--- /dev/null
+From 53c78ab388bfc1a4d72e756815d0db0a842c812e Mon Sep 17 00:00:00 2001
+From: Yang Wang <kevinyang.wang@amd.com>
+Date: Fri, 12 Jun 2026 10:55:09 +0800
+Subject: drm/amd/pm: make pp_features read-only when scpm is enabled
+
+From: Yang Wang <kevinyang.wang@amd.com>
+
+commit 53c78ab388bfc1a4d72e756815d0db0a842c812e upstream.
+
+SCPM owns power feature control when enabled.
+
+Make pp_features read-only during sysfs setup by clearing its write bits
+and store callback.
+
+Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6a5786e191fdce36c5db170e5209cf609e8f0087)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_pm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+@@ -2004,6 +2004,11 @@ static int default_attr_update(struct am
+ } else if (DEVICE_ATTR_IS(pp_features)) {
+ if (adev->flags & AMD_IS_APU || gc_ver < IP_VERSION(9, 0, 0))
+ *states = ATTR_STATE_UNSUPPORTED;
++
++ if (adev->scpm_enabled) {
++ dev_attr->attr.mode &= ~S_IWUGO;
++ dev_attr->store = NULL;
++ }
+ } else if (DEVICE_ATTR_IS(gpu_metrics)) {
+ if (gc_ver < IP_VERSION(9, 1, 0))
+ *states = ATTR_STATE_UNSUPPORTED;
--- /dev/null
+From 0c01c811be47e6b146552dd59bfedbea8f09b8f4 Mon Sep 17 00:00:00 2001
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+Date: Tue, 12 May 2026 10:29:36 -0400
+Subject: drm/amdgpu: fix division by zero with invalid uvd dimensions
+
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+
+commit 0c01c811be47e6b146552dd59bfedbea8f09b8f4 upstream.
+
+When width or height is less than 16, width_in_mb or height_in_mb
+becomes 0, leading to fs_in_mb being 0. This causes a division by
+zero when calculating num_dpb_buffer in H264 and H264 Perf decode
+paths.
+
+Add validation to reject frames with width < 16 or height < 16
+before performing any calculations that depend on these values.
+
+V2: Format change - move up all vaiable definitions.
+V3: Use warn_once to avoid spam.
+
+Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 3e41d26c70b0a459d041cc19482a226c4b7423cb)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+@@ -630,6 +630,14 @@ static int amdgpu_uvd_cs_msg_decode(stru
+ unsigned image_size, tmp, min_dpb_size, num_dpb_buffer;
+ unsigned min_ctx_size = ~0;
+
++ /* Reject invalid dimensions to prevent division by zero */
++ if (width < 16 || height < 16) {
++ dev_WARN_ONCE(adev->dev, 1,
++ "Invalid UVD decoding dimensions (%dx%d)!\n",
++ width, height);
++ return -EINVAL;
++ }
++
+ image_size = width * height;
+ image_size += image_size / 2;
+ image_size = ALIGN(image_size, 1024);
--- /dev/null
+From d06c4173a7c38c7a39e98859f839ce714c7af2c9 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:19:52 -0400
+Subject: drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit d06c4173a7c38c7a39e98859f839ce714c7af2c9 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ac6f00beb658239bced4aaed9efbb04a35348d48)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -3769,7 +3769,7 @@ static void gfx_v10_0_wait_reg_mem(struc
+ WAIT_REG_MEM_ENGINE(eng_sel)));
+
+ if (mem_space)
+- BUG_ON(addr0 & 0x3); /* Dword align */
++ WARN_ON(addr0 & 0x3); /* Dword align */
+ amdgpu_ring_write(ring, addr0);
+ amdgpu_ring_write(ring, addr1);
+ amdgpu_ring_write(ring, ref);
+@@ -8513,7 +8513,7 @@ static void gfx_v10_0_ring_emit_ib_gfx(s
+ control |= 0x400000;
+
+ amdgpu_ring_write(ring, header);
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -8552,7 +8552,7 @@ static void gfx_v10_0_ring_emit_ib_compu
+ }
+
+ amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -8585,9 +8585,9 @@ static void gfx_v10_0_ring_emit_fence(st
+ * aligned if only send 32bit data low (discard data high)
+ */
+ if (write64bit)
+- BUG_ON(addr & 0x7);
++ WARN_ON(addr & 0x7);
+ else
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -8639,9 +8639,6 @@ static void gfx_v10_0_ring_emit_fence_ki
+ {
+ struct amdgpu_device *adev = ring->adev;
+
+- /* we only allocate 32bit for each seq wb address */
+- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
+-
+ /* write fence seq to the "addr" */
+ amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+ amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
--- /dev/null
+From 0eebcab1ea2a77f086a04108f386f82ee3496022 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:20:55 -0400
+Subject: drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 0eebcab1ea2a77f086a04108f386f82ee3496022 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+@@ -309,7 +309,7 @@ static void gfx_v11_0_wait_reg_mem(struc
+ WAIT_REG_MEM_ENGINE(eng_sel)));
+
+ if (mem_space)
+- BUG_ON(addr0 & 0x3); /* Dword align */
++ WARN_ON(addr0 & 0x3); /* Dword align */
+ amdgpu_ring_write(ring, addr0);
+ amdgpu_ring_write(ring, addr1);
+ amdgpu_ring_write(ring, ref);
+@@ -5400,7 +5400,7 @@ static void gfx_v11_0_ring_emit_ib_gfx(s
+ control |= 0x400000;
+
+ amdgpu_ring_write(ring, header);
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -5439,7 +5439,7 @@ static void gfx_v11_0_ring_emit_ib_compu
+ }
+
+ amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -5476,9 +5476,9 @@ static void gfx_v11_0_ring_emit_fence(st
+ * aligned if only send 32bit data low (discard data high)
+ */
+ if (write64bit)
+- BUG_ON(addr & 0x7);
++ WARN_ON(addr & 0x7);
+ else
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -5530,9 +5530,6 @@ static void gfx_v11_0_ring_emit_fence_ki
+ {
+ struct amdgpu_device *adev = ring->adev;
+
+- /* we only allocate 32bit for each seq wb address */
+- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
+-
+ /* write fence seq to the "addr" */
+ amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+ amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
--- /dev/null
+From 84a1a8a952ab4b8c23c5dd1f2eea4049cb4914f5 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:17:59 -0400
+Subject: drm/amdgpu/gfx8: drop unecessary BUG_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 84a1a8a952ab4b8c23c5dd1f2eea4049cb4914f5 upstream.
+
+There's no need to crash the kernel for this case.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -6291,9 +6291,6 @@ static void gfx_v8_0_ring_emit_fence_com
+ static void gfx_v8_0_ring_emit_fence_kiq(struct amdgpu_ring *ring, u64 addr,
+ u64 seq, unsigned int flags)
+ {
+- /* we only allocate 32bit for each seq wb address */
+- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
+-
+ /* write fence seq to the "addr" */
+ amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+ amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
--- /dev/null
+From 6302be10b521f5106ce01eb5a724b9e7945a5061 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:14:59 -0400
+Subject: drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 6302be10b521f5106ce01eb5a724b9e7945a5061 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -978,7 +978,7 @@ static void gfx_v9_0_wait_reg_mem(struct
+ WAIT_REG_MEM_ENGINE(eng_sel)));
+
+ if (mem_space)
+- BUG_ON(addr0 & 0x3); /* Dword align */
++ WARN_ON(addr0 & 0x3); /* Dword align */
+ amdgpu_ring_write(ring, addr0);
+ amdgpu_ring_write(ring, addr1);
+ amdgpu_ring_write(ring, ref);
+@@ -5178,7 +5178,7 @@ static void gfx_v9_0_ring_emit_ib_gfx(st
+ }
+
+ amdgpu_ring_write(ring, header);
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -5213,7 +5213,7 @@ static void gfx_v9_0_ring_emit_ib_comput
+ }
+
+ amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -5247,9 +5247,9 @@ static void gfx_v9_0_ring_emit_fence(str
+ * aligned if only send 32bit data low (discard data high)
+ */
+ if (write64bit)
+- BUG_ON(addr & 0x7);
++ WARN_ON(addr & 0x7);
+ else
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
--- /dev/null
+From 28c9b3c5dc35cc790d11e26ca3fc6e068be63998 Mon Sep 17 00:00:00 2001
+From: Ce Sun <cesun102@amd.com>
+Date: Mon, 22 Jun 2026 22:58:16 +0800
+Subject: drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
+
+From: Ce Sun <cesun102@amd.com>
+
+commit 28c9b3c5dc35cc790d11e26ca3fc6e068be63998 upstream.
+
+Call pm_genpd_remove() to unregister from global list prior to releasing
+acp_genpd memory, and clear the pointer after free.
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit cd8650d7a91ee8b768e202354672553faa5cc1f2)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+@@ -559,7 +559,9 @@ static int acp_hw_fini(void *handle)
+
+ mfd_remove_devices(adev->acp.parent);
+ kfree(adev->acp.acp_res);
++ pm_genpd_remove(&adev->acp.acp_genpd->gpd);
+ kfree(adev->acp.acp_genpd);
++ adev->acp.acp_genpd = NULL;
+ kfree(adev->acp.acp_cell);
+
+ return 0;
--- /dev/null
+From 186bfdc4e26d019b2e7570cb121964a1d89b2e5b Mon Sep 17 00:00:00 2001
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+Date: Mon, 25 May 2026 11:34:27 -0400
+Subject: drm/amdgpu/vce: fix integer overflow in image size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+
+commit 186bfdc4e26d019b2e7570cb121964a1d89b2e5b upstream.
+
+Fix a security vulnerability where malicious VCE command streams
+with oversized dimensions (e.g. 65536×65536) cause 32-bit integer
+overflow, wrapping the calculated buffer size to 0. This bypasses
+validation and allows GPU firmware to perform out-of-bound memory
+access.
+
+The fix uses 64-bit arithmetic to detect overflow and rejects
+invalid dimensions before they reach the hardware.
+
+V2: remove redundant check
+V3: modify max height value
+V4: remove size64
+
+Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+@@ -856,9 +856,20 @@ int amdgpu_vce_ring_parse_cs(struct amdg
+ goto out;
+ }
+
+- *size = amdgpu_ib_get_value(ib, idx + 8) *
+- amdgpu_ib_get_value(ib, idx + 10) *
+- 8 * 3 / 2;
++ uint32_t width, height;
++ width = amdgpu_ib_get_value(ib, idx + 8);
++ height = amdgpu_ib_get_value(ib, idx + 10);
++
++ if (width == 0 || height == 0 ||
++ width > 4096 || height > 2304) {
++ DRM_ERROR("invalid VCE image size: %ux%u\n",
++ width, height);
++ r = -EINVAL;
++ goto out;
++ }
++
++ *size = width * height * 8 * 3 / 2;
++
+ break;
+
+ case 0x04000001: /* config extension */
mctp-serial-handle-zero-length-frames-to-prevent-rx-buffer-overflow.patch
pppoe-reload-header-pointer-after-dev_hard_header.patch
tipc-clear-sock-sk-on-the-failed-insert-path-in-tipc_sk_create.patch
+drm-amd-pm-make-pp_features-read-only-when-scpm-is-enabled.patch
+drm-amdgpu-gfx10-replace-bug_on-with-warn_on.patch
+drm-amdgpu-gfx11-replace-bug_on-with-warn_on.patch
+drm-amdgpu-gfx8-drop-unecessary-bug_on.patch
+drm-amdgpu-gfx9-replace-bug_on-with-warn_on.patch
+drm-amdgpu-vce-fix-integer-overflow-in-image-size.patch
+drm-amdgpu-fix-division-by-zero-with-invalid-uvd-dimensions.patch
+drm-amdgpu-invoke-pm_genpd_remove-before-freeing-genpd.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
