From: Greg Kroah-Hartman Date: Mon, 15 Jun 2026 16:14:25 +0000 (+0200) Subject: 6.1-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5b0d97e977dce38152f53816f1adb303122024ca;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: drm-amd-display-clamp-hdmi-hdcp2-rx_id_list-read-to-buffer-size.patch drm-amd-display-clamp-vbios-hdmi-retimer-register-count-to-array-size.patch drm-amd-display-fix-null-deref-and-buffer-over-read-in-sdp-debugfs.patch drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch drm-amdgpu-restart-the-cs-if-some-parts-of-the-vm-are-still-invalidated.patch --- diff --git a/queue-6.1/drm-amd-display-clamp-hdmi-hdcp2-rx_id_list-read-to-buffer-size.patch b/queue-6.1/drm-amd-display-clamp-hdmi-hdcp2-rx_id_list-read-to-buffer-size.patch new file mode 100644 index 0000000000..4ba247d16f --- /dev/null +++ b/queue-6.1/drm-amd-display-clamp-hdmi-hdcp2-rx_id_list-read-to-buffer-size.patch @@ -0,0 +1,47 @@ +From f0f3981c43b32cadfe373d636d9e9ca522bb3702 Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Thu, 7 May 2026 15:38:37 -0400 +Subject: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size + +From: Harry Wentland + +commit f0f3981c43b32cadfe373d636d9e9ca522bb3702 upstream. + +[Why & How] +During HDCP 2.x repeater authentication over HDMI, the driver reads the +sink's RxStatus register and extracts a 10-bit message size field (max +value 1023). This value is used as the read length for the ReceiverID +list without being clamped to the size of the destination buffer +rx_id_list[177]. A malicious HDMI repeater could advertise a message +size larger than the buffer, causing an out-of-bounds write during the +I2C read. + +Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the +rx_id_list buffer, matching the approach already used in the DP branch. + +Fixes: eff682f83c9c ("drm/amd/display: Add DDC handles for HDCP2.2") +Assisted-by: Copilot:claude-opus-4.6 +Reviewed-by: Alex Hung +Signed-off-by: Harry Wentland +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c ++++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +@@ -533,7 +533,8 @@ enum mod_hdcp_status mod_hdcp_read_rx_id + } else { + status = read(hdcp, MOD_HDCP_MESSAGE_ID_READ_REPEATER_AUTH_SEND_RECEIVERID_LIST, + hdcp->auth.msg.hdcp2.rx_id_list, +- hdcp->auth.msg.hdcp2.rx_id_list_size); ++ MIN(hdcp->auth.msg.hdcp2.rx_id_list_size, ++ sizeof(hdcp->auth.msg.hdcp2.rx_id_list))); + } + return status; + } diff --git a/queue-6.1/drm-amd-display-clamp-vbios-hdmi-retimer-register-count-to-array-size.patch b/queue-6.1/drm-amd-display-clamp-vbios-hdmi-retimer-register-count-to-array-size.patch new file mode 100644 index 0000000000..e6c5d180f2 --- /dev/null +++ b/queue-6.1/drm-amd-display-clamp-vbios-hdmi-retimer-register-count-to-array-size.patch @@ -0,0 +1,188 @@ +From fb0707ce00eef4e2d60c3020e1c0432739703e4a Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Mon, 4 May 2026 15:51:13 -0400 +Subject: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size + +From: Harry Wentland + +commit fb0707ce00eef4e2d60c3020e1c0432739703e4a upstream. + +[Why & How] +The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and +Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C +register settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9] +and dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated +before use, so a malformed VBIOS can specify values up to 255, causing an +out-of-bounds heap write during driver probe. + +Clamp each register count to the destination array size using min_t() +before the copy loops, in both get_integrated_info_v11() and +get_integrated_info_v2_1(). + +Assisted-by: GitHub Copilot:claude-opus-4.6 +Reviewed-by: Alex Hung +Signed-off-by: Harry Wentland +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 48 ++++++++++++++------- + 1 file changed, 32 insertions(+), 16 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +@@ -2520,14 +2520,16 @@ static enum bp_result get_integrated_inf + info_v11->extdispconninfo.checksum; + + info->dp0_ext_hdmi_slv_addr = info_v11->dp0_retimer_set.HdmiSlvAddr; +- info->dp0_ext_hdmi_reg_num = info_v11->dp0_retimer_set.HdmiRegNum; ++ info->dp0_ext_hdmi_reg_num = min_t(u8, info_v11->dp0_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp0_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp0_ext_hdmi_reg_num; i++) { + info->dp0_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v11->dp0_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp0_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v11->dp0_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp0_ext_hdmi_6g_reg_num = info_v11->dp0_retimer_set.Hdmi6GRegNum; ++ info->dp0_ext_hdmi_6g_reg_num = min_t(u8, info_v11->dp0_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp0_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp0_ext_hdmi_6g_reg_num; i++) { + info->dp0_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v11->dp0_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -2536,14 +2538,16 @@ static enum bp_result get_integrated_inf + } + + info->dp1_ext_hdmi_slv_addr = info_v11->dp1_retimer_set.HdmiSlvAddr; +- info->dp1_ext_hdmi_reg_num = info_v11->dp1_retimer_set.HdmiRegNum; ++ info->dp1_ext_hdmi_reg_num = min_t(u8, info_v11->dp1_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp1_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp1_ext_hdmi_reg_num; i++) { + info->dp1_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v11->dp1_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp1_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v11->dp1_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp1_ext_hdmi_6g_reg_num = info_v11->dp1_retimer_set.Hdmi6GRegNum; ++ info->dp1_ext_hdmi_6g_reg_num = min_t(u8, info_v11->dp1_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp1_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp1_ext_hdmi_6g_reg_num; i++) { + info->dp1_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v11->dp1_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -2552,14 +2556,16 @@ static enum bp_result get_integrated_inf + } + + info->dp2_ext_hdmi_slv_addr = info_v11->dp2_retimer_set.HdmiSlvAddr; +- info->dp2_ext_hdmi_reg_num = info_v11->dp2_retimer_set.HdmiRegNum; ++ info->dp2_ext_hdmi_reg_num = min_t(u8, info_v11->dp2_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp2_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp2_ext_hdmi_reg_num; i++) { + info->dp2_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v11->dp2_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp2_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v11->dp2_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp2_ext_hdmi_6g_reg_num = info_v11->dp2_retimer_set.Hdmi6GRegNum; ++ info->dp2_ext_hdmi_6g_reg_num = min_t(u8, info_v11->dp2_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp2_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp2_ext_hdmi_6g_reg_num; i++) { + info->dp2_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v11->dp2_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -2568,14 +2574,16 @@ static enum bp_result get_integrated_inf + } + + info->dp3_ext_hdmi_slv_addr = info_v11->dp3_retimer_set.HdmiSlvAddr; +- info->dp3_ext_hdmi_reg_num = info_v11->dp3_retimer_set.HdmiRegNum; ++ info->dp3_ext_hdmi_reg_num = min_t(u8, info_v11->dp3_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp3_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp3_ext_hdmi_reg_num; i++) { + info->dp3_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v11->dp3_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp3_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v11->dp3_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp3_ext_hdmi_6g_reg_num = info_v11->dp3_retimer_set.Hdmi6GRegNum; ++ info->dp3_ext_hdmi_6g_reg_num = min_t(u8, info_v11->dp3_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp3_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp3_ext_hdmi_6g_reg_num; i++) { + info->dp3_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v11->dp3_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -2725,14 +2733,16 @@ static enum bp_result get_integrated_inf + info->ext_disp_conn_info.checksum = + info_v2_1->extdispconninfo.checksum; + info->dp0_ext_hdmi_slv_addr = info_v2_1->dp0_retimer_set.HdmiSlvAddr; +- info->dp0_ext_hdmi_reg_num = info_v2_1->dp0_retimer_set.HdmiRegNum; ++ info->dp0_ext_hdmi_reg_num = min_t(u8, info_v2_1->dp0_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp0_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp0_ext_hdmi_reg_num; i++) { + info->dp0_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v2_1->dp0_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp0_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v2_1->dp0_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp0_ext_hdmi_6g_reg_num = info_v2_1->dp0_retimer_set.Hdmi6GRegNum; ++ info->dp0_ext_hdmi_6g_reg_num = min_t(u8, info_v2_1->dp0_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp0_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp0_ext_hdmi_6g_reg_num; i++) { + info->dp0_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v2_1->dp0_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -2740,14 +2750,16 @@ static enum bp_result get_integrated_inf + info_v2_1->dp0_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegVal; + } + info->dp1_ext_hdmi_slv_addr = info_v2_1->dp1_retimer_set.HdmiSlvAddr; +- info->dp1_ext_hdmi_reg_num = info_v2_1->dp1_retimer_set.HdmiRegNum; ++ info->dp1_ext_hdmi_reg_num = min_t(u8, info_v2_1->dp1_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp1_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp1_ext_hdmi_reg_num; i++) { + info->dp1_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v2_1->dp1_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp1_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v2_1->dp1_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp1_ext_hdmi_6g_reg_num = info_v2_1->dp1_retimer_set.Hdmi6GRegNum; ++ info->dp1_ext_hdmi_6g_reg_num = min_t(u8, info_v2_1->dp1_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp1_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp1_ext_hdmi_6g_reg_num; i++) { + info->dp1_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v2_1->dp1_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -2755,14 +2767,16 @@ static enum bp_result get_integrated_inf + info_v2_1->dp1_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegVal; + } + info->dp2_ext_hdmi_slv_addr = info_v2_1->dp2_retimer_set.HdmiSlvAddr; +- info->dp2_ext_hdmi_reg_num = info_v2_1->dp2_retimer_set.HdmiRegNum; ++ info->dp2_ext_hdmi_reg_num = min_t(u8, info_v2_1->dp2_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp2_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp2_ext_hdmi_reg_num; i++) { + info->dp2_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v2_1->dp2_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp2_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v2_1->dp2_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp2_ext_hdmi_6g_reg_num = info_v2_1->dp2_retimer_set.Hdmi6GRegNum; ++ info->dp2_ext_hdmi_6g_reg_num = min_t(u8, info_v2_1->dp2_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp2_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp2_ext_hdmi_6g_reg_num; i++) { + info->dp2_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v2_1->dp2_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; +@@ -2770,14 +2784,16 @@ static enum bp_result get_integrated_inf + info_v2_1->dp2_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegVal; + } + info->dp3_ext_hdmi_slv_addr = info_v2_1->dp3_retimer_set.HdmiSlvAddr; +- info->dp3_ext_hdmi_reg_num = info_v2_1->dp3_retimer_set.HdmiRegNum; ++ info->dp3_ext_hdmi_reg_num = min_t(u8, info_v2_1->dp3_retimer_set.HdmiRegNum, ++ ARRAY_SIZE(info->dp3_ext_hdmi_reg_settings)); + for (i = 0; i < info->dp3_ext_hdmi_reg_num; i++) { + info->dp3_ext_hdmi_reg_settings[i].i2c_reg_index = + info_v2_1->dp3_retimer_set.HdmiRegSetting[i].ucI2cRegIndex; + info->dp3_ext_hdmi_reg_settings[i].i2c_reg_val = + info_v2_1->dp3_retimer_set.HdmiRegSetting[i].ucI2cRegVal; + } +- info->dp3_ext_hdmi_6g_reg_num = info_v2_1->dp3_retimer_set.Hdmi6GRegNum; ++ info->dp3_ext_hdmi_6g_reg_num = min_t(u8, info_v2_1->dp3_retimer_set.Hdmi6GRegNum, ++ ARRAY_SIZE(info->dp3_ext_hdmi_6g_reg_settings)); + for (i = 0; i < info->dp3_ext_hdmi_6g_reg_num; i++) { + info->dp3_ext_hdmi_6g_reg_settings[i].i2c_reg_index = + info_v2_1->dp3_retimer_set.Hdmi6GhzRegSetting[i].ucI2cRegIndex; diff --git a/queue-6.1/drm-amd-display-fix-null-deref-and-buffer-over-read-in-sdp-debugfs.patch b/queue-6.1/drm-amd-display-fix-null-deref-and-buffer-over-read-in-sdp-debugfs.patch new file mode 100644 index 0000000000..2b5658b81a --- /dev/null +++ b/queue-6.1/drm-amd-display-fix-null-deref-and-buffer-over-read-in-sdp-debugfs.patch @@ -0,0 +1,53 @@ +From adf67034b1f61f7119295208085bfd43f85f56af Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Mon, 11 May 2026 16:46:25 -0400 +Subject: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs + +From: Harry Wentland + +commit adf67034b1f61f7119295208085bfd43f85f56af upstream. + +[Why & How] +dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc +without checking for NULL. A connector can be connected but not bound to +any CRTC (e.g. after hot-plug before the next atomic commit), causing a +kernel crash when writing to the sdp_message debugfs node. + +The function also ignores the user-provided size argument and always +passes 36 bytes to copy_from_user(), reading past the user buffer when +size < 36. + +Fix both issues by: +- Returning -ENODEV when connector->base.state or state->crtc is NULL +- Clamping write_size to min(size, sizeof(data)) + +Fixes: c7ba3653e977 ("drm/amd/display: Generic SDP message access in amdgpu") +Assisted-by: Copilot:claude-opus-4.6 +Reviewed-by: Alex Hung +Signed-off-by: Harry Wentland +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +@@ -1053,8 +1053,13 @@ static ssize_t dp_sdp_message_debugfs_wr + if (size == 0) + return 0; + ++ if (!connector->base.state || !connector->base.state->crtc) ++ return -ENODEV; ++ + acrtc_state = to_dm_crtc_state(connector->base.state->crtc->state); + ++ write_size = min_t(size_t, size, sizeof(data)); ++ + r = copy_from_user(data, buf, write_size); + + write_size -= r; diff --git a/queue-6.1/drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch b/queue-6.1/drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch new file mode 100644 index 0000000000..88e1802537 --- /dev/null +++ b/queue-6.1/drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch @@ -0,0 +1,46 @@ +From da48bc4461b8a5ebfb9264c9b191a701d8e99009 Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Tue, 5 May 2026 11:52:15 -0400 +Subject: drm/amd/display: Use krealloc_array() in dal_vector_reserve() + +From: Harry Wentland + +commit da48bc4461b8a5ebfb9264c9b191a701d8e99009 upstream. + +[Why & How] +dal_vector_reserve() computes the allocation size as +"capacity * vector->struct_size" using uint32_t arithmetic, which can +silently wrap to a small value on overflow. This would cause krealloc to +return a smaller buffer than expected, leading to heap overflows on +subsequent vector appends. + +Replace krealloc() with krealloc_array() which performs an internal +overflow check and returns NULL on wrap, preventing the issue. + +Fixes: 2004f45ef83f ("drm/amd/display: Use kernel alloc/free") +Assisted-by: Copilot:claude-opus-4.6 +Reviewed-by: Alex Hung +Signed-off-by: Harry Wentland +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/basics/vector.c ++++ b/drivers/gpu/drm/amd/display/dc/basics/vector.c +@@ -289,8 +289,8 @@ bool dal_vector_reserve(struct vector *v + if (capacity <= vector->capacity) + return true; + +- new_container = krealloc(vector->container, +- capacity * vector->struct_size, GFP_KERNEL); ++ new_container = krealloc_array(vector->container, ++ capacity, vector->struct_size, GFP_KERNEL); + + if (new_container) { + vector->container = new_container; diff --git a/queue-6.1/drm-amdgpu-restart-the-cs-if-some-parts-of-the-vm-are-still-invalidated.patch b/queue-6.1/drm-amdgpu-restart-the-cs-if-some-parts-of-the-vm-are-still-invalidated.patch new file mode 100644 index 0000000000..579d91570a --- /dev/null +++ b/queue-6.1/drm-amdgpu-restart-the-cs-if-some-parts-of-the-vm-are-still-invalidated.patch @@ -0,0 +1,48 @@ +From 40396ffdf6120e2380706c59e1a84d7e765a37b6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Wed, 25 Feb 2026 15:12:02 +0100 +Subject: drm/amdgpu: restart the CS if some parts of the VM are still invalidated +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +commit 40396ffdf6120e2380706c59e1a84d7e765a37b6 upstream. + +Make sure that we only submit work with full up to date VM page tables. + +Backport to 7.1 and older. + +Signed-off-by: Christian König +Reviewed-by: Vitaly Prosyak +Tested-by: Vitaly Prosyak +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 59720bfd8c6dbebeb8d5a7ab64241b007efd9213) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -1227,6 +1227,7 @@ static int amdgpu_cs_submit(struct amdgp + { + struct amdgpu_fpriv *fpriv = p->filp->driver_priv; + struct amdgpu_job *leader = p->gang_leader; ++ struct amdgpu_vm *vm = &fpriv->vm; + struct amdgpu_bo_list_entry *e; + unsigned int i; + uint64_t seq; +@@ -1268,7 +1269,8 @@ static int amdgpu_cs_submit(struct amdgp + r |= !amdgpu_ttm_tt_get_user_pages_done(bo->tbo.ttm, e->range); + e->range = NULL; + } +- if (r) { ++ ++ if (r || !list_empty(&vm->invalidated)) { + r = -EAGAIN; + mutex_unlock(&p->adev->notifier_lock); + return r; diff --git a/queue-6.1/series b/queue-6.1/series index ababb57285..fae6ff975e 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -319,3 +319,8 @@ thunderbolt-validate-xdomain-request-packet-size-before-type-cast.patch thunderbolt-limit-xdomain-response-copy-to-actual-frame-size.patch slimbus-qcom-ngd-ctrl-fix-of-node-refcount.patch slimbus-qcom-ngd-ctrl-avoid-abba-on-tx_lock-ctrl-lock.patch +drm-amdgpu-restart-the-cs-if-some-parts-of-the-vm-are-still-invalidated.patch +drm-amd-display-clamp-hdmi-hdcp2-rx_id_list-read-to-buffer-size.patch +drm-amd-display-clamp-vbios-hdmi-retimer-register-count-to-array-size.patch +drm-amd-display-fix-null-deref-and-buffer-over-read-in-sdp-debugfs.patch +drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch