uniform_addr_offsets),
+- GFP_KERNEL);
+- if (!validated_shader->uniform_addr_offsets)
++ offsets = krealloc_array(validated_shader->uniform_addr_offsets,
++ o + 1,
++ sizeof(*validated_shader->uniform_addr_offsets),
++ GFP_KERNEL);
++ if (!offsets)
+ return false;
+
++ validated_shader->uniform_addr_offsets = offsets;
+ validated_shader->uniform_addr_offsets[o] = num_uniforms;
+ validated_shader->num_uniform_addr_offsets++;
+
+--
+2.53.0
+
--- /dev/null
+From 9a55af4ab013728b199b08c757dc4ddb5969f0f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jun 2026 15:27:43 +0300
+Subject: drm/virtio: Fix driver removal with disabled KMS
+
+From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+
+[ Upstream commit f329e8325e054bd6d84d10904f8dd51137281b92 ]
+
+DRM atomic and modesetting aren't initialized if virtio-gpu driver built
+with disabled KMS, leading to access of uninitialized data on driver
+removal/unbinding and crashing kernel. Fix it by skipping shutting down
+atomic core with unavailable KMS.
+
+Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support")
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Tested-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
+Reviewed-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
+Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_drv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c
+index c5716fd0aed380..9b399a12d43c20 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_drv.c
++++ b/drivers/gpu/drm/virtio/virtgpu_drv.c
+@@ -118,7 +118,10 @@ static void virtio_gpu_remove(struct virtio_device *vdev)
+ struct drm_device *dev = vdev->priv;
+
+ drm_dev_unplug(dev);
+- drm_atomic_helper_shutdown(dev);
++
++ if (drm_core_check_feature(dev, DRIVER_ATOMIC))
++ drm_atomic_helper_shutdown(dev);
++
+ virtio_gpu_deinit(dev);
+ drm_dev_put(dev);
+ }
+--
+2.53.0
+
net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
ipv6-fix-a-potential-npd-in-cleanup_prefix_route.patch
netfilter-ctnetlink-ensure-safe-access-to-master-con.patch
+clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch
+drm-virtio-fix-driver-removal-with-disabled-kms.patch
+drm-vc4-fix-krealloc-memory-leak.patch
--- /dev/null
+From a49294ef51fc833af8b9c329d13bf64f7e384432 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jun 2026 08:11:27 -0700
+Subject: accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
+
+From: Lizhi Hou <lizhi.hou@amd.com>
+
+[ Upstream commit 2f41af638c92bac6f1f9275ea2d1901baef578f3 ]
+
+aie2_populate_range() jumps back to the again label without calling
+mmput(mm), leaking a reference to the mm_struct.
+
+Add the missing mmput() before jumping to again.
+
+Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
+Link: https://patch.msgid.link/20260610151127.2994185-1-lizhi.hou@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/amdxdna/aie2_ctx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
+index c0d348884f7494..4c7264c6e6e76f 100644
+--- a/drivers/accel/amdxdna/aie2_ctx.c
++++ b/drivers/accel/amdxdna/aie2_ctx.c
+@@ -928,6 +928,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
+
+ if (ret == -EBUSY) {
+ amdxdna_umap_put(mapp);
++ mmput(mm);
+ goto again;
+ }
+
+@@ -938,11 +939,13 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
+ if (mmu_interval_read_retry(&mapp->notifier, mapp->range.notifier_seq)) {
+ up_write(&xdna->notifier_lock);
+ amdxdna_umap_put(mapp);
++ mmput(mm);
+ goto again;
+ }
+ mapp->invalid = false;
+ up_write(&xdna->notifier_lock);
+ amdxdna_umap_put(mapp);
++ mmput(mm);
+ goto again;
+
+ put_mm:
+--
+2.53.0
+
--- /dev/null
+From 30f4927cb581f7e795d8458c2ef70a6571fcf8d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2026 23:01:51 +0800
+Subject: clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration
+ time
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pengyu Luo <mitltlatltl@gmail.com>
+
+[ Upstream commit 5285b046757844435d1db96c1b5c3a6621b2979a ]
+
+Parking disp{0,1}_cc_mdss_mdp_clk_src clk broke simplefb on HUAWEI
+Gaokun3, the image will stuck at grey for seconds until msm takes
+over framebuffer. Use clk_rcg2_shared_no_init_park_ops to skip it.
+
+Signed-off-by: Pengyu Luo <mitltlatltl@gmail.com>
+Tested-by: Jérôme de Bretagne <jerome.debretagne@gmail.com>
+Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration")
+Link: https://lore.kernel.org/r/20260303150152.90685-1-mitltlatltl@gmail.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-sc8280xp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/dispcc-sc8280xp.c b/drivers/clk/qcom/dispcc-sc8280xp.c
+index e91dfed0f37e9b..acc927c2142ab5 100644
+--- a/drivers/clk/qcom/dispcc-sc8280xp.c
++++ b/drivers/clk/qcom/dispcc-sc8280xp.c
+@@ -977,7 +977,7 @@ static struct clk_rcg2 disp0_cc_mdss_mdp_clk_src = {
+ .name = "disp0_cc_mdss_mdp_clk_src",
+ .parent_data = disp0_cc_parent_data_5,
+ .num_parents = ARRAY_SIZE(disp0_cc_parent_data_5),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_shared_no_init_park_ops,
+ },
+ };
+
+@@ -991,7 +991,7 @@ static struct clk_rcg2 disp1_cc_mdss_mdp_clk_src = {
+ .name = "disp1_cc_mdss_mdp_clk_src",
+ .parent_data = disp1_cc_parent_data_5,
+ .num_parents = ARRAY_SIZE(disp1_cc_parent_data_5),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_shared_no_init_park_ops,
+ },
+ };
+
+--
+2.53.0
+
--- /dev/null
+From 1bc811a21f5c5d0d41960b011827b9615f4ca315 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Apr 2026 14:33:51 +0200
+Subject: clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from
+ getting parked
+
+From: Hans de Goede <johannes.goede@oss.qualcomm.com>
+
+[ Upstream commit bc27dbefae6ed11376d991a2921eff806ffef67c ]
+
+Parking disp_cc_mdss_mdp_clk_src at 19.2MHz causing the EFI GOP framebuffer
+to stop functioning. The EFI GOP framebuffer should keep working until
+the msm display driver loads, to help with boot debugging and to ensure
+display output when the msm module is not in the initramfs.
+
+Switch disp_cc_mdss_mdp_clk_src over to clk_rcg2_shared_no_init_park_ops
+to keep the EFI GOP working after binding the x1e80100-dispcc driver.
+
+Suggested-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration")
+Link: https://lore.kernel.org/r/20260425123351.6292-1-johannes.goede@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-x1e80100.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/dispcc-x1e80100.c b/drivers/clk/qcom/dispcc-x1e80100.c
+index aa7fd43969f9c8..cd45bedf26494c 100644
+--- a/drivers/clk/qcom/dispcc-x1e80100.c
++++ b/drivers/clk/qcom/dispcc-x1e80100.c
+@@ -580,7 +580,7 @@ static struct clk_rcg2 disp_cc_mdss_mdp_clk_src = {
+ .parent_data = disp_cc_parent_data_6,
+ .num_parents = ARRAY_SIZE(disp_cc_parent_data_6),
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_shared_no_init_park_ops,
+ },
+ };
+
+--
+2.53.0
+
--- /dev/null
+From 9d61484121bcf94a620d82a628e7912bf4e43ac7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 May 2026 17:14:57 +0000
+Subject: clk: samsung: gs101: Fix missing USI7_USI DIV clock in
+ peric0_clk_regs
+
+From: Kuan-Wei Chiu <visitorckw@gmail.com>
+
+[ Upstream commit 78ee734b36284d82454e87a92094fdb926985b47 ]
+
+In the peric0_clk_regs array, the divider register offset for USI6 was
+accidentally listed twice, while the divider for USI7 was omitted.
+
+Missing this DIV register causes the USI7 clock divider setting to be
+lost and reset to its hardware default value during a suspend/resume
+cycle.
+
+Replace the duplicated USI6 DIV entry with the correct USI7 DIV
+register.
+
+Fixes: 893f133a040b ("clk: samsung: gs101: add support for cmu_peric0")
+Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
+Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Link: https://patch.msgid.link/20260505171457.1960837-1-visitorckw@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-gs101.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/samsung/clk-gs101.c b/drivers/clk/samsung/clk-gs101.c
+index 44a8ecd332fddc..b439b7ae30ea39 100644
+--- a/drivers/clk/samsung/clk-gs101.c
++++ b/drivers/clk/samsung/clk-gs101.c
+@@ -3921,7 +3921,7 @@ static const unsigned long peric0_clk_regs[] __initconst = {
+ CLK_CON_DIV_DIV_CLK_PERIC0_USI4_USI,
+ CLK_CON_DIV_DIV_CLK_PERIC0_USI5_USI,
+ CLK_CON_DIV_DIV_CLK_PERIC0_USI6_USI,
+- CLK_CON_DIV_DIV_CLK_PERIC0_USI6_USI,
++ CLK_CON_DIV_DIV_CLK_PERIC0_USI7_USI,
+ CLK_CON_DIV_DIV_CLK_PERIC0_USI8_USI,
+ CLK_CON_BUF_CLKBUF_PERIC0_IP,
+ CLK_CON_GAT_CLK_BLK_PERIC0_UID_PERIC0_CMU_PERIC0_IPCLKPORT_PCLK,
+--
+2.53.0
+
--- /dev/null
+From 2c701836b8652399ae15f95b58461fe7fbcec235 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2026 12:20:21 +0200
+Subject: drm/amd/display: use plane color_mgmt_changed to track colorop
+ changes
+
+From: Melissa Wen <mwen@igalia.com>
+
+[ Upstream commit d79716401a954677a93c4dd51fec65beccb38296 ]
+
+Ensure the driver tracks changes in any colorop property of a plane
+color pipeline by using the same mechanism of CRTC color management and
+update plane color blocks when any colorop property changes. It fixes an
+issue observed on gamescope settings for night mode which is done via
+shaper/3D-LUT updates.
+
+Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block")
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
+Link: https://patch.msgid.link/20260609110420.1298352-5-mwen@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 0aee65503642d7..2d0c818cace25c 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10016,7 +10016,7 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state,
+ continue;
+
+ bundle->surface_updates[planes_count].surface = dc_plane;
+- if (new_pcrtc_state->color_mgmt_changed) {
++ if (new_pcrtc_state->color_mgmt_changed || new_plane_state->color_mgmt_changed) {
+ bundle->surface_updates[planes_count].gamma = &dc_plane->gamma_correction;
+ bundle->surface_updates[planes_count].in_transfer_func = &dc_plane->in_transfer_func;
+ bundle->surface_updates[planes_count].gamut_remap_matrix = &dc_plane->gamut_remap_matrix;
+@@ -11756,6 +11756,10 @@ static bool should_reset_plane(struct drm_atomic_state *state,
+ if (new_crtc_state->color_mgmt_changed)
+ return true;
+
++ /* Plane color pipeline or its colorop changes. */
++ if (new_plane_state->color_mgmt_changed)
++ return true;
++
+ /*
+ * On zpos change, planes need to be reordered by removing and re-adding
+ * them one by one to the dc state, in order of descending zpos.
+--
+2.53.0
+
--- /dev/null
+From d071fc0933d1dcadbe390868a4e0a242df04e492 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2026 12:20:20 +0200
+Subject: drm/atomic: track individual colorop updates
+
+From: Melissa Wen <mwen@igalia.com>
+
+[ Upstream commit 2e235e2a2784b12b735321e5b42240ca51c49b0f ]
+
+As we do for CRTC color mgmt properties, use color_mgmt_changed flag to
+track any value changes in the color pipeline of a given plane, so that
+drivers can update color blocks as soon as plane color pipeline or
+individual colorop values change. Since we're here, only announce and
+track changes to plane COLOR_PIPELINE prop if its value is actually
+changing.
+
+Fixes: 8c5ea1745f4c ("drm/colorop: Add BYPASS property")
+Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation")
+Fixes: 41651f9d42eb ("drm/colorop: Add 1D Curve subtype")
+Fixes: 3410108037d5 ("drm/colorop: Add multiplier type")
+Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline")
+Fixes: e5719e7f1900 ("drm/colorop: Add 3x4 CTM type")
+Fixes: 99a4e4f08abe ("drm/colorop: Add 1D Curve Custom LUT type")
+Fixes: 2afc3184f3b3 ("drm/plane: Add COLOR PIPELINE property")
+Reviewed-by: Harry Wentland <harry.wentland@amd.com> #v1
+Reviewed-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block")
+Signed-off-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
+Link: https://patch.msgid.link/20260609110420.1298352-4-mwen@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_atomic_uapi.c | 64 ++++++++++++++++++++++++-------
+ include/drm/drm_atomic_uapi.h | 4 +-
+ 2 files changed, 54 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
+index aefcf58e4f0399..97bbf91f3c7975 100644
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -265,13 +265,19 @@ EXPORT_SYMBOL(drm_atomic_set_fb_for_plane);
+ *
+ * Helper function to select the color pipeline on a plane by setting
+ * it to the first drm_colorop element of the pipeline.
++ *
++ * Return: true if plane color pipeline value changed, false otherwise.
+ */
+-void
++bool
+ drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state,
+ struct drm_colorop *colorop)
+ {
+ struct drm_plane *plane = plane_state->plane;
+
++ /* Color pipeline didn't change */
++ if (plane_state->color_pipeline == colorop)
++ return false;
++
+ if (colorop)
+ drm_dbg_atomic(plane->dev,
+ "Set [COLOROP:%d] for [PLANE:%d:%s] state %p\n",
+@@ -283,6 +289,8 @@ drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state,
+ plane->base.id, plane->name, plane_state);
+
+ plane_state->color_pipeline = colorop;
++
++ return true;
+ }
+ EXPORT_SYMBOL(drm_atomic_set_colorop_for_plane);
+
+@@ -600,7 +608,7 @@ static int drm_atomic_plane_set_property(struct drm_plane *plane,
+ if (val && !colorop)
+ return -EACCES;
+
+- drm_atomic_set_colorop_for_plane(state, colorop);
++ state->color_mgmt_changed |= drm_atomic_set_colorop_for_plane(state, colorop);
+ } else if (property == config->prop_fb_damage_clips) {
+ ret = drm_property_replace_blob_from_id(dev,
+ &state->fb_damage_clips,
+@@ -709,11 +717,11 @@ drm_atomic_plane_get_property(struct drm_plane *plane,
+ static int drm_atomic_color_set_data_property(struct drm_colorop *colorop,
+ struct drm_colorop_state *state,
+ struct drm_property *property,
+- uint64_t val)
++ uint64_t val,
++ bool *replaced)
+ {
+ ssize_t elem_size = -1;
+ ssize_t size = -1;
+- bool replaced = false;
+
+ switch (colorop->type) {
+ case DRM_COLOROP_1D_LUT:
+@@ -735,28 +743,45 @@ static int drm_atomic_color_set_data_property(struct drm_colorop *colorop,
+ &state->data,
+ val,
+ -1, size, elem_size,
+- &replaced);
++ replaced);
+ }
+
+ static int drm_atomic_colorop_set_property(struct drm_colorop *colorop,
+ struct drm_colorop_state *state,
+ struct drm_file *file_priv,
+ struct drm_property *property,
+- uint64_t val)
++ uint64_t val,
++ bool *replaced)
+ {
+ if (property == colorop->bypass_property) {
+- state->bypass = val;
++ if (state->bypass != val) {
++ state->bypass = val;
++ *replaced = true;
++ }
+ } else if (property == colorop->lut1d_interpolation_property) {
+- state->lut1d_interpolation = val;
++ if (state->lut1d_interpolation != val) {
++ state->lut1d_interpolation = val;
++ *replaced = true;
++ }
+ } else if (property == colorop->curve_1d_type_property) {
+- state->curve_1d_type = val;
++ if (state->curve_1d_type != val) {
++ state->curve_1d_type = val;
++ *replaced = true;
++ }
+ } else if (property == colorop->multiplier_property) {
+- state->multiplier = val;
++ if (state->multiplier != val) {
++ state->multiplier = val;
++ *replaced = true;
++ }
+ } else if (property == colorop->lut3d_interpolation_property) {
+- state->lut3d_interpolation = val;
++ if (state->lut3d_interpolation != val) {
++ state->lut3d_interpolation = val;
++ *replaced = true;
++ }
+ } else if (property == colorop->data_property) {
+ return drm_atomic_color_set_data_property(colorop, state,
+- property, val);
++ property, val,
++ replaced);
+ } else {
+ drm_dbg_atomic(colorop->dev,
+ "[COLOROP:%d:%d] unknown property [PROP:%d:%s]\n",
+@@ -1271,8 +1296,10 @@ int drm_atomic_set_property(struct drm_atomic_state *state,
+ break;
+ }
+ case DRM_MODE_OBJECT_COLOROP: {
++ struct drm_plane_state *plane_state;
+ struct drm_colorop *colorop = obj_to_colorop(obj);
+ struct drm_colorop_state *colorop_state;
++ bool replaced = false;
+
+ colorop_state = drm_atomic_get_colorop_state(state, colorop);
+ if (IS_ERR(colorop_state)) {
+@@ -1281,7 +1308,18 @@ int drm_atomic_set_property(struct drm_atomic_state *state,
+ }
+
+ ret = drm_atomic_colorop_set_property(colorop, colorop_state,
+- file_priv, prop, prop_value);
++ file_priv, prop, prop_value,
++ &replaced);
++ if (ret || !replaced)
++ break;
++
++ plane_state = drm_atomic_get_plane_state(state, colorop->plane);
++ if (IS_ERR(plane_state)) {
++ ret = PTR_ERR(plane_state);
++ break;
++ }
++ plane_state->color_mgmt_changed |= replaced;
++
+ break;
+ }
+ default:
+diff --git a/include/drm/drm_atomic_uapi.h b/include/drm/drm_atomic_uapi.h
+index 4363155233267b..4e7e78f711e26a 100644
+--- a/include/drm/drm_atomic_uapi.h
++++ b/include/drm/drm_atomic_uapi.h
+@@ -29,6 +29,8 @@
+ #ifndef DRM_ATOMIC_UAPI_H_
+ #define DRM_ATOMIC_UAPI_H_
+
++#include <linux/types.h>
++
+ struct drm_crtc_state;
+ struct drm_display_mode;
+ struct drm_property_blob;
+@@ -50,7 +52,7 @@ drm_atomic_set_crtc_for_plane(struct drm_plane_state *plane_state,
+ struct drm_crtc *crtc);
+ void drm_atomic_set_fb_for_plane(struct drm_plane_state *plane_state,
+ struct drm_framebuffer *fb);
+-void drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state,
++bool drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state,
+ struct drm_colorop *colorop);
+ int __must_check
+ drm_atomic_set_crtc_for_connector(struct drm_connector_state *conn_state,
+--
+2.53.0
+
--- /dev/null
+From 891d9a2652a65b39d99563a83c20e515028bf406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2026 12:20:19 +0200
+Subject: drm/colorop: make lut(1/3)d_interpolation props correctly behave as
+ mutable
+
+From: Melissa Wen <mwen@igalia.com>
+
+[ Upstream commit 94ff735296d371045fce163451a3d65e44ac4729 ]
+
+As interpolation props are actually mutable props, any changes should be
+handled by drm_colorop_state. Move their enum and make it correctly
+behaves as mutable.
+
+Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation")
+Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline")
+Reviewed-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block")
+Signed-off-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
+Link: https://patch.msgid.link/20260609110420.1298352-3-mwen@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_atomic.c | 4 ++--
+ drivers/gpu/drm/drm_atomic_uapi.c | 8 ++++----
+ drivers/gpu/drm/drm_colorop.c | 16 ++++++++++++++--
+ include/drm/drm_colorop.h | 28 ++++++++++++++--------------
+ 4 files changed, 34 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index ec7534227f66d4..b31bb3f9b11aae 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -829,7 +829,7 @@ static void drm_atomic_colorop_print_state(struct drm_printer *p,
+ case DRM_COLOROP_1D_LUT:
+ drm_printf(p, "\tsize=%d\n", colorop->size);
+ drm_printf(p, "\tinterpolation=%s\n",
+- drm_get_colorop_lut1d_interpolation_name(colorop->lut1d_interpolation));
++ drm_get_colorop_lut1d_interpolation_name(state->lut1d_interpolation));
+ drm_printf(p, "\tdata blob id=%d\n", state->data ? state->data->base.id : 0);
+ break;
+ case DRM_COLOROP_CTM_3X4:
+@@ -841,7 +841,7 @@ static void drm_atomic_colorop_print_state(struct drm_printer *p,
+ case DRM_COLOROP_3D_LUT:
+ drm_printf(p, "\tsize=%d\n", colorop->size);
+ drm_printf(p, "\tinterpolation=%s\n",
+- drm_get_colorop_lut3d_interpolation_name(colorop->lut3d_interpolation));
++ drm_get_colorop_lut3d_interpolation_name(state->lut3d_interpolation));
+ drm_printf(p, "\tdata blob id=%d\n", state->data ? state->data->base.id : 0);
+ break;
+ default:
+diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
+index 87de41fb445931..aefcf58e4f0399 100644
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -747,13 +747,13 @@ static int drm_atomic_colorop_set_property(struct drm_colorop *colorop,
+ if (property == colorop->bypass_property) {
+ state->bypass = val;
+ } else if (property == colorop->lut1d_interpolation_property) {
+- colorop->lut1d_interpolation = val;
++ state->lut1d_interpolation = val;
+ } else if (property == colorop->curve_1d_type_property) {
+ state->curve_1d_type = val;
+ } else if (property == colorop->multiplier_property) {
+ state->multiplier = val;
+ } else if (property == colorop->lut3d_interpolation_property) {
+- colorop->lut3d_interpolation = val;
++ state->lut3d_interpolation = val;
+ } else if (property == colorop->data_property) {
+ return drm_atomic_color_set_data_property(colorop, state,
+ property, val);
+@@ -778,7 +778,7 @@ drm_atomic_colorop_get_property(struct drm_colorop *colorop,
+ else if (property == colorop->bypass_property)
+ *val = state->bypass;
+ else if (property == colorop->lut1d_interpolation_property)
+- *val = colorop->lut1d_interpolation;
++ *val = state->lut1d_interpolation;
+ else if (property == colorop->curve_1d_type_property)
+ *val = state->curve_1d_type;
+ else if (property == colorop->multiplier_property)
+@@ -786,7 +786,7 @@ drm_atomic_colorop_get_property(struct drm_colorop *colorop,
+ else if (property == colorop->size_property)
+ *val = colorop->size;
+ else if (property == colorop->lut3d_interpolation_property)
+- *val = colorop->lut3d_interpolation;
++ *val = state->lut3d_interpolation;
+ else if (property == colorop->data_property)
+ *val = (state->data) ? state->data->base.id : 0;
+ else
+diff --git a/drivers/gpu/drm/drm_colorop.c b/drivers/gpu/drm/drm_colorop.c
+index 27139862b12086..6751add3cba96c 100644
+--- a/drivers/gpu/drm/drm_colorop.c
++++ b/drivers/gpu/drm/drm_colorop.c
+@@ -321,7 +321,6 @@ int drm_plane_colorop_curve_1d_lut_init(struct drm_device *dev, struct drm_color
+
+ colorop->lut1d_interpolation_property = prop;
+ drm_object_attach_property(&colorop->base, prop, interpolation);
+- colorop->lut1d_interpolation = interpolation;
+
+ /* data */
+ ret = drm_colorop_create_data_prop(dev, colorop);
+@@ -417,7 +416,6 @@ int drm_plane_colorop_3dlut_init(struct drm_device *dev, struct drm_colorop *col
+
+ colorop->lut3d_interpolation_property = prop;
+ drm_object_attach_property(&colorop->base, prop, interpolation);
+- colorop->lut3d_interpolation = interpolation;
+
+ /* data */
+ ret = drm_colorop_create_data_prop(dev, colorop);
+@@ -496,6 +494,20 @@ static void __drm_colorop_state_reset(struct drm_colorop_state *colorop_state,
+ &val);
+ colorop_state->curve_1d_type = val;
+ }
++
++ if (colorop->lut1d_interpolation_property) {
++ if (!drm_object_property_get_default_value(&colorop->base,
++ colorop->lut1d_interpolation_property,
++ &val))
++ colorop_state->lut1d_interpolation = val;
++ }
++
++ if (colorop->lut3d_interpolation_property) {
++ if (!drm_object_property_get_default_value(&colorop->base,
++ colorop->lut3d_interpolation_property,
++ &val))
++ colorop_state->lut3d_interpolation = val;
++ }
+ }
+
+ /**
+diff --git a/include/drm/drm_colorop.h b/include/drm/drm_colorop.h
+index 5bcb510e56c0a7..272ebff2de72e2 100644
+--- a/include/drm/drm_colorop.h
++++ b/include/drm/drm_colorop.h
+@@ -183,6 +183,20 @@ struct drm_colorop_state {
+ */
+ struct drm_property_blob *data;
+
++ /**
++ * @lut1d_interpolation:
++ *
++ * Interpolation for DRM_COLOROP_1D_LUT
++ */
++ enum drm_colorop_lut1d_interpolation_type lut1d_interpolation;
++
++ /**
++ * @lut3d_interpolation:
++ *
++ * Interpolation for DRM_COLOROP_3D_LUT
++ */
++ enum drm_colorop_lut3d_interpolation_type lut3d_interpolation;
++
+ /** @state: backpointer to global drm_atomic_state */
+ struct drm_atomic_state *state;
+ };
+@@ -293,20 +307,6 @@ struct drm_colorop {
+ */
+ uint32_t size;
+
+- /**
+- * @lut1d_interpolation:
+- *
+- * Interpolation for DRM_COLOROP_1D_LUT
+- */
+- enum drm_colorop_lut1d_interpolation_type lut1d_interpolation;
+-
+- /**
+- * @lut3d_interpolation:
+- *
+- * Interpolation for DRM_COLOROP_3D_LUT
+- */
+- enum drm_colorop_lut3d_interpolation_type lut3d_interpolation;
+-
+ /**
+ * @lut1d_interpolation_property:
+ *
+--
+2.53.0
+
--- /dev/null
+From 4359686aa76c964911f0732b4b6b1a9c5001661a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2026 12:20:18 +0200
+Subject: drm/colorop: Remove read-only comments from interpolation fields
+
+From: Alex Hung <alex.hung@amd.com>
+
+[ Upstream commit e480228cf65583040c894bb9cc02e1d5b328cee0 ]
+
+The lut1d_interpolation and lut3d_interpolation fields and their
+associated properties were marked as read-only, but userspace
+can set them via drm_atomic_colorop_set_property().
+
+Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation")
+Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline")
+Reviewed-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block")
+Signed-off-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
+Link: https://patch.msgid.link/20260609110420.1298352-2-mwen@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_colorop.h | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/include/drm/drm_colorop.h b/include/drm/drm_colorop.h
+index a3a32f9f918c73..5bcb510e56c0a7 100644
+--- a/include/drm/drm_colorop.h
++++ b/include/drm/drm_colorop.h
+@@ -296,7 +296,6 @@ struct drm_colorop {
+ /**
+ * @lut1d_interpolation:
+ *
+- * Read-only
+ * Interpolation for DRM_COLOROP_1D_LUT
+ */
+ enum drm_colorop_lut1d_interpolation_type lut1d_interpolation;
+@@ -304,7 +303,6 @@ struct drm_colorop {
+ /**
+ * @lut3d_interpolation:
+ *
+- * Read-only
+ * Interpolation for DRM_COLOROP_3D_LUT
+ */
+ enum drm_colorop_lut3d_interpolation_type lut3d_interpolation;
+@@ -312,7 +310,7 @@ struct drm_colorop {
+ /**
+ * @lut1d_interpolation_property:
+ *
+- * Read-only property for DRM_COLOROP_1D_LUT interpolation
++ * Property for DRM_COLOROP_1D_LUT interpolation
+ */
+ struct drm_property *lut1d_interpolation_property;
+
+@@ -340,7 +338,7 @@ struct drm_colorop {
+ /**
+ * @lut3d_interpolation_property:
+ *
+- * Read-only property for DRM_COLOROP_3D_LUT interpolation
++ * Property for DRM_COLOROP_3D_LUT interpolation
+ */
+ struct drm_property *lut3d_interpolation_property;
+
+--
+2.53.0
+
--- /dev/null
+From 1ef4c03c5a8492fa7bb5318beadbf7c89d7bb014 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 May 2026 17:57:58 +0300
+Subject: drm/i915/edp: Check supported link rates DPCD read
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 2673cefa99ca918e7ac5b0388ff578a83656c896 ]
+
+intel_edp_set_sink_rates() reads DP_SUPPORTED_LINK_RATES into a local
+stack array and then parses the array unconditionally. If the read
+fails, the array contents are not valid and may result in bogus sink
+link rates being used.
+
+Use drm_dp_dpcd_read_data() and clear the sink rate array on failure,
+so the existing parser falls back to the default sink rate handling.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 68f357cb7347 ("drm/i915/dp: generate and cache sink rate array for all DP, not just eDP 1.4")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patch.msgid.link/20260529145759.1640646-1-n.zhandarovich@fintech.ru
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit bd61c7756b34157e093028225a69383b4b1203cc)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_dp.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
+index d52205d714eee6..afd4169ac0a6c0 100644
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -4533,10 +4533,17 @@ intel_edp_set_sink_rates(struct intel_dp *intel_dp)
+
+ if (intel_dp->edp_dpcd[0] >= DP_EDP_14) {
+ __le16 sink_rates[DP_MAX_SUPPORTED_RATES];
++ int ret;
+ int i;
+
+- drm_dp_dpcd_read(&intel_dp->aux, DP_SUPPORTED_LINK_RATES,
+- sink_rates, sizeof(sink_rates));
++ ret = drm_dp_dpcd_read_data(&intel_dp->aux,
++ DP_SUPPORTED_LINK_RATES,
++ sink_rates, sizeof(sink_rates));
++ if (ret < 0) {
++ drm_dbg_kms(display->drm,
++ "Unable to read eDP supported link rates, using default rates\n");
++ memset(sink_rates, 0, sizeof(sink_rates));
++ }
+
+ for (i = 0; i < ARRAY_SIZE(sink_rates); i++) {
+ int rate;
+--
+2.53.0
+
--- /dev/null
+From eb816fac43013afe45d739f3b890ab1bad62e7ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jun 2026 14:38:10 +0200
+Subject: drm/vc4: fix krealloc() memory leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander A. Klimov <grandmaster@al2klimov.de>
+
+[ Upstream commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b ]
+
+Don't just overwrite the original pointer passed to krealloc()
+with its return value without checking latter:
+
+ MEM = krealloc(MEM, SZ, GFP);
+
+If krealloc() returns NULL, that erases the pointer
+to the still allocated memory, hence leaks this memory.
+Instead, use a temporary variable, check it's not NULL
+and only then assign it to the original pointer:
+
+ TMP = krealloc(MEM, SZ, GFP);
+ if (!TMP) return;
+ MEM = TMP;
+
+While on it, use krealloc_array().
+
+Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
+Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+index d48cf76983c09b..66502a6a4a8e7b 100644
+--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+@@ -290,15 +290,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
+ {
+ uint32_t o = validated_shader->num_uniform_addr_offsets;
+ uint32_t num_uniforms = validated_shader->uniforms_size / 4;
++ u32 *offsets;
+
+- validated_shader->uniform_addr_offsets =
+- krealloc(validated_shader->uniform_addr_offsets,
+- (o + 1) *
+- sizeof(*validated_shader->uniform_addr_offsets),
+- GFP_KERNEL);
+- if (!validated_shader->uniform_addr_offsets)
++ offsets = krealloc_array(validated_shader->uniform_addr_offsets,
++ o + 1,
++ sizeof(*validated_shader->uniform_addr_offsets),
++ GFP_KERNEL);
++ if (!offsets)
+ return false;
+
++ validated_shader->uniform_addr_offsets = offsets;
+ validated_shader->uniform_addr_offsets[o] = num_uniforms;
+ validated_shader->num_uniform_addr_offsets++;
+
+--
+2.53.0
+
--- /dev/null
+From aba62394541e1cd60a980975fcd01d0f2da3dc52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jun 2026 15:27:43 +0300
+Subject: drm/virtio: Fix driver removal with disabled KMS
+
+From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+
+[ Upstream commit f329e8325e054bd6d84d10904f8dd51137281b92 ]
+
+DRM atomic and modesetting aren't initialized if virtio-gpu driver built
+with disabled KMS, leading to access of uninitialized data on driver
+removal/unbinding and crashing kernel. Fix it by skipping shutting down
+atomic core with unavailable KMS.
+
+Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support")
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Tested-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
+Reviewed-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
+Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_drv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c
+index a5ce96fb8a1d24..9af740bda83593 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_drv.c
++++ b/drivers/gpu/drm/virtio/virtgpu_drv.c
+@@ -124,7 +124,10 @@ static void virtio_gpu_remove(struct virtio_device *vdev)
+ struct drm_device *dev = vdev->priv;
+
+ drm_dev_unplug(dev);
+- drm_atomic_helper_shutdown(dev);
++
++ if (drm_core_check_feature(dev, DRIVER_ATOMIC))
++ drm_atomic_helper_shutdown(dev);
++
+ virtio_gpu_deinit(dev);
+ drm_dev_put(dev);
+ }
+--
+2.53.0
+
--- /dev/null
+From cc4e2b797c1e6c523f1dddc378e7268ac7a48217 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jun 2026 11:25:49 -0400
+Subject: drm/xe: fix job timeout recovery for unstarted jobs and kernel queues
+
+From: Rodrigo Vivi <rodrigo.vivi@intel.com>
+
+[ Upstream commit 347ccc0453fca2c669e8dc8a72000e76ca4adf10 ]
+
+A job that GuC never scheduled (never started) indicates a GuC
+scheduling failure; previously such jobs were silently errored out
+instead of triggering a GT reset to recover. Trigger a GT reset and
+resubmit them, but only when the queue was not already killed or banned:
+an unstarted job on an already banned queue is the ban working as
+intended and must neither clear the ban nor kick off a reset, otherwise
+a banned userspace queue could be resurrected and spam GT resets.
+
+Kernel queues are always recovered this way and wedge the device once
+recovery attempts are exhausted, since kernel work must not silently
+fail. A started job that times out on a userspace VM bind queue stays
+banned rather than being reset and retried.
+
+The queue is banned early in the timeout handler to signal the G2H
+scheduling-done handler so it wakes the disable-scheduling waiter;
+without it the waiter sleeps the full 5s timeout. When a reset is
+warranted the ban is cleared before rearming so that
+guc_exec_queue_start() can resubmit jobs after the GT reset - a
+still-banned queue would block resubmission and cause an infinite TDR
+loop. The already-banned case is gated out before this point via
+skip_timeout_check, so it is unaffected.
+
+v2: (Himal) Do it for any queue type, not just kernel/migration
+v3: - (Sashiko and Sanjay): don't clear the ban / GT reset for already
+ killed/banned queues on unstarted-job timeout
+ - Update commit message
+ - (Matt) Add Fixes tag
+
+Fixes: fe05cee4d953 ("drm/xe: Don't short circuit TDR on jobs not started")
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Sanjay Yadav <sanjay.kumar.yadav@intel.com>
+Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Assisted-by: GitHub-Copilot:claude-sonnet-4.6
+Assisted-by: GitHub-Copilot:claude-opus-4.8
+Tested-by: Sanjay Yadav <sanjay.kumar.yadav@intel.com>
+Reviewed-by: Sanjay Yadav <sanjay.kumar.yadav@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Link: https://patch.msgid.link/20260610152548.404575-3-rodrigo.vivi@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+(cherry picked from commit b1107d085e7e8ed15ba6f80c102528a9c8a6cb0e)
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_submit.c | 49 +++++++++++++++++++++---------
+ 1 file changed, 35 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index e948f40fa17896..6365eca9816092 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -159,6 +159,11 @@ static void set_exec_queue_banned(struct xe_exec_queue *q)
+ atomic_or(EXEC_QUEUE_STATE_BANNED, &q->guc->state);
+ }
+
++static void clear_exec_queue_banned(struct xe_exec_queue *q)
++{
++ atomic_andnot(EXEC_QUEUE_STATE_BANNED, &q->guc->state);
++}
++
+ static bool exec_queue_suspended(struct xe_exec_queue *q)
+ {
+ return atomic_read(&q->guc->state) & EXEC_QUEUE_STATE_SUSPENDED;
+@@ -1326,7 +1331,8 @@ static bool check_timeout(struct xe_exec_queue *q, struct xe_sched_job *job)
+ xe_sched_job_seqno(job), xe_sched_job_lrc_seqno(job),
+ q->guc->id);
+
+- return xe_sched_invalidate_job(job, 2);
++ /* GuC never scheduled this job - let the caller trigger a GT reset. */
++ return true;
+ }
+
+ ctx_timestamp = lower_32_bits(xe_lrc_timestamp(q->lrc[0]));
+@@ -1423,6 +1429,21 @@ static void disable_scheduling(struct xe_exec_queue *q, bool immediate)
+ G2H_LEN_DW_SCHED_CONTEXT_MODE_SET, 1);
+ }
+
++/*
++ * Recover via GT reset for a kernel queue, or for a GuC scheduling failure (job
++ * never started) on a queue that was not already killed or banned. An already
++ * banned queue must stay banned, so its unstarted jobs do not clear the ban or
++ * trigger a reset.
++ */
++static bool timeout_needs_gt_reset(struct xe_exec_queue *q, struct xe_sched_job *job,
++ bool skip_timeout_check)
++{
++ if (q->flags & EXEC_QUEUE_FLAG_KERNEL)
++ return true;
++
++ return !skip_timeout_check && !xe_sched_job_started(job);
++}
++
+ static enum drm_gpu_sched_stat
+ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job)
+ {
+@@ -1573,19 +1594,19 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job)
+ xe_sched_job_seqno(job), xe_sched_job_lrc_seqno(job),
+ q->guc->id, q->flags);
+
+- /*
+- * Kernel jobs should never fail, nor should VM jobs if they do
+- * somethings has gone wrong and the GT needs a reset
+- */
+- xe_gt_WARN(q->gt, q->flags & EXEC_QUEUE_FLAG_KERNEL,
+- "Kernel-submitted job timed out\n");
+- xe_gt_WARN(q->gt, q->flags & EXEC_QUEUE_FLAG_VM && !exec_queue_killed(q),
+- "VM job timed out on non-killed execqueue\n");
+- if (!wedged && (q->flags & EXEC_QUEUE_FLAG_KERNEL ||
+- (q->flags & EXEC_QUEUE_FLAG_VM && !exec_queue_killed(q)))) {
+- if (!xe_sched_invalidate_job(job, 2)) {
+- xe_gt_reset_async(q->gt);
+- goto rearm;
++ if (!wedged) {
++ if (timeout_needs_gt_reset(q, job, skip_timeout_check)) {
++ if (!xe_sched_invalidate_job(job, 2)) {
++ clear_exec_queue_banned(q);
++ xe_gt_reset_async(q->gt);
++ goto rearm;
++ }
++ if (q->flags & EXEC_QUEUE_FLAG_KERNEL) {
++ xe_gt_WARN(q->gt, true, "Kernel-submitted job timed out\n");
++ xe_device_declare_wedged(gt_to_xe(q->gt));
++ }
++ } else if (q->flags & EXEC_QUEUE_FLAG_VM && !exec_queue_killed(q)) {
++ xe_gt_WARN(q->gt, true, "VM job timed out on non-killed execqueue\n");
+ }
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 353738b1f3f334caab4fb2774e3b29e12149aee5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jun 2026 10:27:05 -0700
+Subject: drm/xe: fix refcount leak in xe_range_fence_insert()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit ba36786b21d19082e696eda85bfcd49e7071944a ]
+
+xe_range_fence_insert() acquires a reference on fence via
+dma_fence_get() and stores it in rfence->fence. It then calls
+dma_fence_add_callback() and handles two cases: when the callback
+is successfully registered (err == 0) the fence is transferred to
+the tree for later cleanup; when the fence is already signaled
+(err == -ENOENT) it manually drops the extra reference with
+dma_fence_put(fence).
+
+However, dma_fence_add_callback() can fail with other errors
+(e.g. -EINVAL) and in that case the code falls through to the free:
+label without releasing the acquired reference, leaking it.
+
+Fix the leak by adding an else branch that calls dma_fence_put()
+before jumping to free: for any error other than -ENOENT.
+
+Fixes: 845f64bdbfc9 ("drm/xe: Introduce a range-fence utility")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20260610172705.3450560-1-matthew.brost@intel.com
+(cherry picked from commit 98c4a4201290823c2c5c7ba21692bd9a64b61021)
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_range_fence.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_range_fence.c b/drivers/gpu/drm/xe/xe_range_fence.c
+index 372378e89e9892..3d8fa194a7b0eb 100644
+--- a/drivers/gpu/drm/xe/xe_range_fence.c
++++ b/drivers/gpu/drm/xe/xe_range_fence.c
+@@ -77,6 +77,8 @@ int xe_range_fence_insert(struct xe_range_fence_tree *tree,
+ } else if (err == 0) {
+ xe_range_fence_tree_insert(rfence, &tree->root);
+ return 0;
++ } else {
++ dma_fence_put(fence);
+ }
+
+ free:
+--
+2.53.0
+
net-txgbe-initialize-phy-interface-to-0.patch
ipv6-fix-a-potential-npd-in-cleanup_prefix_route.patch
asoc-sdca-fix-null-pointer-dereference-in-sdca_dev_u.patch
+clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch
+clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch
+clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch
+drm-i915-edp-check-supported-link-rates-dpcd-read.patch
+drm-virtio-fix-driver-removal-with-disabled-kms.patch
+drm-vc4-fix-krealloc-memory-leak.patch
+drm-colorop-remove-read-only-comments-from-interpola.patch
+drm-colorop-make-lut-1-3-d_interpolation-props-corre.patch
+drm-atomic-track-individual-colorop-updates.patch
+drm-amd-display-use-plane-color_mgmt_changed-to-trac.patch
+drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch
+drm-xe-fix-job-timeout-recovery-for-unstarted-jobs-a.patch
+accel-amdxdna-fix-mm_struct-reference-leak-in-aie2_p.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
