+++ /dev/null
-From 90c0486a82e27393f9eaf3bb350f51a0bd38cb6b Mon Sep 17 00:00:00 2001
-From: Jani Nikula <jani.nikula@intel.com>
-Date: Wed, 10 Jun 2026 17:15:49 +0300
-Subject: drm/displayid: fix Tiled Display Topology ID size
-
-From: Jani Nikula <jani.nikula@intel.com>
-
-commit 90c0486a82e27393f9eaf3bb350f51a0bd38cb6b upstream.
-
-The Tiled Display Topology ID of a DisplayID Tiled Display Topology Data
-Block consists of three fields:
-
-- Tiled Display Manufacturer/Vendor ID Field (3 bytes)
-- Tiled Display Product ID Code Field (2 bytes)
-- Tiled Display Serial Number Field (4 bytes)
-
-i.e. a total of 9 bytes, not 8.
-
-The DisplayID Tiled Display Topology ID is used as the tile group
-identifier.
-
-Update both struct displayid_tiled_block topology_id member and struct
-drm_tile_group group_data member to full 9 bytes.
-
-The group data was missing the last byte of the serial number. I don't
-know whether there are known bug reports that might be linked to this,
-but it's plausible the last byte could be the differentiating part for
-the tile groups, and fewer tile groups might have been created than
-intended.
-
-Fixes: b49b55bd4fba ("drm/displayid: add displayid defines and edid extension (v2)")
-Fixes: 138f9ebb9755 ("drm: add tile_group support. (v3)")
-Cc: Dave Airlie <airlied@redhat.com>
-Cc: stable@vger.kernel.org # v3.19+
-Reviewed-by: Dave Airlie <airlied@redhat.com>
-Link: https://patch.msgid.link/20260610141549.555605-1-jani.nikula@intel.com
-Signed-off-by: Jani Nikula <jani.nikula@intel.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/gpu/drm/drm_connector.c | 12 ++++++------
- drivers/gpu/drm/drm_displayid_internal.h | 2 +-
- include/drm/drm_connector.h | 6 +++---
- 3 files changed, 10 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
-index 47dc53c4a738..29634757c06d 100644
---- a/drivers/gpu/drm/drm_connector.c
-+++ b/drivers/gpu/drm/drm_connector.c
-@@ -3576,7 +3576,7 @@ EXPORT_SYMBOL(drm_mode_put_tile_group);
- /**
- * drm_mode_get_tile_group - get a reference to an existing tile group
- * @dev: DRM device
-- * @topology: 8-bytes unique per monitor.
-+ * @topology_id: 9-byte unique ID per monitor.
- *
- * Use the unique bytes to get a reference to an existing tile group.
- *
-@@ -3584,14 +3584,14 @@ EXPORT_SYMBOL(drm_mode_put_tile_group);
- * tile group or NULL if not found.
- */
- struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
-- const char topology[8])
-+ const char topology_id[9])
- {
- struct drm_tile_group *tg;
- int id;
-
- mutex_lock(&dev->mode_config.idr_mutex);
- idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) {
-- if (!memcmp(tg->group_data, topology, 8)) {
-+ if (!memcmp(tg->group_data, topology_id, sizeof(tg->group_data))) {
- if (!kref_get_unless_zero(&tg->refcount))
- tg = NULL;
- mutex_unlock(&dev->mode_config.idr_mutex);
-@@ -3606,7 +3606,7 @@ EXPORT_SYMBOL(drm_mode_get_tile_group);
- /**
- * drm_mode_create_tile_group - create a tile group from a displayid description
- * @dev: DRM device
-- * @topology: 8-bytes unique per monitor.
-+ * @topology_id: 9-byte unique ID per monitor.
- *
- * Create a tile group for the unique monitor, and get a unique
- * identifier for the tile group.
-@@ -3615,7 +3615,7 @@ EXPORT_SYMBOL(drm_mode_get_tile_group);
- * new tile group or NULL.
- */
- struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
-- const char topology[8])
-+ const char topology_id[9])
- {
- struct drm_tile_group *tg;
- int ret;
-@@ -3625,7 +3625,7 @@ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
- return NULL;
-
- kref_init(&tg->refcount);
-- memcpy(tg->group_data, topology, 8);
-+ memcpy(tg->group_data, topology_id, sizeof(tg->group_data));
- tg->dev = dev;
-
- mutex_lock(&dev->mode_config.idr_mutex);
-diff --git a/drivers/gpu/drm/drm_displayid_internal.h b/drivers/gpu/drm/drm_displayid_internal.h
-index 5b1b32f73516..4590d6a3d821 100644
---- a/drivers/gpu/drm/drm_displayid_internal.h
-+++ b/drivers/gpu/drm/drm_displayid_internal.h
-@@ -109,7 +109,7 @@ struct displayid_tiled_block {
- u8 topo[3];
- u8 tile_size[4];
- u8 tile_pixel_bezel[5];
-- u8 topology_id[8];
-+ u8 topology_id[9];
- } __packed;
-
- struct displayid_detailed_timings_1 {
-diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
-index f83f28cae207..877b5ca87e95 100644
---- a/include/drm/drm_connector.h
-+++ b/include/drm/drm_connector.h
-@@ -2608,13 +2608,13 @@ struct drm_tile_group {
- struct kref refcount;
- struct drm_device *dev;
- int id;
-- u8 group_data[8];
-+ u8 group_data[9];
- };
-
- struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
-- const char topology[8]);
-+ const char topology_id[9]);
- struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev,
-- const char topology[8]);
-+ const char topology_id[9]);
- void drm_mode_put_tile_group(struct drm_device *dev,
- struct drm_tile_group *tg);
-
---
-2.55.0
-
--- /dev/null
+From eed3de2acf6aa5154d49098b026710b646db67ee Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 1 Jul 2026 10:30:30 +0300
+Subject: drm/i915/gem: Do not leak siblings[] on proto context error
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit eed3de2acf6aa5154d49098b026710b646db67ee upstream.
+
+After a successful BALANCE/PARALLEL_SUBMIT extension on context
+creation, error during processing of next user extension leaks
+the siblings[] array. Fix that.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)")
+Cc: Faith Ekstrand <faith.ekstrand@collabora.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.15+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -768,8 +768,8 @@ static int set_proto_ctx_engines(struct
+ struct intel_engine_cs *engine;
+
+ if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) {
+- kfree(set.engines);
+- return -EFAULT;
++ err = -EFAULT;
++ goto err;
+ }
+
+ memset(&set.engines[n], 0, sizeof(set.engines[n]));
+@@ -785,8 +785,8 @@ static int set_proto_ctx_engines(struct
+ drm_dbg(&i915->drm,
+ "Invalid engine[%d]: { class:%d, instance:%d }\n",
+ n, ci.engine_class, ci.engine_instance);
+- kfree(set.engines);
+- return -ENOENT;
++ err = -ENOENT;
++ goto err;
+ }
+
+ set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL;
+@@ -799,15 +799,21 @@ static int set_proto_ctx_engines(struct
+ set_proto_ctx_engines_extensions,
+ ARRAY_SIZE(set_proto_ctx_engines_extensions),
+ &set);
+- if (err) {
+- kfree(set.engines);
+- return err;
+- }
++ if (err)
++ goto err_extensions;
+
+ pc->num_user_engines = set.num_engines;
+ pc->user_engines = set.engines;
+
+ return 0;
++
++err_extensions:
++ for (n = 0; n < set.num_engines; n++)
++ kfree(set.engines[n].siblings);
++err:
++ kfree(set.engines);
++
++ return err;
+ }
+
+ static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv,
--- /dev/null
+From 2b56757a9a7456825eb668fde92299e01c5e2721 Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 1 Jul 2026 10:55:55 +0300
+Subject: drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 2b56757a9a7456825eb668fde92299e01c5e2721 upstream.
+
+Setting context engine slot N into I915_ENGINE_CLASS_INVALID /
+I915_ENGINE_CLASS_INVALID_NONE and attempting to apply
+I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL.
+Fix that.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)")
+Cc: Faith Ekstrand <faith.ekstrand@collabora.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.15+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://patch.msgid.link/20260701075555.52142-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -855,7 +855,7 @@ static int set_proto_ctx_sseu(struct drm
+ pe = &pc->user_engines[idx];
+
+ /* Only render engine supports RPCS configuration. */
+- if (pe->engine->class != RENDER_CLASS)
++ if (!pe->engine || pe->engine->class != RENDER_CLASS)
+ return -EINVAL;
+
+ sseu = &pe->sseu;
--- /dev/null
+From 1e33f0de5fdcd09e51fdec1e5822448970b6420f Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 24 Jun 2026 12:09:40 +0300
+Subject: drm/i915: Return NULL on error in active_instance
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 1e33f0de5fdcd09e51fdec1e5822448970b6420f upstream.
+
+Avoid returning &node->base when node is NULL due to OOM
+during GFP_ATOMIC allocation.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: bfaae47db3c0 ("drm/i915: make lockdep slightly happier about execbuf.")
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: <stable@vger.kernel.org> # v5.13+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Link: https://patch.msgid.link/20260624090940.74840-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 6029bc064f0b1bac184203a50fbaaf070fa18832)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_active.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_active.c
++++ b/drivers/gpu/drm/i915/i915_active.c
+@@ -319,7 +319,7 @@ active_instance(struct i915_active *ref,
+ */
+ node = kmem_cache_alloc(slab_cache, GFP_ATOMIC);
+ if (!node)
+- goto out;
++ goto err;
+
+ __i915_active_fence_init(&node->base, NULL, node_retire);
+ node->ref = ref;
+@@ -333,6 +333,11 @@ out:
+ spin_unlock_irq(&ref->tree_lock);
+
+ return &node->base;
++
++err:
++ spin_unlock_irq(&ref->tree_lock);
++
++ return NULL;
+ }
+
+ void __i915_active_init(struct i915_active *ref,
drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch
drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch
drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch
-drm-displayid-fix-tiled-display-topology-id-size.patch
+drm-i915-return-null-on-error-in-active_instance.patch
+drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch
+drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
