From: Greg Kroah-Hartman Date: Mon, 15 Jun 2026 16:14:24 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1bbd74ddad6d005f714657669a0de1a7054ae209;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: drm-amd-display-clamp-hdmi-hdcp2-rx_id_list-read-to-buffer-size.patch drm-amd-display-clamp-vbios-hdmi-retimer-register-count-to-array-size.patch drm-amd-display-fix-null-deref-and-buffer-over-read-in-sdp-debugfs.patch drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch --- diff --git a/queue-5.15/drm-amd-display-clamp-hdmi-hdcp2-rx_id_list-read-to-buffer-size.patch b/queue-5.15/drm-amd-display-clamp-hdmi-hdcp2-rx_id_list-read-to-buffer-size.patch new file mode 100644 index 0000000000..4ba247d16f --- /dev/null +++ b/queue-5.15/drm-amd-display-clamp-hdmi-hdcp2-rx_id_list-read-to-buffer-size.patch @@ -0,0 +1,47 @@ +From f0f3981c43b32cadfe373d636d9e9ca522bb3702 Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Thu, 7 May 2026 15:38:37 -0400 +Subject: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size + +From: Harry Wentland + +commit f0f3981c43b32cadfe373d636d9e9ca522bb3702 upstream. + +[Why & How] +During HDCP 2.x repeater authentication over HDMI, the driver reads the +sink's RxStatus register and extracts a 10-bit message size field (max +value 1023). This value is used as the read length for the ReceiverID +list without being clamped to the size of the destination buffer +rx_id_list[177]. A malicious HDMI repeater could advertise a message +size larger than the buffer, causing an out-of-bounds write during the +I2C read. + +Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the +rx_id_list buffer, matching the approach already used in the DP branch. + +Fixes: eff682f83c9c ("drm/amd/display: Add DDC handles for HDCP2.2") +Assisted-by: Copilot:claude-opus-4.6 +Reviewed-by: Alex Hung +Signed-off-by: Harry Wentland +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c ++++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +@@ -533,7 +533,8 @@ enum mod_hdcp_status mod_hdcp_read_rx_id + } else { + status = read(hdcp, MOD_HDCP_MESSAGE_ID_READ_REPEATER_AUTH_SEND_RECEIVERID_LIST, + hdcp->auth.msg.hdcp2.rx_id_list, +- hdcp->auth.msg.hdcp2.rx_id_list_size); ++ MIN(hdcp->auth.msg.hdcp2.rx_id_list_size, ++ sizeof(hdcp->auth.msg.hdcp2.rx_id_list))); + } + return status; + } diff --git a/queue-5.15/drm-amd-display-clamp-vbios-hdmi-retimer-register-count-to-array-size.patch b/queue-5.15/drm-amd-display-clamp-vbios-hdmi-retimer-register-count-to-array-size.patch new file mode 100644 index 0000000000..1b637b5546 --- /dev/null +++ b/queue-5.15/drm-amd-display-clamp-vbios-hdmi-retimer-register-count-to-array-size.patch @@ -0,0 +1,188 @@ +From fb0707ce00eef4e2d60c3020e1c0432739703e4a Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Mon, 4 May 2026 15:51:13 -0400 +Subject: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size + +From: Harry Wentland + +commit fb0707ce00eef4e2d60c3020e1c0432739703e4a upstream. + +[Why & How] +The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and +Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C +register settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9] +and dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated +before use, so a malformed VBIOS can specify values up to 255, causing an +out-of-bounds heap write during driver probe. + +Clamp each register count to the destination array size using min_t() +before the copy loops, in both get_integrated_info_v11() and +get_integrated_info_v2_1(). + +Assisted-by: GitHub Copilot:claude-opus-4.6 +Reviewed-by: Alex Hung +Signed-off-by: Harry Wentland +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 48 ++++++++++++++------- + 1 file changed, 32 insertions(+), 16 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +@@ -1858,14 +1858,16 @@ static enum bp_result get_integrated_inf + info_v11->extdispconninfo.checksum; + + info->dp0_ext_hdmi_slv_addr = info_v11->dp0_retimer_set.HdmiSlvAddr; +- info->dp0_ext_hdmi_reg_num = info_v11->dp0_retimer_set.HdmiRegNum; ++ info->dp0_ext_hdmi_reg_num = min_t(u8, info_v11->dp0_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp0_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp0_ext_hdmi_reg_num; i++) { + info->dp0_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v11->dp0_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp0_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v11->dp0_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp0_ext_hdmi_6g_reg_num = info_v11->dp0_retimer_set.Hdmi6GRegNum; ++ info->dp0_ext_hdmi_6g_reg_num = min_t(u8, info_v11->dp0_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp0_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp0_ext_hdmi_6g_reg_num; i++) { + info->dp0_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v11->dp0_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -1874,14 +1876,16 @@ static enum bp_result get_integrated_inf + } + + info->dp1_ext_hdmi_slv_addr = info_v11->dp1_retimer_set.HdmiSlvAddr; +- info->dp1_ext_hdmi_reg_num = info_v11->dp1_retimer_set.HdmiRegNum; ++ info->dp1_ext_hdmi_reg_num = min_t(u8, info_v11->dp1_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp1_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp1_ext_hdmi_reg_num; i++) { + info->dp1_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v11->dp1_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp1_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v11->dp1_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp1_ext_hdmi_6g_reg_num = info_v11->dp1_retimer_set.Hdmi6GRegNum; ++ info->dp1_ext_hdmi_6g_reg_num = min_t(u8, info_v11->dp1_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp1_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp1_ext_hdmi_6g_reg_num; i++) { + info->dp1_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v11->dp1_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -1890,14 +1894,16 @@ static enum bp_result get_integrated_inf + } + + info->dp2_ext_hdmi_slv_addr = info_v11->dp2_retimer_set.HdmiSlvAddr; +- info->dp2_ext_hdmi_reg_num = info_v11->dp2_retimer_set.HdmiRegNum; ++ info->dp2_ext_hdmi_reg_num = min_t(u8, info_v11->dp2_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp2_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp2_ext_hdmi_reg_num; i++) { + info->dp2_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v11->dp2_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp2_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v11->dp2_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp2_ext_hdmi_6g_reg_num = info_v11->dp2_retimer_set.Hdmi6GRegNum; ++ info->dp2_ext_hdmi_6g_reg_num = min_t(u8, info_v11->dp2_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp2_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp2_ext_hdmi_6g_reg_num; i++) { + info->dp2_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v11->dp2_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -1906,14 +1912,16 @@ static enum bp_result get_integrated_inf + } + + info->dp3_ext_hdmi_slv_addr = info_v11->dp3_retimer_set.HdmiSlvAddr; +- info->dp3_ext_hdmi_reg_num = info_v11->dp3_retimer_set.HdmiRegNum; ++ info->dp3_ext_hdmi_reg_num = min_t(u8, info_v11->dp3_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp3_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp3_ext_hdmi_reg_num; i++) { + info->dp3_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v11->dp3_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp3_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v11->dp3_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp3_ext_hdmi_6g_reg_num = info_v11->dp3_retimer_set.Hdmi6GRegNum; ++ info->dp3_ext_hdmi_6g_reg_num = min_t(u8, info_v11->dp3_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp3_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp3_ext_hdmi_6g_reg_num; i++) { + info->dp3_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v11->dp3_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -2061,14 +2069,16 @@ static enum bp_result get_integrated_inf + info->ext_disp_conn_info.checksum = + info_v2_1->extdispconninfo.checksum; + info->dp0_ext_hdmi_slv_addr = info_v2_1->dp0_retimer_set.HdmiSlvAddr; +- info->dp0_ext_hdmi_reg_num = info_v2_1->dp0_retimer_set.HdmiRegNum; ++ info->dp0_ext_hdmi_reg_num = min_t(u8, info_v2_1->dp0_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp0_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp0_ext_hdmi_reg_num; i++) { + info->dp0_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v2_1->dp0_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp0_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v2_1->dp0_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp0_ext_hdmi_6g_reg_num = info_v2_1->dp0_retimer_set.Hdmi6GRegNum; ++ info->dp0_ext_hdmi_6g_reg_num = min_t(u8, info_v2_1->dp0_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp0_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp0_ext_hdmi_6g_reg_num; i++) { + info->dp0_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v2_1->dp0_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -2076,14 +2086,16 @@ static enum bp_result get_integrated_inf + info_v2_1->dp0_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegVal; + } + info->dp1_ext_hdmi_slv_addr = info_v2_1->dp1_retimer_set.HdmiSlvAddr; +- info->dp1_ext_hdmi_reg_num = info_v2_1->dp1_retimer_set.HdmiRegNum; ++ info->dp1_ext_hdmi_reg_num = min_t(u8, info_v2_1->dp1_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp1_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp1_ext_hdmi_reg_num; i++) { + info->dp1_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v2_1->dp1_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp1_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v2_1->dp1_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp1_ext_hdmi_6g_reg_num = info_v2_1->dp1_retimer_set.Hdmi6GRegNum; ++ info->dp1_ext_hdmi_6g_reg_num = min_t(u8, info_v2_1->dp1_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp1_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp1_ext_hdmi_6g_reg_num; i++) { + info->dp1_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v2_1->dp1_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -2091,14 +2103,16 @@ static enum bp_result get_integrated_inf + info_v2_1->dp1_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegVal; + } + info->dp2_ext_hdmi_slv_addr = info_v2_1->dp2_retimer_set.HdmiSlvAddr; +- info->dp2_ext_hdmi_reg_num = info_v2_1->dp2_retimer_set.HdmiRegNum; ++ info->dp2_ext_hdmi_reg_num = min_t(u8, info_v2_1->dp2_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp2_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp2_ext_hdmi_reg_num; i++) { + info->dp2_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v2_1->dp2_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp2_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v2_1->dp2_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp2_ext_hdmi_6g_reg_num = info_v2_1->dp2_retimer_set.Hdmi6GRegNum; ++ info->dp2_ext_hdmi_6g_reg_num = min_t(u8, info_v2_1->dp2_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp2_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp2_ext_hdmi_6g_reg_num; i++) { + info->dp2_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v2_1->dp2_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -2106,14 +2120,16 @@ static enum bp_result get_integrated_inf + info_v2_1->dp2_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegVal; + } + info->dp3_ext_hdmi_slv_addr = info_v2_1->dp3_retimer_set.HdmiSlvAddr; +- info->dp3_ext_hdmi_reg_num = info_v2_1->dp3_retimer_set.HdmiRegNum; ++ info->dp3_ext_hdmi_reg_num = min_t(u8, info_v2_1->dp3_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp3_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp3_ext_hdmi_reg_num; i++) { + info->dp3_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v2_1->dp3_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp3_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v2_1->dp3_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp3_ext_hdmi_6g_reg_num = info_v2_1->dp3_retimer_set.Hdmi6GRegNum; ++ info->dp3_ext_hdmi_6g_reg_num = min_t(u8, info_v2_1->dp3_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp3_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp3_ext_hdmi_6g_reg_num; i++) { + info->dp3_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v2_1->dp3_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; diff --git a/queue-5.15/drm-amd-display-fix-null-deref-and-buffer-over-read-in-sdp-debugfs.patch b/queue-5.15/drm-amd-display-fix-null-deref-and-buffer-over-read-in-sdp-debugfs.patch new file mode 100644 index 0000000000..70337ccfb6 --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-null-deref-and-buffer-over-read-in-sdp-debugfs.patch @@ -0,0 +1,53 @@ +From adf67034b1f61f7119295208085bfd43f85f56af Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Mon, 11 May 2026 16:46:25 -0400 +Subject: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs + +From: Harry Wentland + +commit adf67034b1f61f7119295208085bfd43f85f56af upstream. + +[Why & How] +dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc +without checking for NULL. A connector can be connected but not bound to +any CRTC (e.g. after hot-plug before the next atomic commit), causing a +kernel crash when writing to the sdp_message debugfs node. + +The function also ignores the user-provided size argument and always +passes 36 bytes to copy_from_user(), reading past the user buffer when +size < 36. + +Fix both issues by: +- Returning -ENODEV when connector->base.state or state->crtc is NULL +- Clamping write_size to min(size, sizeof(data)) + +Fixes: c7ba3653e977 ("drm/amd/display: Generic SDP message access in amdgpu") +Assisted-by: Copilot:claude-opus-4.6 +Reviewed-by: Alex Hung +Signed-off-by: Harry Wentland +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +@@ -1016,8 +1016,13 @@ static ssize_t dp_sdp_message_debugfs_wr + if (size == 0) + return 0; + ++ if (!connector->base.state || !connector->base.state->crtc) ++ return -ENODEV; ++ + acrtc_state = to_dm_crtc_state(connector->base.state->crtc->state); + ++ write_size = min_t(size_t, size, sizeof(data)); ++ + r = copy_from_user(data, buf, write_size); + + write_size -= r; diff --git a/queue-5.15/drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch b/queue-5.15/drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch new file mode 100644 index 0000000000..04596cfe53 --- /dev/null +++ b/queue-5.15/drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch @@ -0,0 +1,46 @@ +From da48bc4461b8a5ebfb9264c9b191a701d8e99009 Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Tue, 5 May 2026 11:52:15 -0400 +Subject: drm/amd/display: Use krealloc_array() in dal_vector_reserve() + +From: Harry Wentland + +commit da48bc4461b8a5ebfb9264c9b191a701d8e99009 upstream. + +[Why & How] +dal_vector_reserve() computes the allocation size as +"capacity * vector->struct_size" using uint32_t arithmetic, which can +silently wrap to a small value on overflow. This would cause krealloc to +return a smaller buffer than expected, leading to heap overflows on +subsequent vector appends. + +Replace krealloc() with krealloc_array() which performs an internal +overflow check and returns NULL on wrap, preventing the issue. + +Fixes: 2004f45ef83f ("drm/amd/display: Use kernel alloc/free") +Assisted-by: Copilot:claude-opus-4.6 +Reviewed-by: Alex Hung +Signed-off-by: Harry Wentland +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/basics/vector.c ++++ b/drivers/gpu/drm/amd/display/dc/basics/vector.c +@@ -291,8 +291,8 @@ bool dal_vector_reserve(struct vector *v + if (capacity <= vector->capacity) + return true; + +- new_container = krealloc(vector->container, +- capacity * vector->struct_size, GFP_KERNEL); ++ new_container = krealloc_array(vector->container, ++ capacity, vector->struct_size, GFP_KERNEL); + + if (new_container) { + vector->container = new_container; diff --git a/queue-5.15/series b/queue-5.15/series index 7536871655..9fe3b00345 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -239,3 +239,7 @@ thunderbolt-bound-root-directory-content-to-block-size.patch thunderbolt-clamp-xdomain-response-data-copy-to-allocation-size.patch thunderbolt-limit-xdomain-response-copy-to-actual-frame-size.patch slimbus-qcom-ngd-ctrl-avoid-abba-on-tx_lock-ctrl-lock.patch +drm-amd-display-clamp-hdmi-hdcp2-rx_id_list-read-to-buffer-size.patch +drm-amd-display-clamp-vbios-hdmi-retimer-register-count-to-array-size.patch +drm-amd-display-fix-null-deref-and-buffer-over-read-in-sdp-debugfs.patch +drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch