From: Sasha Levin Date: Sun, 14 Jun 2026 16:24:34 +0000 (-0400) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=43ba8e1c0cabec8963293b12092cd9c2c8cdd48f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/drm-vc4-fix-krealloc-memory-leak.patch b/queue-5.15/drm-vc4-fix-krealloc-memory-leak.patch new file mode 100644 index 0000000000..c5413f0361 --- /dev/null +++ b/queue-5.15/drm-vc4-fix-krealloc-memory-leak.patch @@ -0,0 +1,67 @@ +From 11020c11e30d6f8962bc3050662630a42904365b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jun 2026 14:38:10 +0200 +Subject: drm/vc4: fix krealloc() memory leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander A. Klimov + +[ Upstream commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b ] + +Don't just overwrite the original pointer passed to krealloc() +with its return value without checking latter: + + MEM = krealloc(MEM, SZ, GFP); + +If krealloc() returns NULL, that erases the pointer +to the still allocated memory, hence leaks this memory. +Instead, use a temporary variable, check it's not NULL +and only then assign it to the original pointer: + + TMP = krealloc(MEM, SZ, GFP); + if (!TMP) return; + MEM = TMP; + +While on it, use krealloc_array(). + +Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.") +Signed-off-by: Alexander A. Klimov +Signed-off-by: Maíra Canal +Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +index 7cf82b071de290..82543a23ec0638 100644 +--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c ++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +@@ -288,15 +288,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va + { + uint32_t o = validated_shader->num_uniform_addr_offsets; + uint32_t num_uniforms = validated_shader->uniforms_size / 4; ++ u32 *offsets; + +- validated_shader->uniform_addr_offsets = +- krealloc(validated_shader->uniform_addr_offsets, +- (o + 1) * +- sizeof(*validated_shader->uniform_addr_offsets), +- GFP_KERNEL); +- if (!validated_shader->uniform_addr_offsets) ++ offsets = krealloc_array(validated_shader->uniform_addr_offsets, ++ o + 1, ++ sizeof(*validated_shader->uniform_addr_offsets), ++ GFP_KERNEL); ++ if (!offsets) + return false; + ++ validated_shader->uniform_addr_offsets = offsets; + validated_shader->uniform_addr_offsets[o] = num_uniforms; + validated_shader->num_uniform_addr_offsets++; + +-- +2.53.0 + diff --git a/queue-5.15/series b/queue-5.15/series index bef20d9655..94674b2c8e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -197,3 +197,4 @@ net-mvpp2-limit-xdp-frame-size-to-the-rx-buffer.patch net-mvpp2-add-metadata-support-for-xdp-mode.patch net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch +drm-vc4-fix-krealloc-memory-leak.patch diff --git a/queue-6.1/drm-vc4-fix-krealloc-memory-leak.patch b/queue-6.1/drm-vc4-fix-krealloc-memory-leak.patch new file mode 100644 index 0000000000..0c74a024b8 --- /dev/null +++ b/queue-6.1/drm-vc4-fix-krealloc-memory-leak.patch @@ -0,0 +1,67 @@ +From a9e1aa25b8336098b4b2e7158c7987cd811bc227 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jun 2026 14:38:10 +0200 +Subject: drm/vc4: fix krealloc() memory leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander A. Klimov + +[ Upstream commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b ] + +Don't just overwrite the original pointer passed to krealloc() +with its return value without checking latter: + + MEM = krealloc(MEM, SZ, GFP); + +If krealloc() returns NULL, that erases the pointer +to the still allocated memory, hence leaks this memory. +Instead, use a temporary variable, check it's not NULL +and only then assign it to the original pointer: + + TMP = krealloc(MEM, SZ, GFP); + if (!TMP) return; + MEM = TMP; + +While on it, use krealloc_array(). + +Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.") +Signed-off-by: Alexander A. Klimov +Signed-off-by: Maíra Canal +Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +index 9745f8810eca6d..c2c6767ae55862 100644 +--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c ++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +@@ -288,15 +288,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va + { + uint32_t o = validated_shader->num_uniform_addr_offsets; + uint32_t num_uniforms = validated_shader->uniforms_size / 4; ++ u32 *offsets; + +- validated_shader->uniform_addr_offsets = +- krealloc(validated_shader->uniform_addr_offsets, +- (o + 1) * +- sizeof(*validated_shader->uniform_addr_offsets), +- GFP_KERNEL); +- if (!validated_shader->uniform_addr_offsets) ++ offsets = krealloc_array(validated_shader->uniform_addr_offsets, ++ o + 1, ++ sizeof(*validated_shader->uniform_addr_offsets), ++ GFP_KERNEL); ++ if (!offsets) + return false; + ++ validated_shader->uniform_addr_offsets = offsets; + validated_shader->uniform_addr_offsets[o] = num_uniforms; + validated_shader->num_uniform_addr_offsets++; + +-- +2.53.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 28392a84ce..0dc0c5a8ed 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -262,3 +262,4 @@ net-mvpp2-add-metadata-support-for-xdp-mode.patch net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch netfilter-ctnetlink-ensure-safe-access-to-master-con.patch +drm-vc4-fix-krealloc-memory-leak.patch diff --git a/queue-6.12/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch b/queue-6.12/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch new file mode 100644 index 0000000000..8310e3a50b --- /dev/null +++ b/queue-6.12/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch @@ -0,0 +1,52 @@ +From 4bd22aac8c593d4561b5c0b2ba6b2bc04fdf6805 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2026 23:01:51 +0800 +Subject: clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration + time +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pengyu Luo + +[ Upstream commit 5285b046757844435d1db96c1b5c3a6621b2979a ] + +Parking disp{0,1}_cc_mdss_mdp_clk_src clk broke simplefb on HUAWEI +Gaokun3, the image will stuck at grey for seconds until msm takes +over framebuffer. Use clk_rcg2_shared_no_init_park_ops to skip it. + +Signed-off-by: Pengyu Luo +Tested-by: Jérôme de Bretagne +Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") +Link: https://lore.kernel.org/r/20260303150152.90685-1-mitltlatltl@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-sc8280xp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-sc8280xp.c b/drivers/clk/qcom/dispcc-sc8280xp.c +index c23cbb983d29ea..43d26616bd27bd 100644 +--- a/drivers/clk/qcom/dispcc-sc8280xp.c ++++ b/drivers/clk/qcom/dispcc-sc8280xp.c +@@ -978,7 +978,7 @@ static struct clk_rcg2 disp0_cc_mdss_mdp_clk_src = { + .name = "disp0_cc_mdss_mdp_clk_src", + .parent_data = disp0_cc_parent_data_5, + .num_parents = ARRAY_SIZE(disp0_cc_parent_data_5), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_shared_no_init_park_ops, + }, + }; + +@@ -992,7 +992,7 @@ static struct clk_rcg2 disp1_cc_mdss_mdp_clk_src = { + .name = "disp1_cc_mdss_mdp_clk_src", + .parent_data = disp1_cc_parent_data_5, + .num_parents = ARRAY_SIZE(disp1_cc_parent_data_5), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_shared_no_init_park_ops, + }, + }; + +-- +2.53.0 + diff --git a/queue-6.12/clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch b/queue-6.12/clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch new file mode 100644 index 0000000000..49941b5a8a --- /dev/null +++ b/queue-6.12/clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch @@ -0,0 +1,45 @@ +From bbbdecb73e02a14e6587b55e2864c20a18a97585 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Apr 2026 14:33:51 +0200 +Subject: clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from + getting parked + +From: Hans de Goede + +[ Upstream commit bc27dbefae6ed11376d991a2921eff806ffef67c ] + +Parking disp_cc_mdss_mdp_clk_src at 19.2MHz causing the EFI GOP framebuffer +to stop functioning. The EFI GOP framebuffer should keep working until +the msm display driver loads, to help with boot debugging and to ensure +display output when the msm module is not in the initramfs. + +Switch disp_cc_mdss_mdp_clk_src over to clk_rcg2_shared_no_init_park_ops +to keep the EFI GOP working after binding the x1e80100-dispcc driver. + +Suggested-by: Dmitry Baryshkov +Signed-off-by: Hans de Goede +Reviewed-by: Dmitry Baryshkov +Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") +Link: https://lore.kernel.org/r/20260425123351.6292-1-johannes.goede@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-x1e80100.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/dispcc-x1e80100.c b/drivers/clk/qcom/dispcc-x1e80100.c +index 40069eba41f241..5c00a0f8448931 100644 +--- a/drivers/clk/qcom/dispcc-x1e80100.c ++++ b/drivers/clk/qcom/dispcc-x1e80100.c +@@ -580,7 +580,7 @@ static struct clk_rcg2 disp_cc_mdss_mdp_clk_src = { + .parent_data = disp_cc_parent_data_6, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_6), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_shared_no_init_park_ops, + }, + }; + +-- +2.53.0 + diff --git a/queue-6.12/clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch b/queue-6.12/clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch new file mode 100644 index 0000000000..1d1bcd14db --- /dev/null +++ b/queue-6.12/clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch @@ -0,0 +1,47 @@ +From 3b54953048de83057c7dc690eff912a49cf76955 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 May 2026 17:14:57 +0000 +Subject: clk: samsung: gs101: Fix missing USI7_USI DIV clock in + peric0_clk_regs + +From: Kuan-Wei Chiu + +[ Upstream commit 78ee734b36284d82454e87a92094fdb926985b47 ] + +In the peric0_clk_regs array, the divider register offset for USI6 was +accidentally listed twice, while the divider for USI7 was omitted. + +Missing this DIV register causes the USI7 clock divider setting to be +lost and reset to its hardware default value during a suspend/resume +cycle. + +Replace the duplicated USI6 DIV entry with the correct USI7 DIV +register. + +Fixes: 893f133a040b ("clk: samsung: gs101: add support for cmu_peric0") +Signed-off-by: Kuan-Wei Chiu +Reviewed-by: Peter Griffin +Reviewed-by: Tudor Ambarus +Link: https://patch.msgid.link/20260505171457.1960837-1-visitorckw@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-gs101.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/samsung/clk-gs101.c b/drivers/clk/samsung/clk-gs101.c +index fa628fab28ac4e..7cc6a1173d44fb 100644 +--- a/drivers/clk/samsung/clk-gs101.c ++++ b/drivers/clk/samsung/clk-gs101.c +@@ -3602,7 +3602,7 @@ static const unsigned long peric0_clk_regs[] __initconst = { + CLK_CON_DIV_DIV_CLK_PERIC0_USI4_USI, + CLK_CON_DIV_DIV_CLK_PERIC0_USI5_USI, + CLK_CON_DIV_DIV_CLK_PERIC0_USI6_USI, +- CLK_CON_DIV_DIV_CLK_PERIC0_USI6_USI, ++ CLK_CON_DIV_DIV_CLK_PERIC0_USI7_USI, + CLK_CON_DIV_DIV_CLK_PERIC0_USI8_USI, + CLK_CON_BUF_CLKBUF_PERIC0_IP, + CLK_CON_GAT_CLK_BLK_PERIC0_UID_PERIC0_CMU_PERIC0_IPCLKPORT_PCLK, +-- +2.53.0 + diff --git a/queue-6.12/drm-vc4-fix-krealloc-memory-leak.patch b/queue-6.12/drm-vc4-fix-krealloc-memory-leak.patch new file mode 100644 index 0000000000..aae38c93f7 --- /dev/null +++ b/queue-6.12/drm-vc4-fix-krealloc-memory-leak.patch @@ -0,0 +1,67 @@ +From 11f87838f0276479725b5bb3abb4ecb7dd6c2d5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jun 2026 14:38:10 +0200 +Subject: drm/vc4: fix krealloc() memory leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander A. Klimov + +[ Upstream commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b ] + +Don't just overwrite the original pointer passed to krealloc() +with its return value without checking latter: + + MEM = krealloc(MEM, SZ, GFP); + +If krealloc() returns NULL, that erases the pointer +to the still allocated memory, hence leaks this memory. +Instead, use a temporary variable, check it's not NULL +and only then assign it to the original pointer: + + TMP = krealloc(MEM, SZ, GFP); + if (!TMP) return; + MEM = TMP; + +While on it, use krealloc_array(). + +Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.") +Signed-off-by: Alexander A. Klimov +Signed-off-by: Maíra Canal +Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +index afb1a4d8268465..792e2d90aecf10 100644 +--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c ++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +@@ -288,15 +288,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va + { + uint32_t o = validated_shader->num_uniform_addr_offsets; + uint32_t num_uniforms = validated_shader->uniforms_size / 4; ++ u32 *offsets; + +- validated_shader->uniform_addr_offsets = +- krealloc(validated_shader->uniform_addr_offsets, +- (o + 1) * +- sizeof(*validated_shader->uniform_addr_offsets), +- GFP_KERNEL); +- if (!validated_shader->uniform_addr_offsets) ++ offsets = krealloc_array(validated_shader->uniform_addr_offsets, ++ o + 1, ++ sizeof(*validated_shader->uniform_addr_offsets), ++ GFP_KERNEL); ++ if (!offsets) + return false; + ++ validated_shader->uniform_addr_offsets = offsets; + validated_shader->uniform_addr_offsets[o] = num_uniforms; + validated_shader->num_uniform_addr_offsets++; + +-- +2.53.0 + diff --git a/queue-6.12/drm-virtio-fix-driver-removal-with-disabled-kms.patch b/queue-6.12/drm-virtio-fix-driver-removal-with-disabled-kms.patch new file mode 100644 index 0000000000..3c2f2d4973 --- /dev/null +++ b/queue-6.12/drm-virtio-fix-driver-removal-with-disabled-kms.patch @@ -0,0 +1,43 @@ +From 73b2271da6d2ac09a787005013db16832a0dfcf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jun 2026 15:27:43 +0300 +Subject: drm/virtio: Fix driver removal with disabled KMS + +From: Dmitry Osipenko + +[ Upstream commit f329e8325e054bd6d84d10904f8dd51137281b92 ] + +DRM atomic and modesetting aren't initialized if virtio-gpu driver built +with disabled KMS, leading to access of uninitialized data on driver +removal/unbinding and crashing kernel. Fix it by skipping shutting down +atomic core with unavailable KMS. + +Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support") +Signed-off-by: Dmitry Osipenko +Tested-by: Ryosuke Yasuoka +Reviewed-by: Ryosuke Yasuoka +Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/virtio/virtgpu_drv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c +index e5a2665e50eac4..44d99e89bb9b65 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_drv.c ++++ b/drivers/gpu/drm/virtio/virtgpu_drv.c +@@ -118,7 +118,10 @@ static void virtio_gpu_remove(struct virtio_device *vdev) + struct drm_device *dev = vdev->priv; + + drm_dev_unplug(dev); +- drm_atomic_helper_shutdown(dev); ++ ++ if (drm_core_check_feature(dev, DRIVER_ATOMIC)) ++ drm_atomic_helper_shutdown(dev); ++ + virtio_gpu_deinit(dev); + drm_dev_put(dev); + } +-- +2.53.0 + diff --git a/queue-6.12/drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch b/queue-6.12/drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch new file mode 100644 index 0000000000..ddeb238fea --- /dev/null +++ b/queue-6.12/drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch @@ -0,0 +1,52 @@ +From be61c33eb89ccca14309b323aeb9fe22d5cfb4c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jun 2026 10:27:05 -0700 +Subject: drm/xe: fix refcount leak in xe_range_fence_insert() + +From: Wentao Liang + +[ Upstream commit ba36786b21d19082e696eda85bfcd49e7071944a ] + +xe_range_fence_insert() acquires a reference on fence via +dma_fence_get() and stores it in rfence->fence. It then calls +dma_fence_add_callback() and handles two cases: when the callback +is successfully registered (err == 0) the fence is transferred to +the tree for later cleanup; when the fence is already signaled +(err == -ENOENT) it manually drops the extra reference with +dma_fence_put(fence). + +However, dma_fence_add_callback() can fail with other errors +(e.g. -EINVAL) and in that case the code falls through to the free: +label without releasing the acquired reference, leaking it. + +Fix the leak by adding an else branch that calls dma_fence_put() +before jumping to free: for any error other than -ENOENT. + +Fixes: 845f64bdbfc9 ("drm/xe: Introduce a range-fence utility") +Signed-off-by: Wentao Liang +Reviewed-by: Matthew Brost +Signed-off-by: Matthew Brost +Link: https://patch.msgid.link/20260610172705.3450560-1-matthew.brost@intel.com +(cherry picked from commit 98c4a4201290823c2c5c7ba21692bd9a64b61021) +Signed-off-by: Matthew Brost +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_range_fence.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/xe/xe_range_fence.c b/drivers/gpu/drm/xe/xe_range_fence.c +index 372378e89e9892..3d8fa194a7b0eb 100644 +--- a/drivers/gpu/drm/xe/xe_range_fence.c ++++ b/drivers/gpu/drm/xe/xe_range_fence.c +@@ -77,6 +77,8 @@ int xe_range_fence_insert(struct xe_range_fence_tree *tree, + } else if (err == 0) { + xe_range_fence_tree_insert(rfence, &tree->root); + return 0; ++ } else { ++ dma_fence_put(fence); + } + + free: +-- +2.53.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 146cd6f37f..b55217e52c 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -110,3 +110,9 @@ writeback-fix-use-after-free-in-inode_switch_wbs_wor.patch xfrm-hold-device-only-for-the-asynchronous-decryptio.patch xfrm-hold-dev-ref-until-after-transport_finish-nf_ho.patch kvm-vmx-update-svi-during-runtime-apicv-activation.patch +clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch +clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch +clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch +drm-virtio-fix-driver-removal-with-disabled-kms.patch +drm-vc4-fix-krealloc-memory-leak.patch +drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch diff --git a/queue-6.18/accel-amdxdna-fix-mm_struct-reference-leak-in-aie2_p.patch b/queue-6.18/accel-amdxdna-fix-mm_struct-reference-leak-in-aie2_p.patch new file mode 100644 index 0000000000..4dd84cd150 --- /dev/null +++ b/queue-6.18/accel-amdxdna-fix-mm_struct-reference-leak-in-aie2_p.patch @@ -0,0 +1,52 @@ +From d72290a8cfffb9a5d4c65ba6edb697b6e7c9ef45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jun 2026 08:11:27 -0700 +Subject: accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() + +From: Lizhi Hou + +[ Upstream commit 2f41af638c92bac6f1f9275ea2d1901baef578f3 ] + +aie2_populate_range() jumps back to the again label without calling +mmput(mm), leaking a reference to the mm_struct. + +Add the missing mmput() before jumping to again. + +Fixes: e486147c912f ("accel/amdxdna: Add BO import and export") +Reviewed-by: Mario Limonciello (AMD) +Signed-off-by: Lizhi Hou +Link: https://patch.msgid.link/20260610151127.2994185-1-lizhi.hou@amd.com +Signed-off-by: Sasha Levin +--- + drivers/accel/amdxdna/aie2_ctx.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c +index 4610f491f0881c..80de2906a26fcb 100644 +--- a/drivers/accel/amdxdna/aie2_ctx.c ++++ b/drivers/accel/amdxdna/aie2_ctx.c +@@ -828,6 +828,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo) + + if (ret == -EBUSY) { + amdxdna_umap_put(mapp); ++ mmput(mm); + goto again; + } + +@@ -838,11 +839,13 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo) + if (mmu_interval_read_retry(&mapp->notifier, mapp->range.notifier_seq)) { + up_write(&xdna->notifier_lock); + amdxdna_umap_put(mapp); ++ mmput(mm); + goto again; + } + mapp->invalid = false; + up_write(&xdna->notifier_lock); + amdxdna_umap_put(mapp); ++ mmput(mm); + goto again; + + put_mm: +-- +2.53.0 + diff --git a/queue-6.18/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch b/queue-6.18/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch new file mode 100644 index 0000000000..c5ea08b2f3 --- /dev/null +++ b/queue-6.18/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch @@ -0,0 +1,52 @@ +From aaf55ed73ae88c751bf9868f16ae4e9a6aa7c7fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2026 23:01:51 +0800 +Subject: clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration + time +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pengyu Luo + +[ Upstream commit 5285b046757844435d1db96c1b5c3a6621b2979a ] + +Parking disp{0,1}_cc_mdss_mdp_clk_src clk broke simplefb on HUAWEI +Gaokun3, the image will stuck at grey for seconds until msm takes +over framebuffer. Use clk_rcg2_shared_no_init_park_ops to skip it. + +Signed-off-by: Pengyu Luo +Tested-by: Jérôme de Bretagne +Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") +Link: https://lore.kernel.org/r/20260303150152.90685-1-mitltlatltl@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-sc8280xp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-sc8280xp.c b/drivers/clk/qcom/dispcc-sc8280xp.c +index e91dfed0f37e9b..acc927c2142ab5 100644 +--- a/drivers/clk/qcom/dispcc-sc8280xp.c ++++ b/drivers/clk/qcom/dispcc-sc8280xp.c +@@ -977,7 +977,7 @@ static struct clk_rcg2 disp0_cc_mdss_mdp_clk_src = { + .name = "disp0_cc_mdss_mdp_clk_src", + .parent_data = disp0_cc_parent_data_5, + .num_parents = ARRAY_SIZE(disp0_cc_parent_data_5), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_shared_no_init_park_ops, + }, + }; + +@@ -991,7 +991,7 @@ static struct clk_rcg2 disp1_cc_mdss_mdp_clk_src = { + .name = "disp1_cc_mdss_mdp_clk_src", + .parent_data = disp1_cc_parent_data_5, + .num_parents = ARRAY_SIZE(disp1_cc_parent_data_5), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_shared_no_init_park_ops, + }, + }; + +-- +2.53.0 + diff --git a/queue-6.18/clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch b/queue-6.18/clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch new file mode 100644 index 0000000000..7544f64307 --- /dev/null +++ b/queue-6.18/clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch @@ -0,0 +1,45 @@ +From 337e329b6645dc62cd6b542e35d6f5fc3abe1d5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Apr 2026 14:33:51 +0200 +Subject: clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from + getting parked + +From: Hans de Goede + +[ Upstream commit bc27dbefae6ed11376d991a2921eff806ffef67c ] + +Parking disp_cc_mdss_mdp_clk_src at 19.2MHz causing the EFI GOP framebuffer +to stop functioning. The EFI GOP framebuffer should keep working until +the msm display driver loads, to help with boot debugging and to ensure +display output when the msm module is not in the initramfs. + +Switch disp_cc_mdss_mdp_clk_src over to clk_rcg2_shared_no_init_park_ops +to keep the EFI GOP working after binding the x1e80100-dispcc driver. + +Suggested-by: Dmitry Baryshkov +Signed-off-by: Hans de Goede +Reviewed-by: Dmitry Baryshkov +Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") +Link: https://lore.kernel.org/r/20260425123351.6292-1-johannes.goede@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-x1e80100.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/dispcc-x1e80100.c b/drivers/clk/qcom/dispcc-x1e80100.c +index 40069eba41f241..5c00a0f8448931 100644 +--- a/drivers/clk/qcom/dispcc-x1e80100.c ++++ b/drivers/clk/qcom/dispcc-x1e80100.c +@@ -580,7 +580,7 @@ static struct clk_rcg2 disp_cc_mdss_mdp_clk_src = { + .parent_data = disp_cc_parent_data_6, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_6), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_shared_no_init_park_ops, + }, + }; + +-- +2.53.0 + diff --git a/queue-6.18/clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch b/queue-6.18/clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch new file mode 100644 index 0000000000..287a875f80 --- /dev/null +++ b/queue-6.18/clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch @@ -0,0 +1,47 @@ +From 13a8b71893444b2c77873a3322a147543638247e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 May 2026 17:14:57 +0000 +Subject: clk: samsung: gs101: Fix missing USI7_USI DIV clock in + peric0_clk_regs + +From: Kuan-Wei Chiu + +[ Upstream commit 78ee734b36284d82454e87a92094fdb926985b47 ] + +In the peric0_clk_regs array, the divider register offset for USI6 was +accidentally listed twice, while the divider for USI7 was omitted. + +Missing this DIV register causes the USI7 clock divider setting to be +lost and reset to its hardware default value during a suspend/resume +cycle. + +Replace the duplicated USI6 DIV entry with the correct USI7 DIV +register. + +Fixes: 893f133a040b ("clk: samsung: gs101: add support for cmu_peric0") +Signed-off-by: Kuan-Wei Chiu +Reviewed-by: Peter Griffin +Reviewed-by: Tudor Ambarus +Link: https://patch.msgid.link/20260505171457.1960837-1-visitorckw@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-gs101.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/samsung/clk-gs101.c b/drivers/clk/samsung/clk-gs101.c +index 70b26db9b95ad0..cd2bf64e08c529 100644 +--- a/drivers/clk/samsung/clk-gs101.c ++++ b/drivers/clk/samsung/clk-gs101.c +@@ -3602,7 +3602,7 @@ static const unsigned long peric0_clk_regs[] __initconst = { + CLK_CON_DIV_DIV_CLK_PERIC0_USI4_USI, + CLK_CON_DIV_DIV_CLK_PERIC0_USI5_USI, + CLK_CON_DIV_DIV_CLK_PERIC0_USI6_USI, +- CLK_CON_DIV_DIV_CLK_PERIC0_USI6_USI, ++ CLK_CON_DIV_DIV_CLK_PERIC0_USI7_USI, + CLK_CON_DIV_DIV_CLK_PERIC0_USI8_USI, + CLK_CON_BUF_CLKBUF_PERIC0_IP, + CLK_CON_GAT_CLK_BLK_PERIC0_UID_PERIC0_CMU_PERIC0_IPCLKPORT_PCLK, +-- +2.53.0 + diff --git a/queue-6.18/drm-i915-edp-check-supported-link-rates-dpcd-read.patch b/queue-6.18/drm-i915-edp-check-supported-link-rates-dpcd-read.patch new file mode 100644 index 0000000000..a5a0365abb --- /dev/null +++ b/queue-6.18/drm-i915-edp-check-supported-link-rates-dpcd-read.patch @@ -0,0 +1,59 @@ +From 9bdee58aaf99074b634bda59bbfd8f6ec02e7612 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 May 2026 17:57:58 +0300 +Subject: drm/i915/edp: Check supported link rates DPCD read + +From: Nikita Zhandarovich + +[ Upstream commit 2673cefa99ca918e7ac5b0388ff578a83656c896 ] + +intel_edp_set_sink_rates() reads DP_SUPPORTED_LINK_RATES into a local +stack array and then parses the array unconditionally. If the read +fails, the array contents are not valid and may result in bogus sink +link rates being used. + +Use drm_dp_dpcd_read_data() and clear the sink rate array on failure, +so the existing parser falls back to the default sink rate handling. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 68f357cb7347 ("drm/i915/dp: generate and cache sink rate array for all DP, not just eDP 1.4") +Signed-off-by: Nikita Zhandarovich +Reviewed-by: Jani Nikula +Link: https://patch.msgid.link/20260529145759.1640646-1-n.zhandarovich@fintech.ru +Signed-off-by: Jani Nikula +(cherry picked from commit bd61c7756b34157e093028225a69383b4b1203cc) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_dp.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c +index a44fbac1e5e272..c7886b36477067 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -4372,10 +4372,17 @@ intel_edp_set_sink_rates(struct intel_dp *intel_dp) + + if (intel_dp->edp_dpcd[0] >= DP_EDP_14) { + __le16 sink_rates[DP_MAX_SUPPORTED_RATES]; ++ int ret; + int i; + +- drm_dp_dpcd_read(&intel_dp->aux, DP_SUPPORTED_LINK_RATES, +- sink_rates, sizeof(sink_rates)); ++ ret = drm_dp_dpcd_read_data(&intel_dp->aux, ++ DP_SUPPORTED_LINK_RATES, ++ sink_rates, sizeof(sink_rates)); ++ if (ret < 0) { ++ drm_dbg_kms(display->drm, ++ "Unable to read eDP supported link rates, using default rates\n"); ++ memset(sink_rates, 0, sizeof(sink_rates)); ++ } + + for (i = 0; i < ARRAY_SIZE(sink_rates); i++) { + int rate; +-- +2.53.0 + diff --git a/queue-6.18/drm-vc4-fix-krealloc-memory-leak.patch b/queue-6.18/drm-vc4-fix-krealloc-memory-leak.patch new file mode 100644 index 0000000000..b53969ba78 --- /dev/null +++ b/queue-6.18/drm-vc4-fix-krealloc-memory-leak.patch @@ -0,0 +1,67 @@ +From 68bdf9038ba8fc01ee998dfdeaf5c0e7d0c46acc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jun 2026 14:38:10 +0200 +Subject: drm/vc4: fix krealloc() memory leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander A. Klimov + +[ Upstream commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b ] + +Don't just overwrite the original pointer passed to krealloc() +with its return value without checking latter: + + MEM = krealloc(MEM, SZ, GFP); + +If krealloc() returns NULL, that erases the pointer +to the still allocated memory, hence leaks this memory. +Instead, use a temporary variable, check it's not NULL +and only then assign it to the original pointer: + + TMP = krealloc(MEM, SZ, GFP); + if (!TMP) return; + MEM = TMP; + +While on it, use krealloc_array(). + +Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.") +Signed-off-by: Alexander A. Klimov +Signed-off-by: Maíra Canal +Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +index 2d74e786914cb3..7ce3ec0906c33b 100644 +--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c ++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +@@ -288,15 +288,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va + { + uint32_t o = validated_shader->num_uniform_addr_offsets; + uint32_t num_uniforms = validated_shader->uniforms_size / 4; ++ u32 *offsets; + +- validated_shader->uniform_addr_offsets = +- krealloc(validated_shader->uniform_addr_offsets, +- (o + 1) * +- sizeof(*validated_shader->uniform_addr_offsets), +- GFP_KERNEL); +- if (!validated_shader->uniform_addr_offsets) ++ offsets = krealloc_array(validated_shader->uniform_addr_offsets, ++ o + 1, ++ sizeof(*validated_shader->uniform_addr_offsets), ++ GFP_KERNEL); ++ if (!offsets) + return false; + ++ validated_shader->uniform_addr_offsets = offsets; + validated_shader->uniform_addr_offsets[o] = num_uniforms; + validated_shader->num_uniform_addr_offsets++; + +-- +2.53.0 + diff --git a/queue-6.18/drm-virtio-fix-driver-removal-with-disabled-kms.patch b/queue-6.18/drm-virtio-fix-driver-removal-with-disabled-kms.patch new file mode 100644 index 0000000000..8a763d9877 --- /dev/null +++ b/queue-6.18/drm-virtio-fix-driver-removal-with-disabled-kms.patch @@ -0,0 +1,43 @@ +From 56bb0cd779a1890eb6c50b111d25ab27e8f9da04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jun 2026 15:27:43 +0300 +Subject: drm/virtio: Fix driver removal with disabled KMS + +From: Dmitry Osipenko + +[ Upstream commit f329e8325e054bd6d84d10904f8dd51137281b92 ] + +DRM atomic and modesetting aren't initialized if virtio-gpu driver built +with disabled KMS, leading to access of uninitialized data on driver +removal/unbinding and crashing kernel. Fix it by skipping shutting down +atomic core with unavailable KMS. + +Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support") +Signed-off-by: Dmitry Osipenko +Tested-by: Ryosuke Yasuoka +Reviewed-by: Ryosuke Yasuoka +Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/virtio/virtgpu_drv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c +index 71c6ccad4b99b4..d9556e1b67b10b 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_drv.c ++++ b/drivers/gpu/drm/virtio/virtgpu_drv.c +@@ -123,7 +123,10 @@ static void virtio_gpu_remove(struct virtio_device *vdev) + struct drm_device *dev = vdev->priv; + + drm_dev_unplug(dev); +- drm_atomic_helper_shutdown(dev); ++ ++ if (drm_core_check_feature(dev, DRIVER_ATOMIC)) ++ drm_atomic_helper_shutdown(dev); ++ + virtio_gpu_deinit(dev); + drm_dev_put(dev); + } +-- +2.53.0 + diff --git a/queue-6.18/drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch b/queue-6.18/drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch new file mode 100644 index 0000000000..50f4357d03 --- /dev/null +++ b/queue-6.18/drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch @@ -0,0 +1,52 @@ +From c6ad8f2608d98c46eac9fb9e0e684abc5faaa178 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jun 2026 10:27:05 -0700 +Subject: drm/xe: fix refcount leak in xe_range_fence_insert() + +From: Wentao Liang + +[ Upstream commit ba36786b21d19082e696eda85bfcd49e7071944a ] + +xe_range_fence_insert() acquires a reference on fence via +dma_fence_get() and stores it in rfence->fence. It then calls +dma_fence_add_callback() and handles two cases: when the callback +is successfully registered (err == 0) the fence is transferred to +the tree for later cleanup; when the fence is already signaled +(err == -ENOENT) it manually drops the extra reference with +dma_fence_put(fence). + +However, dma_fence_add_callback() can fail with other errors +(e.g. -EINVAL) and in that case the code falls through to the free: +label without releasing the acquired reference, leaking it. + +Fix the leak by adding an else branch that calls dma_fence_put() +before jumping to free: for any error other than -ENOENT. + +Fixes: 845f64bdbfc9 ("drm/xe: Introduce a range-fence utility") +Signed-off-by: Wentao Liang +Reviewed-by: Matthew Brost +Signed-off-by: Matthew Brost +Link: https://patch.msgid.link/20260610172705.3450560-1-matthew.brost@intel.com +(cherry picked from commit 98c4a4201290823c2c5c7ba21692bd9a64b61021) +Signed-off-by: Matthew Brost +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_range_fence.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/xe/xe_range_fence.c b/drivers/gpu/drm/xe/xe_range_fence.c +index 372378e89e9892..3d8fa194a7b0eb 100644 +--- a/drivers/gpu/drm/xe/xe_range_fence.c ++++ b/drivers/gpu/drm/xe/xe_range_fence.c +@@ -77,6 +77,8 @@ int xe_range_fence_insert(struct xe_range_fence_tree *tree, + } else if (err == 0) { + xe_range_fence_tree_insert(rfence, &tree->root); + return 0; ++ } else { ++ dma_fence_put(fence); + } + + free: +-- +2.53.0 + diff --git a/queue-6.18/series b/queue-6.18/series index f5057e7178..9f74846abd 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -135,3 +135,11 @@ net-txgbe-rename-the-sfp-related.patch net-txgbe-initialize-module-info-buffer.patch ipv6-fix-a-potential-npd-in-cleanup_prefix_route.patch kvm-vmx-update-svi-during-runtime-apicv-activation.patch +clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch +clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch +clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch +drm-i915-edp-check-supported-link-rates-dpcd-read.patch +drm-virtio-fix-driver-removal-with-disabled-kms.patch +drm-vc4-fix-krealloc-memory-leak.patch +drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch +accel-amdxdna-fix-mm_struct-reference-leak-in-aie2_p.patch diff --git a/queue-6.6/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch b/queue-6.6/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch new file mode 100644 index 0000000000..e263077341 --- /dev/null +++ b/queue-6.6/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch @@ -0,0 +1,52 @@ +From 5f838b3285059607f7df4dde12b1a18d4ffc31b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2026 23:01:51 +0800 +Subject: clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration + time +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pengyu Luo + +[ Upstream commit 5285b046757844435d1db96c1b5c3a6621b2979a ] + +Parking disp{0,1}_cc_mdss_mdp_clk_src clk broke simplefb on HUAWEI +Gaokun3, the image will stuck at grey for seconds until msm takes +over framebuffer. Use clk_rcg2_shared_no_init_park_ops to skip it. + +Signed-off-by: Pengyu Luo +Tested-by: Jérôme de Bretagne +Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") +Link: https://lore.kernel.org/r/20260303150152.90685-1-mitltlatltl@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-sc8280xp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-sc8280xp.c b/drivers/clk/qcom/dispcc-sc8280xp.c +index 7f8819ece5eb01..40fc57eb9f7981 100644 +--- a/drivers/clk/qcom/dispcc-sc8280xp.c ++++ b/drivers/clk/qcom/dispcc-sc8280xp.c +@@ -978,7 +978,7 @@ static struct clk_rcg2 disp0_cc_mdss_mdp_clk_src = { + .name = "disp0_cc_mdss_mdp_clk_src", + .parent_data = disp0_cc_parent_data_5, + .num_parents = ARRAY_SIZE(disp0_cc_parent_data_5), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_shared_no_init_park_ops, + }, + }; + +@@ -992,7 +992,7 @@ static struct clk_rcg2 disp1_cc_mdss_mdp_clk_src = { + .name = "disp1_cc_mdss_mdp_clk_src", + .parent_data = disp1_cc_parent_data_5, + .num_parents = ARRAY_SIZE(disp1_cc_parent_data_5), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_shared_no_init_park_ops, + }, + }; + +-- +2.53.0 + diff --git a/queue-6.6/drm-vc4-fix-krealloc-memory-leak.patch b/queue-6.6/drm-vc4-fix-krealloc-memory-leak.patch new file mode 100644 index 0000000000..3610d7cdbc --- /dev/null +++ b/queue-6.6/drm-vc4-fix-krealloc-memory-leak.patch @@ -0,0 +1,67 @@ +From 39936784062825e2c103e1f209f4adc326703146 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jun 2026 14:38:10 +0200 +Subject: drm/vc4: fix krealloc() memory leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander A. Klimov + +[ Upstream commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b ] + +Don't just overwrite the original pointer passed to krealloc() +with its return value without checking latter: + + MEM = krealloc(MEM, SZ, GFP); + +If krealloc() returns NULL, that erases the pointer +to the still allocated memory, hence leaks this memory. +Instead, use a temporary variable, check it's not NULL +and only then assign it to the original pointer: + + TMP = krealloc(MEM, SZ, GFP); + if (!TMP) return; + MEM = TMP; + +While on it, use krealloc_array(). + +Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.") +Signed-off-by: Alexander A. Klimov +Signed-off-by: Maíra Canal +Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +index 9745f8810eca6d..c2c6767ae55862 100644 +--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c ++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +@@ -288,15 +288,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va + { + uint32_t o = validated_shader->num_uniform_addr_offsets; + uint32_t num_uniforms = validated_shader->uniforms_size / 4; ++ u32 *offsets; + +- validated_shader->uniform_addr_offsets = +- krealloc(validated_shader->uniform_addr_offsets, +- (o + 1) * +- sizeof(*validated_shader->uniform_addr_offsets), +- GFP_KERNEL); +- if (!validated_shader->uniform_addr_offsets) ++ offsets = krealloc_array(validated_shader->uniform_addr_offsets, ++ o + 1, ++ sizeof(*validated_shader->uniform_addr_offsets), ++ GFP_KERNEL); ++ if (!offsets) + return false; + ++ validated_shader->uniform_addr_offsets = offsets; + validated_shader->uniform_addr_offsets[o] = num_uniforms; + validated_shader->num_uniform_addr_offsets++; + +-- +2.53.0 + diff --git a/queue-6.6/drm-virtio-fix-driver-removal-with-disabled-kms.patch b/queue-6.6/drm-virtio-fix-driver-removal-with-disabled-kms.patch new file mode 100644 index 0000000000..c95b77b0d0 --- /dev/null +++ b/queue-6.6/drm-virtio-fix-driver-removal-with-disabled-kms.patch @@ -0,0 +1,43 @@ +From 9a55af4ab013728b199b08c757dc4ddb5969f0f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jun 2026 15:27:43 +0300 +Subject: drm/virtio: Fix driver removal with disabled KMS + +From: Dmitry Osipenko + +[ Upstream commit f329e8325e054bd6d84d10904f8dd51137281b92 ] + +DRM atomic and modesetting aren't initialized if virtio-gpu driver built +with disabled KMS, leading to access of uninitialized data on driver +removal/unbinding and crashing kernel. Fix it by skipping shutting down +atomic core with unavailable KMS. + +Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support") +Signed-off-by: Dmitry Osipenko +Tested-by: Ryosuke Yasuoka +Reviewed-by: Ryosuke Yasuoka +Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/virtio/virtgpu_drv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c +index c5716fd0aed380..9b399a12d43c20 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_drv.c ++++ b/drivers/gpu/drm/virtio/virtgpu_drv.c +@@ -118,7 +118,10 @@ static void virtio_gpu_remove(struct virtio_device *vdev) + struct drm_device *dev = vdev->priv; + + drm_dev_unplug(dev); +- drm_atomic_helper_shutdown(dev); ++ ++ if (drm_core_check_feature(dev, DRIVER_ATOMIC)) ++ drm_atomic_helper_shutdown(dev); ++ + virtio_gpu_deinit(dev); + drm_dev_put(dev); + } +-- +2.53.0 + diff --git a/queue-6.6/series b/queue-6.6/series index ffa706ab8d..cf8a894d62 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -284,3 +284,6 @@ net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch ipv6-fix-a-potential-npd-in-cleanup_prefix_route.patch netfilter-ctnetlink-ensure-safe-access-to-master-con.patch +clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch +drm-virtio-fix-driver-removal-with-disabled-kms.patch +drm-vc4-fix-krealloc-memory-leak.patch diff --git a/queue-7.0/accel-amdxdna-fix-mm_struct-reference-leak-in-aie2_p.patch b/queue-7.0/accel-amdxdna-fix-mm_struct-reference-leak-in-aie2_p.patch new file mode 100644 index 0000000000..03c0f7f2a1 --- /dev/null +++ b/queue-7.0/accel-amdxdna-fix-mm_struct-reference-leak-in-aie2_p.patch @@ -0,0 +1,52 @@ +From a49294ef51fc833af8b9c329d13bf64f7e384432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jun 2026 08:11:27 -0700 +Subject: accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() + +From: Lizhi Hou + +[ Upstream commit 2f41af638c92bac6f1f9275ea2d1901baef578f3 ] + +aie2_populate_range() jumps back to the again label without calling +mmput(mm), leaking a reference to the mm_struct. + +Add the missing mmput() before jumping to again. + +Fixes: e486147c912f ("accel/amdxdna: Add BO import and export") +Reviewed-by: Mario Limonciello (AMD) +Signed-off-by: Lizhi Hou +Link: https://patch.msgid.link/20260610151127.2994185-1-lizhi.hou@amd.com +Signed-off-by: Sasha Levin +--- + drivers/accel/amdxdna/aie2_ctx.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c +index c0d348884f7494..4c7264c6e6e76f 100644 +--- a/drivers/accel/amdxdna/aie2_ctx.c ++++ b/drivers/accel/amdxdna/aie2_ctx.c +@@ -928,6 +928,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo) + + if (ret == -EBUSY) { + amdxdna_umap_put(mapp); ++ mmput(mm); + goto again; + } + +@@ -938,11 +939,13 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo) + if (mmu_interval_read_retry(&mapp->notifier, mapp->range.notifier_seq)) { + up_write(&xdna->notifier_lock); + amdxdna_umap_put(mapp); ++ mmput(mm); + goto again; + } + mapp->invalid = false; + up_write(&xdna->notifier_lock); + amdxdna_umap_put(mapp); ++ mmput(mm); + goto again; + + put_mm: +-- +2.53.0 + diff --git a/queue-7.0/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch b/queue-7.0/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch new file mode 100644 index 0000000000..79677b4bec --- /dev/null +++ b/queue-7.0/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch @@ -0,0 +1,52 @@ +From 30f4927cb581f7e795d8458c2ef70a6571fcf8d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2026 23:01:51 +0800 +Subject: clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration + time +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pengyu Luo + +[ Upstream commit 5285b046757844435d1db96c1b5c3a6621b2979a ] + +Parking disp{0,1}_cc_mdss_mdp_clk_src clk broke simplefb on HUAWEI +Gaokun3, the image will stuck at grey for seconds until msm takes +over framebuffer. Use clk_rcg2_shared_no_init_park_ops to skip it. + +Signed-off-by: Pengyu Luo +Tested-by: Jérôme de Bretagne +Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") +Link: https://lore.kernel.org/r/20260303150152.90685-1-mitltlatltl@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-sc8280xp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-sc8280xp.c b/drivers/clk/qcom/dispcc-sc8280xp.c +index e91dfed0f37e9b..acc927c2142ab5 100644 +--- a/drivers/clk/qcom/dispcc-sc8280xp.c ++++ b/drivers/clk/qcom/dispcc-sc8280xp.c +@@ -977,7 +977,7 @@ static struct clk_rcg2 disp0_cc_mdss_mdp_clk_src = { + .name = "disp0_cc_mdss_mdp_clk_src", + .parent_data = disp0_cc_parent_data_5, + .num_parents = ARRAY_SIZE(disp0_cc_parent_data_5), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_shared_no_init_park_ops, + }, + }; + +@@ -991,7 +991,7 @@ static struct clk_rcg2 disp1_cc_mdss_mdp_clk_src = { + .name = "disp1_cc_mdss_mdp_clk_src", + .parent_data = disp1_cc_parent_data_5, + .num_parents = ARRAY_SIZE(disp1_cc_parent_data_5), +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_shared_no_init_park_ops, + }, + }; + +-- +2.53.0 + diff --git a/queue-7.0/clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch b/queue-7.0/clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch new file mode 100644 index 0000000000..c7ee5b8267 --- /dev/null +++ b/queue-7.0/clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch @@ -0,0 +1,45 @@ +From 1bc811a21f5c5d0d41960b011827b9615f4ca315 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Apr 2026 14:33:51 +0200 +Subject: clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from + getting parked + +From: Hans de Goede + +[ Upstream commit bc27dbefae6ed11376d991a2921eff806ffef67c ] + +Parking disp_cc_mdss_mdp_clk_src at 19.2MHz causing the EFI GOP framebuffer +to stop functioning. The EFI GOP framebuffer should keep working until +the msm display driver loads, to help with boot debugging and to ensure +display output when the msm module is not in the initramfs. + +Switch disp_cc_mdss_mdp_clk_src over to clk_rcg2_shared_no_init_park_ops +to keep the EFI GOP working after binding the x1e80100-dispcc driver. + +Suggested-by: Dmitry Baryshkov +Signed-off-by: Hans de Goede +Reviewed-by: Dmitry Baryshkov +Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") +Link: https://lore.kernel.org/r/20260425123351.6292-1-johannes.goede@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-x1e80100.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/dispcc-x1e80100.c b/drivers/clk/qcom/dispcc-x1e80100.c +index aa7fd43969f9c8..cd45bedf26494c 100644 +--- a/drivers/clk/qcom/dispcc-x1e80100.c ++++ b/drivers/clk/qcom/dispcc-x1e80100.c +@@ -580,7 +580,7 @@ static struct clk_rcg2 disp_cc_mdss_mdp_clk_src = { + .parent_data = disp_cc_parent_data_6, + .num_parents = ARRAY_SIZE(disp_cc_parent_data_6), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_shared_ops, ++ .ops = &clk_rcg2_shared_no_init_park_ops, + }, + }; + +-- +2.53.0 + diff --git a/queue-7.0/clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch b/queue-7.0/clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch new file mode 100644 index 0000000000..8330b8e86a --- /dev/null +++ b/queue-7.0/clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch @@ -0,0 +1,47 @@ +From 9d61484121bcf94a620d82a628e7912bf4e43ac7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 May 2026 17:14:57 +0000 +Subject: clk: samsung: gs101: Fix missing USI7_USI DIV clock in + peric0_clk_regs + +From: Kuan-Wei Chiu + +[ Upstream commit 78ee734b36284d82454e87a92094fdb926985b47 ] + +In the peric0_clk_regs array, the divider register offset for USI6 was +accidentally listed twice, while the divider for USI7 was omitted. + +Missing this DIV register causes the USI7 clock divider setting to be +lost and reset to its hardware default value during a suspend/resume +cycle. + +Replace the duplicated USI6 DIV entry with the correct USI7 DIV +register. + +Fixes: 893f133a040b ("clk: samsung: gs101: add support for cmu_peric0") +Signed-off-by: Kuan-Wei Chiu +Reviewed-by: Peter Griffin +Reviewed-by: Tudor Ambarus +Link: https://patch.msgid.link/20260505171457.1960837-1-visitorckw@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-gs101.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/samsung/clk-gs101.c b/drivers/clk/samsung/clk-gs101.c +index 44a8ecd332fddc..b439b7ae30ea39 100644 +--- a/drivers/clk/samsung/clk-gs101.c ++++ b/drivers/clk/samsung/clk-gs101.c +@@ -3921,7 +3921,7 @@ static const unsigned long peric0_clk_regs[] __initconst = { + CLK_CON_DIV_DIV_CLK_PERIC0_USI4_USI, + CLK_CON_DIV_DIV_CLK_PERIC0_USI5_USI, + CLK_CON_DIV_DIV_CLK_PERIC0_USI6_USI, +- CLK_CON_DIV_DIV_CLK_PERIC0_USI6_USI, ++ CLK_CON_DIV_DIV_CLK_PERIC0_USI7_USI, + CLK_CON_DIV_DIV_CLK_PERIC0_USI8_USI, + CLK_CON_BUF_CLKBUF_PERIC0_IP, + CLK_CON_GAT_CLK_BLK_PERIC0_UID_PERIC0_CMU_PERIC0_IPCLKPORT_PCLK, +-- +2.53.0 + diff --git a/queue-7.0/drm-amd-display-use-plane-color_mgmt_changed-to-trac.patch b/queue-7.0/drm-amd-display-use-plane-color_mgmt_changed-to-trac.patch new file mode 100644 index 0000000000..b6a21a6737 --- /dev/null +++ b/queue-7.0/drm-amd-display-use-plane-color_mgmt_changed-to-trac.patch @@ -0,0 +1,54 @@ +From 2c701836b8652399ae15f95b58461fe7fbcec235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2026 12:20:21 +0200 +Subject: drm/amd/display: use plane color_mgmt_changed to track colorop + changes + +From: Melissa Wen + +[ Upstream commit d79716401a954677a93c4dd51fec65beccb38296 ] + +Ensure the driver tracks changes in any colorop property of a plane +color pipeline by using the same mechanism of CRTC color management and +update plane color blocks when any colorop property changes. It fixes an +issue observed on gamescope settings for night mode which is done via +shaper/3D-LUT updates. + +Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") +Reviewed-by: Harry Wentland +Reviewed-by: Alex Hung +Signed-off-by: Melissa Wen +Signed-off-by: Melissa Wen +Link: https://patch.msgid.link/20260609110420.1298352-5-mwen@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 0aee65503642d7..2d0c818cace25c 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10016,7 +10016,7 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, + continue; + + bundle->surface_updates[planes_count].surface = dc_plane; +- if (new_pcrtc_state->color_mgmt_changed) { ++ if (new_pcrtc_state->color_mgmt_changed || new_plane_state->color_mgmt_changed) { + bundle->surface_updates[planes_count].gamma = &dc_plane->gamma_correction; + bundle->surface_updates[planes_count].in_transfer_func = &dc_plane->in_transfer_func; + bundle->surface_updates[planes_count].gamut_remap_matrix = &dc_plane->gamut_remap_matrix; +@@ -11756,6 +11756,10 @@ static bool should_reset_plane(struct drm_atomic_state *state, + if (new_crtc_state->color_mgmt_changed) + return true; + ++ /* Plane color pipeline or its colorop changes. */ ++ if (new_plane_state->color_mgmt_changed) ++ return true; ++ + /* + * On zpos change, planes need to be reordered by removing and re-adding + * them one by one to the dc state, in order of descending zpos. +-- +2.53.0 + diff --git a/queue-7.0/drm-atomic-track-individual-colorop-updates.patch b/queue-7.0/drm-atomic-track-individual-colorop-updates.patch new file mode 100644 index 0000000000..7de4a7617f --- /dev/null +++ b/queue-7.0/drm-atomic-track-individual-colorop-updates.patch @@ -0,0 +1,204 @@ +From d071fc0933d1dcadbe390868a4e0a242df04e492 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2026 12:20:20 +0200 +Subject: drm/atomic: track individual colorop updates + +From: Melissa Wen + +[ Upstream commit 2e235e2a2784b12b735321e5b42240ca51c49b0f ] + +As we do for CRTC color mgmt properties, use color_mgmt_changed flag to +track any value changes in the color pipeline of a given plane, so that +drivers can update color blocks as soon as plane color pipeline or +individual colorop values change. Since we're here, only announce and +track changes to plane COLOR_PIPELINE prop if its value is actually +changing. + +Fixes: 8c5ea1745f4c ("drm/colorop: Add BYPASS property") +Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation") +Fixes: 41651f9d42eb ("drm/colorop: Add 1D Curve subtype") +Fixes: 3410108037d5 ("drm/colorop: Add multiplier type") +Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline") +Fixes: e5719e7f1900 ("drm/colorop: Add 3x4 CTM type") +Fixes: 99a4e4f08abe ("drm/colorop: Add 1D Curve Custom LUT type") +Fixes: 2afc3184f3b3 ("drm/plane: Add COLOR PIPELINE property") +Reviewed-by: Harry Wentland #v1 +Reviewed-by: Chaitanya Kumar Borah +Reviewed-by: Alex Hung +Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") +Signed-off-by: Melissa Wen +Signed-off-by: Melissa Wen +Link: https://patch.msgid.link/20260609110420.1298352-4-mwen@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_atomic_uapi.c | 64 ++++++++++++++++++++++++------- + include/drm/drm_atomic_uapi.h | 4 +- + 2 files changed, 54 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c +index aefcf58e4f0399..97bbf91f3c7975 100644 +--- a/drivers/gpu/drm/drm_atomic_uapi.c ++++ b/drivers/gpu/drm/drm_atomic_uapi.c +@@ -265,13 +265,19 @@ EXPORT_SYMBOL(drm_atomic_set_fb_for_plane); + * + * Helper function to select the color pipeline on a plane by setting + * it to the first drm_colorop element of the pipeline. ++ * ++ * Return: true if plane color pipeline value changed, false otherwise. + */ +-void ++bool + drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state, + struct drm_colorop *colorop) + { + struct drm_plane *plane = plane_state->plane; + ++ /* Color pipeline didn't change */ ++ if (plane_state->color_pipeline == colorop) ++ return false; ++ + if (colorop) + drm_dbg_atomic(plane->dev, + "Set [COLOROP:%d] for [PLANE:%d:%s] state %p\n", +@@ -283,6 +289,8 @@ drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state, + plane->base.id, plane->name, plane_state); + + plane_state->color_pipeline = colorop; ++ ++ return true; + } + EXPORT_SYMBOL(drm_atomic_set_colorop_for_plane); + +@@ -600,7 +608,7 @@ static int drm_atomic_plane_set_property(struct drm_plane *plane, + if (val && !colorop) + return -EACCES; + +- drm_atomic_set_colorop_for_plane(state, colorop); ++ state->color_mgmt_changed |= drm_atomic_set_colorop_for_plane(state, colorop); + } else if (property == config->prop_fb_damage_clips) { + ret = drm_property_replace_blob_from_id(dev, + &state->fb_damage_clips, +@@ -709,11 +717,11 @@ drm_atomic_plane_get_property(struct drm_plane *plane, + static int drm_atomic_color_set_data_property(struct drm_colorop *colorop, + struct drm_colorop_state *state, + struct drm_property *property, +- uint64_t val) ++ uint64_t val, ++ bool *replaced) + { + ssize_t elem_size = -1; + ssize_t size = -1; +- bool replaced = false; + + switch (colorop->type) { + case DRM_COLOROP_1D_LUT: +@@ -735,28 +743,45 @@ static int drm_atomic_color_set_data_property(struct drm_colorop *colorop, + &state->data, + val, + -1, size, elem_size, +- &replaced); ++ replaced); + } + + static int drm_atomic_colorop_set_property(struct drm_colorop *colorop, + struct drm_colorop_state *state, + struct drm_file *file_priv, + struct drm_property *property, +- uint64_t val) ++ uint64_t val, ++ bool *replaced) + { + if (property == colorop->bypass_property) { +- state->bypass = val; ++ if (state->bypass != val) { ++ state->bypass = val; ++ *replaced = true; ++ } + } else if (property == colorop->lut1d_interpolation_property) { +- state->lut1d_interpolation = val; ++ if (state->lut1d_interpolation != val) { ++ state->lut1d_interpolation = val; ++ *replaced = true; ++ } + } else if (property == colorop->curve_1d_type_property) { +- state->curve_1d_type = val; ++ if (state->curve_1d_type != val) { ++ state->curve_1d_type = val; ++ *replaced = true; ++ } + } else if (property == colorop->multiplier_property) { +- state->multiplier = val; ++ if (state->multiplier != val) { ++ state->multiplier = val; ++ *replaced = true; ++ } + } else if (property == colorop->lut3d_interpolation_property) { +- state->lut3d_interpolation = val; ++ if (state->lut3d_interpolation != val) { ++ state->lut3d_interpolation = val; ++ *replaced = true; ++ } + } else if (property == colorop->data_property) { + return drm_atomic_color_set_data_property(colorop, state, +- property, val); ++ property, val, ++ replaced); + } else { + drm_dbg_atomic(colorop->dev, + "[COLOROP:%d:%d] unknown property [PROP:%d:%s]\n", +@@ -1271,8 +1296,10 @@ int drm_atomic_set_property(struct drm_atomic_state *state, + break; + } + case DRM_MODE_OBJECT_COLOROP: { ++ struct drm_plane_state *plane_state; + struct drm_colorop *colorop = obj_to_colorop(obj); + struct drm_colorop_state *colorop_state; ++ bool replaced = false; + + colorop_state = drm_atomic_get_colorop_state(state, colorop); + if (IS_ERR(colorop_state)) { +@@ -1281,7 +1308,18 @@ int drm_atomic_set_property(struct drm_atomic_state *state, + } + + ret = drm_atomic_colorop_set_property(colorop, colorop_state, +- file_priv, prop, prop_value); ++ file_priv, prop, prop_value, ++ &replaced); ++ if (ret || !replaced) ++ break; ++ ++ plane_state = drm_atomic_get_plane_state(state, colorop->plane); ++ if (IS_ERR(plane_state)) { ++ ret = PTR_ERR(plane_state); ++ break; ++ } ++ plane_state->color_mgmt_changed |= replaced; ++ + break; + } + default: +diff --git a/include/drm/drm_atomic_uapi.h b/include/drm/drm_atomic_uapi.h +index 4363155233267b..4e7e78f711e26a 100644 +--- a/include/drm/drm_atomic_uapi.h ++++ b/include/drm/drm_atomic_uapi.h +@@ -29,6 +29,8 @@ + #ifndef DRM_ATOMIC_UAPI_H_ + #define DRM_ATOMIC_UAPI_H_ + ++#include ++ + struct drm_crtc_state; + struct drm_display_mode; + struct drm_property_blob; +@@ -50,7 +52,7 @@ drm_atomic_set_crtc_for_plane(struct drm_plane_state *plane_state, + struct drm_crtc *crtc); + void drm_atomic_set_fb_for_plane(struct drm_plane_state *plane_state, + struct drm_framebuffer *fb); +-void drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state, ++bool drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state, + struct drm_colorop *colorop); + int __must_check + drm_atomic_set_crtc_for_connector(struct drm_connector_state *conn_state, +-- +2.53.0 + diff --git a/queue-7.0/drm-colorop-make-lut-1-3-d_interpolation-props-corre.patch b/queue-7.0/drm-colorop-make-lut-1-3-d_interpolation-props-corre.patch new file mode 100644 index 0000000000..a5d7a12a20 --- /dev/null +++ b/queue-7.0/drm-colorop-make-lut-1-3-d_interpolation-props-corre.patch @@ -0,0 +1,180 @@ +From 891d9a2652a65b39d99563a83c20e515028bf406 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2026 12:20:19 +0200 +Subject: drm/colorop: make lut(1/3)d_interpolation props correctly behave as + mutable + +From: Melissa Wen + +[ Upstream commit 94ff735296d371045fce163451a3d65e44ac4729 ] + +As interpolation props are actually mutable props, any changes should be +handled by drm_colorop_state. Move their enum and make it correctly +behaves as mutable. + +Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation") +Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline") +Reviewed-by: Chaitanya Kumar Borah +Reviewed-by: Alex Hung +Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") +Signed-off-by: Melissa Wen +Signed-off-by: Melissa Wen +Link: https://patch.msgid.link/20260609110420.1298352-3-mwen@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_atomic.c | 4 ++-- + drivers/gpu/drm/drm_atomic_uapi.c | 8 ++++---- + drivers/gpu/drm/drm_colorop.c | 16 ++++++++++++++-- + include/drm/drm_colorop.h | 28 ++++++++++++++-------------- + 4 files changed, 34 insertions(+), 22 deletions(-) + +diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c +index ec7534227f66d4..b31bb3f9b11aae 100644 +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -829,7 +829,7 @@ static void drm_atomic_colorop_print_state(struct drm_printer *p, + case DRM_COLOROP_1D_LUT: + drm_printf(p, "\tsize=%d\n", colorop->size); + drm_printf(p, "\tinterpolation=%s\n", +- drm_get_colorop_lut1d_interpolation_name(colorop->lut1d_interpolation)); ++ drm_get_colorop_lut1d_interpolation_name(state->lut1d_interpolation)); + drm_printf(p, "\tdata blob id=%d\n", state->data ? state->data->base.id : 0); + break; + case DRM_COLOROP_CTM_3X4: +@@ -841,7 +841,7 @@ static void drm_atomic_colorop_print_state(struct drm_printer *p, + case DRM_COLOROP_3D_LUT: + drm_printf(p, "\tsize=%d\n", colorop->size); + drm_printf(p, "\tinterpolation=%s\n", +- drm_get_colorop_lut3d_interpolation_name(colorop->lut3d_interpolation)); ++ drm_get_colorop_lut3d_interpolation_name(state->lut3d_interpolation)); + drm_printf(p, "\tdata blob id=%d\n", state->data ? state->data->base.id : 0); + break; + default: +diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c +index 87de41fb445931..aefcf58e4f0399 100644 +--- a/drivers/gpu/drm/drm_atomic_uapi.c ++++ b/drivers/gpu/drm/drm_atomic_uapi.c +@@ -747,13 +747,13 @@ static int drm_atomic_colorop_set_property(struct drm_colorop *colorop, + if (property == colorop->bypass_property) { + state->bypass = val; + } else if (property == colorop->lut1d_interpolation_property) { +- colorop->lut1d_interpolation = val; ++ state->lut1d_interpolation = val; + } else if (property == colorop->curve_1d_type_property) { + state->curve_1d_type = val; + } else if (property == colorop->multiplier_property) { + state->multiplier = val; + } else if (property == colorop->lut3d_interpolation_property) { +- colorop->lut3d_interpolation = val; ++ state->lut3d_interpolation = val; + } else if (property == colorop->data_property) { + return drm_atomic_color_set_data_property(colorop, state, + property, val); +@@ -778,7 +778,7 @@ drm_atomic_colorop_get_property(struct drm_colorop *colorop, + else if (property == colorop->bypass_property) + *val = state->bypass; + else if (property == colorop->lut1d_interpolation_property) +- *val = colorop->lut1d_interpolation; ++ *val = state->lut1d_interpolation; + else if (property == colorop->curve_1d_type_property) + *val = state->curve_1d_type; + else if (property == colorop->multiplier_property) +@@ -786,7 +786,7 @@ drm_atomic_colorop_get_property(struct drm_colorop *colorop, + else if (property == colorop->size_property) + *val = colorop->size; + else if (property == colorop->lut3d_interpolation_property) +- *val = colorop->lut3d_interpolation; ++ *val = state->lut3d_interpolation; + else if (property == colorop->data_property) + *val = (state->data) ? state->data->base.id : 0; + else +diff --git a/drivers/gpu/drm/drm_colorop.c b/drivers/gpu/drm/drm_colorop.c +index 27139862b12086..6751add3cba96c 100644 +--- a/drivers/gpu/drm/drm_colorop.c ++++ b/drivers/gpu/drm/drm_colorop.c +@@ -321,7 +321,6 @@ int drm_plane_colorop_curve_1d_lut_init(struct drm_device *dev, struct drm_color + + colorop->lut1d_interpolation_property = prop; + drm_object_attach_property(&colorop->base, prop, interpolation); +- colorop->lut1d_interpolation = interpolation; + + /* data */ + ret = drm_colorop_create_data_prop(dev, colorop); +@@ -417,7 +416,6 @@ int drm_plane_colorop_3dlut_init(struct drm_device *dev, struct drm_colorop *col + + colorop->lut3d_interpolation_property = prop; + drm_object_attach_property(&colorop->base, prop, interpolation); +- colorop->lut3d_interpolation = interpolation; + + /* data */ + ret = drm_colorop_create_data_prop(dev, colorop); +@@ -496,6 +494,20 @@ static void __drm_colorop_state_reset(struct drm_colorop_state *colorop_state, + &val); + colorop_state->curve_1d_type = val; + } ++ ++ if (colorop->lut1d_interpolation_property) { ++ if (!drm_object_property_get_default_value(&colorop->base, ++ colorop->lut1d_interpolation_property, ++ &val)) ++ colorop_state->lut1d_interpolation = val; ++ } ++ ++ if (colorop->lut3d_interpolation_property) { ++ if (!drm_object_property_get_default_value(&colorop->base, ++ colorop->lut3d_interpolation_property, ++ &val)) ++ colorop_state->lut3d_interpolation = val; ++ } + } + + /** +diff --git a/include/drm/drm_colorop.h b/include/drm/drm_colorop.h +index 5bcb510e56c0a7..272ebff2de72e2 100644 +--- a/include/drm/drm_colorop.h ++++ b/include/drm/drm_colorop.h +@@ -183,6 +183,20 @@ struct drm_colorop_state { + */ + struct drm_property_blob *data; + ++ /** ++ * @lut1d_interpolation: ++ * ++ * Interpolation for DRM_COLOROP_1D_LUT ++ */ ++ enum drm_colorop_lut1d_interpolation_type lut1d_interpolation; ++ ++ /** ++ * @lut3d_interpolation: ++ * ++ * Interpolation for DRM_COLOROP_3D_LUT ++ */ ++ enum drm_colorop_lut3d_interpolation_type lut3d_interpolation; ++ + /** @state: backpointer to global drm_atomic_state */ + struct drm_atomic_state *state; + }; +@@ -293,20 +307,6 @@ struct drm_colorop { + */ + uint32_t size; + +- /** +- * @lut1d_interpolation: +- * +- * Interpolation for DRM_COLOROP_1D_LUT +- */ +- enum drm_colorop_lut1d_interpolation_type lut1d_interpolation; +- +- /** +- * @lut3d_interpolation: +- * +- * Interpolation for DRM_COLOROP_3D_LUT +- */ +- enum drm_colorop_lut3d_interpolation_type lut3d_interpolation; +- + /** + * @lut1d_interpolation_property: + * +-- +2.53.0 + diff --git a/queue-7.0/drm-colorop-remove-read-only-comments-from-interpola.patch b/queue-7.0/drm-colorop-remove-read-only-comments-from-interpola.patch new file mode 100644 index 0000000000..f9c78574bd --- /dev/null +++ b/queue-7.0/drm-colorop-remove-read-only-comments-from-interpola.patch @@ -0,0 +1,67 @@ +From 4359686aa76c964911f0732b4b6b1a9c5001661a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2026 12:20:18 +0200 +Subject: drm/colorop: Remove read-only comments from interpolation fields + +From: Alex Hung + +[ Upstream commit e480228cf65583040c894bb9cc02e1d5b328cee0 ] + +The lut1d_interpolation and lut3d_interpolation fields and their +associated properties were marked as read-only, but userspace +can set them via drm_atomic_colorop_set_property(). + +Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation") +Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline") +Reviewed-by: Chaitanya Kumar Borah +Signed-off-by: Alex Hung +Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") +Signed-off-by: Melissa Wen +Signed-off-by: Melissa Wen +Link: https://patch.msgid.link/20260609110420.1298352-2-mwen@igalia.com +Signed-off-by: Sasha Levin +--- + include/drm/drm_colorop.h | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/include/drm/drm_colorop.h b/include/drm/drm_colorop.h +index a3a32f9f918c73..5bcb510e56c0a7 100644 +--- a/include/drm/drm_colorop.h ++++ b/include/drm/drm_colorop.h +@@ -296,7 +296,6 @@ struct drm_colorop { + /** + * @lut1d_interpolation: + * +- * Read-only + * Interpolation for DRM_COLOROP_1D_LUT + */ + enum drm_colorop_lut1d_interpolation_type lut1d_interpolation; +@@ -304,7 +303,6 @@ struct drm_colorop { + /** + * @lut3d_interpolation: + * +- * Read-only + * Interpolation for DRM_COLOROP_3D_LUT + */ + enum drm_colorop_lut3d_interpolation_type lut3d_interpolation; +@@ -312,7 +310,7 @@ struct drm_colorop { + /** + * @lut1d_interpolation_property: + * +- * Read-only property for DRM_COLOROP_1D_LUT interpolation ++ * Property for DRM_COLOROP_1D_LUT interpolation + */ + struct drm_property *lut1d_interpolation_property; + +@@ -340,7 +338,7 @@ struct drm_colorop { + /** + * @lut3d_interpolation_property: + * +- * Read-only property for DRM_COLOROP_3D_LUT interpolation ++ * Property for DRM_COLOROP_3D_LUT interpolation + */ + struct drm_property *lut3d_interpolation_property; + +-- +2.53.0 + diff --git a/queue-7.0/drm-i915-edp-check-supported-link-rates-dpcd-read.patch b/queue-7.0/drm-i915-edp-check-supported-link-rates-dpcd-read.patch new file mode 100644 index 0000000000..26a3072457 --- /dev/null +++ b/queue-7.0/drm-i915-edp-check-supported-link-rates-dpcd-read.patch @@ -0,0 +1,59 @@ +From 1ef4c03c5a8492fa7bb5318beadbf7c89d7bb014 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 May 2026 17:57:58 +0300 +Subject: drm/i915/edp: Check supported link rates DPCD read + +From: Nikita Zhandarovich + +[ Upstream commit 2673cefa99ca918e7ac5b0388ff578a83656c896 ] + +intel_edp_set_sink_rates() reads DP_SUPPORTED_LINK_RATES into a local +stack array and then parses the array unconditionally. If the read +fails, the array contents are not valid and may result in bogus sink +link rates being used. + +Use drm_dp_dpcd_read_data() and clear the sink rate array on failure, +so the existing parser falls back to the default sink rate handling. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 68f357cb7347 ("drm/i915/dp: generate and cache sink rate array for all DP, not just eDP 1.4") +Signed-off-by: Nikita Zhandarovich +Reviewed-by: Jani Nikula +Link: https://patch.msgid.link/20260529145759.1640646-1-n.zhandarovich@fintech.ru +Signed-off-by: Jani Nikula +(cherry picked from commit bd61c7756b34157e093028225a69383b4b1203cc) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_dp.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c +index d52205d714eee6..afd4169ac0a6c0 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -4533,10 +4533,17 @@ intel_edp_set_sink_rates(struct intel_dp *intel_dp) + + if (intel_dp->edp_dpcd[0] >= DP_EDP_14) { + __le16 sink_rates[DP_MAX_SUPPORTED_RATES]; ++ int ret; + int i; + +- drm_dp_dpcd_read(&intel_dp->aux, DP_SUPPORTED_LINK_RATES, +- sink_rates, sizeof(sink_rates)); ++ ret = drm_dp_dpcd_read_data(&intel_dp->aux, ++ DP_SUPPORTED_LINK_RATES, ++ sink_rates, sizeof(sink_rates)); ++ if (ret < 0) { ++ drm_dbg_kms(display->drm, ++ "Unable to read eDP supported link rates, using default rates\n"); ++ memset(sink_rates, 0, sizeof(sink_rates)); ++ } + + for (i = 0; i < ARRAY_SIZE(sink_rates); i++) { + int rate; +-- +2.53.0 + diff --git a/queue-7.0/drm-vc4-fix-krealloc-memory-leak.patch b/queue-7.0/drm-vc4-fix-krealloc-memory-leak.patch new file mode 100644 index 0000000000..9573dd0658 --- /dev/null +++ b/queue-7.0/drm-vc4-fix-krealloc-memory-leak.patch @@ -0,0 +1,67 @@ +From eb816fac43013afe45d739f3b890ab1bad62e7ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jun 2026 14:38:10 +0200 +Subject: drm/vc4: fix krealloc() memory leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander A. Klimov + +[ Upstream commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b ] + +Don't just overwrite the original pointer passed to krealloc() +with its return value without checking latter: + + MEM = krealloc(MEM, SZ, GFP); + +If krealloc() returns NULL, that erases the pointer +to the still allocated memory, hence leaks this memory. +Instead, use a temporary variable, check it's not NULL +and only then assign it to the original pointer: + + TMP = krealloc(MEM, SZ, GFP); + if (!TMP) return; + MEM = TMP; + +While on it, use krealloc_array(). + +Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.") +Signed-off-by: Alexander A. Klimov +Signed-off-by: Maíra Canal +Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +index d48cf76983c09b..66502a6a4a8e7b 100644 +--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c ++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +@@ -290,15 +290,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va + { + uint32_t o = validated_shader->num_uniform_addr_offsets; + uint32_t num_uniforms = validated_shader->uniforms_size / 4; ++ u32 *offsets; + +- validated_shader->uniform_addr_offsets = +- krealloc(validated_shader->uniform_addr_offsets, +- (o + 1) * +- sizeof(*validated_shader->uniform_addr_offsets), +- GFP_KERNEL); +- if (!validated_shader->uniform_addr_offsets) ++ offsets = krealloc_array(validated_shader->uniform_addr_offsets, ++ o + 1, ++ sizeof(*validated_shader->uniform_addr_offsets), ++ GFP_KERNEL); ++ if (!offsets) + return false; + ++ validated_shader->uniform_addr_offsets = offsets; + validated_shader->uniform_addr_offsets[o] = num_uniforms; + validated_shader->num_uniform_addr_offsets++; + +-- +2.53.0 + diff --git a/queue-7.0/drm-virtio-fix-driver-removal-with-disabled-kms.patch b/queue-7.0/drm-virtio-fix-driver-removal-with-disabled-kms.patch new file mode 100644 index 0000000000..6951da2af5 --- /dev/null +++ b/queue-7.0/drm-virtio-fix-driver-removal-with-disabled-kms.patch @@ -0,0 +1,43 @@ +From aba62394541e1cd60a980975fcd01d0f2da3dc52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jun 2026 15:27:43 +0300 +Subject: drm/virtio: Fix driver removal with disabled KMS + +From: Dmitry Osipenko + +[ Upstream commit f329e8325e054bd6d84d10904f8dd51137281b92 ] + +DRM atomic and modesetting aren't initialized if virtio-gpu driver built +with disabled KMS, leading to access of uninitialized data on driver +removal/unbinding and crashing kernel. Fix it by skipping shutting down +atomic core with unavailable KMS. + +Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support") +Signed-off-by: Dmitry Osipenko +Tested-by: Ryosuke Yasuoka +Reviewed-by: Ryosuke Yasuoka +Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/virtio/virtgpu_drv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c +index a5ce96fb8a1d24..9af740bda83593 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_drv.c ++++ b/drivers/gpu/drm/virtio/virtgpu_drv.c +@@ -124,7 +124,10 @@ static void virtio_gpu_remove(struct virtio_device *vdev) + struct drm_device *dev = vdev->priv; + + drm_dev_unplug(dev); +- drm_atomic_helper_shutdown(dev); ++ ++ if (drm_core_check_feature(dev, DRIVER_ATOMIC)) ++ drm_atomic_helper_shutdown(dev); ++ + virtio_gpu_deinit(dev); + drm_dev_put(dev); + } +-- +2.53.0 + diff --git a/queue-7.0/drm-xe-fix-job-timeout-recovery-for-unstarted-jobs-a.patch b/queue-7.0/drm-xe-fix-job-timeout-recovery-for-unstarted-jobs-a.patch new file mode 100644 index 0000000000..3f961bf551 --- /dev/null +++ b/queue-7.0/drm-xe-fix-job-timeout-recovery-for-unstarted-jobs-a.patch @@ -0,0 +1,141 @@ +From cc4e2b797c1e6c523f1dddc378e7268ac7a48217 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jun 2026 11:25:49 -0400 +Subject: drm/xe: fix job timeout recovery for unstarted jobs and kernel queues + +From: Rodrigo Vivi + +[ Upstream commit 347ccc0453fca2c669e8dc8a72000e76ca4adf10 ] + +A job that GuC never scheduled (never started) indicates a GuC +scheduling failure; previously such jobs were silently errored out +instead of triggering a GT reset to recover. Trigger a GT reset and +resubmit them, but only when the queue was not already killed or banned: +an unstarted job on an already banned queue is the ban working as +intended and must neither clear the ban nor kick off a reset, otherwise +a banned userspace queue could be resurrected and spam GT resets. + +Kernel queues are always recovered this way and wedge the device once +recovery attempts are exhausted, since kernel work must not silently +fail. A started job that times out on a userspace VM bind queue stays +banned rather than being reset and retried. + +The queue is banned early in the timeout handler to signal the G2H +scheduling-done handler so it wakes the disable-scheduling waiter; +without it the waiter sleeps the full 5s timeout. When a reset is +warranted the ban is cleared before rearming so that +guc_exec_queue_start() can resubmit jobs after the GT reset - a +still-banned queue would block resubmission and cause an infinite TDR +loop. The already-banned case is gated out before this point via +skip_timeout_check, so it is unaffected. + +v2: (Himal) Do it for any queue type, not just kernel/migration +v3: - (Sashiko and Sanjay): don't clear the ban / GT reset for already + killed/banned queues on unstarted-job timeout + - Update commit message + - (Matt) Add Fixes tag + +Fixes: fe05cee4d953 ("drm/xe: Don't short circuit TDR on jobs not started") +Cc: Matthew Auld +Cc: Matthew Brost +Cc: Sanjay Yadav +Cc: Himal Prasad Ghimiray +Assisted-by: GitHub-Copilot:claude-sonnet-4.6 +Assisted-by: GitHub-Copilot:claude-opus-4.8 +Tested-by: Sanjay Yadav +Reviewed-by: Sanjay Yadav +Reviewed-by: Matthew Brost +Reviewed-by: Himal Prasad Ghimiray +Link: https://patch.msgid.link/20260610152548.404575-3-rodrigo.vivi@intel.com +Signed-off-by: Rodrigo Vivi +(cherry picked from commit b1107d085e7e8ed15ba6f80c102528a9c8a6cb0e) +Signed-off-by: Matthew Brost +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_guc_submit.c | 49 +++++++++++++++++++++--------- + 1 file changed, 35 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c +index e948f40fa17896..6365eca9816092 100644 +--- a/drivers/gpu/drm/xe/xe_guc_submit.c ++++ b/drivers/gpu/drm/xe/xe_guc_submit.c +@@ -159,6 +159,11 @@ static void set_exec_queue_banned(struct xe_exec_queue *q) + atomic_or(EXEC_QUEUE_STATE_BANNED, &q->guc->state); + } + ++static void clear_exec_queue_banned(struct xe_exec_queue *q) ++{ ++ atomic_andnot(EXEC_QUEUE_STATE_BANNED, &q->guc->state); ++} ++ + static bool exec_queue_suspended(struct xe_exec_queue *q) + { + return atomic_read(&q->guc->state) & EXEC_QUEUE_STATE_SUSPENDED; +@@ -1326,7 +1331,8 @@ static bool check_timeout(struct xe_exec_queue *q, struct xe_sched_job *job) + xe_sched_job_seqno(job), xe_sched_job_lrc_seqno(job), + q->guc->id); + +- return xe_sched_invalidate_job(job, 2); ++ /* GuC never scheduled this job - let the caller trigger a GT reset. */ ++ return true; + } + + ctx_timestamp = lower_32_bits(xe_lrc_timestamp(q->lrc[0])); +@@ -1423,6 +1429,21 @@ static void disable_scheduling(struct xe_exec_queue *q, bool immediate) + G2H_LEN_DW_SCHED_CONTEXT_MODE_SET, 1); + } + ++/* ++ * Recover via GT reset for a kernel queue, or for a GuC scheduling failure (job ++ * never started) on a queue that was not already killed or banned. An already ++ * banned queue must stay banned, so its unstarted jobs do not clear the ban or ++ * trigger a reset. ++ */ ++static bool timeout_needs_gt_reset(struct xe_exec_queue *q, struct xe_sched_job *job, ++ bool skip_timeout_check) ++{ ++ if (q->flags & EXEC_QUEUE_FLAG_KERNEL) ++ return true; ++ ++ return !skip_timeout_check && !xe_sched_job_started(job); ++} ++ + static enum drm_gpu_sched_stat + guc_exec_queue_timedout_job(struct drm_sched_job *drm_job) + { +@@ -1573,19 +1594,19 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job) + xe_sched_job_seqno(job), xe_sched_job_lrc_seqno(job), + q->guc->id, q->flags); + +- /* +- * Kernel jobs should never fail, nor should VM jobs if they do +- * somethings has gone wrong and the GT needs a reset +- */ +- xe_gt_WARN(q->gt, q->flags & EXEC_QUEUE_FLAG_KERNEL, +- "Kernel-submitted job timed out\n"); +- xe_gt_WARN(q->gt, q->flags & EXEC_QUEUE_FLAG_VM && !exec_queue_killed(q), +- "VM job timed out on non-killed execqueue\n"); +- if (!wedged && (q->flags & EXEC_QUEUE_FLAG_KERNEL || +- (q->flags & EXEC_QUEUE_FLAG_VM && !exec_queue_killed(q)))) { +- if (!xe_sched_invalidate_job(job, 2)) { +- xe_gt_reset_async(q->gt); +- goto rearm; ++ if (!wedged) { ++ if (timeout_needs_gt_reset(q, job, skip_timeout_check)) { ++ if (!xe_sched_invalidate_job(job, 2)) { ++ clear_exec_queue_banned(q); ++ xe_gt_reset_async(q->gt); ++ goto rearm; ++ } ++ if (q->flags & EXEC_QUEUE_FLAG_KERNEL) { ++ xe_gt_WARN(q->gt, true, "Kernel-submitted job timed out\n"); ++ xe_device_declare_wedged(gt_to_xe(q->gt)); ++ } ++ } else if (q->flags & EXEC_QUEUE_FLAG_VM && !exec_queue_killed(q)) { ++ xe_gt_WARN(q->gt, true, "VM job timed out on non-killed execqueue\n"); + } + } + +-- +2.53.0 + diff --git a/queue-7.0/drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch b/queue-7.0/drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch new file mode 100644 index 0000000000..860cda5856 --- /dev/null +++ b/queue-7.0/drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch @@ -0,0 +1,52 @@ +From 353738b1f3f334caab4fb2774e3b29e12149aee5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jun 2026 10:27:05 -0700 +Subject: drm/xe: fix refcount leak in xe_range_fence_insert() + +From: Wentao Liang + +[ Upstream commit ba36786b21d19082e696eda85bfcd49e7071944a ] + +xe_range_fence_insert() acquires a reference on fence via +dma_fence_get() and stores it in rfence->fence. It then calls +dma_fence_add_callback() and handles two cases: when the callback +is successfully registered (err == 0) the fence is transferred to +the tree for later cleanup; when the fence is already signaled +(err == -ENOENT) it manually drops the extra reference with +dma_fence_put(fence). + +However, dma_fence_add_callback() can fail with other errors +(e.g. -EINVAL) and in that case the code falls through to the free: +label without releasing the acquired reference, leaking it. + +Fix the leak by adding an else branch that calls dma_fence_put() +before jumping to free: for any error other than -ENOENT. + +Fixes: 845f64bdbfc9 ("drm/xe: Introduce a range-fence utility") +Signed-off-by: Wentao Liang +Reviewed-by: Matthew Brost +Signed-off-by: Matthew Brost +Link: https://patch.msgid.link/20260610172705.3450560-1-matthew.brost@intel.com +(cherry picked from commit 98c4a4201290823c2c5c7ba21692bd9a64b61021) +Signed-off-by: Matthew Brost +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_range_fence.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/xe/xe_range_fence.c b/drivers/gpu/drm/xe/xe_range_fence.c +index 372378e89e9892..3d8fa194a7b0eb 100644 +--- a/drivers/gpu/drm/xe/xe_range_fence.c ++++ b/drivers/gpu/drm/xe/xe_range_fence.c +@@ -77,6 +77,8 @@ int xe_range_fence_insert(struct xe_range_fence_tree *tree, + } else if (err == 0) { + xe_range_fence_tree_insert(rfence, &tree->root); + return 0; ++ } else { ++ dma_fence_put(fence); + } + + free: +-- +2.53.0 + diff --git a/queue-7.0/series b/queue-7.0/series index 9ca0d8551a..0dc277c0ac 100644 --- a/queue-7.0/series +++ b/queue-7.0/series @@ -151,3 +151,16 @@ net-txgbe-distinguish-module-types-by-checking-ident.patch net-txgbe-initialize-phy-interface-to-0.patch ipv6-fix-a-potential-npd-in-cleanup_prefix_route.patch asoc-sdca-fix-null-pointer-dereference-in-sdca_dev_u.patch +clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch +clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch +clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch +drm-i915-edp-check-supported-link-rates-dpcd-read.patch +drm-virtio-fix-driver-removal-with-disabled-kms.patch +drm-vc4-fix-krealloc-memory-leak.patch +drm-colorop-remove-read-only-comments-from-interpola.patch +drm-colorop-make-lut-1-3-d_interpolation-props-corre.patch +drm-atomic-track-individual-colorop-updates.patch +drm-amd-display-use-plane-color_mgmt_changed-to-trac.patch +drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch +drm-xe-fix-job-timeout-recovery-for-unstarted-jobs-a.patch +accel-amdxdna-fix-mm_struct-reference-leak-in-aie2_p.patch