Merge tag 'drm-fixes-2026-05-30' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Regular pull, doesn't seem too insane or AI owned, couple of UAF fixes
  and another repair for an earlier fix, mostly amdgpu and i915 display
  with xe/i915 accel, and misc core/driver fixes.

  It might be a bit bigger than usual at this stage, but I'm not seeing
  anything too scary here.

  dumb-buffer:
   - prevent overflows in dumb-buffer creation

  dma-buf:
   - fix UAF in dma_buf_fd() tracepoint

  gem:
   - fix for the fix for the fix for the change handle ioctl

  i915:
   - Fix potential UAF in TTM object purge
   - Use polling when irqs are unavailable
   - Fix HDR pre-CSC LUT programming loop
   - Block DC states on vblank enable when Panel Replay supported
   - Use DC_OFF wake reference to block DC6 on vblank enable

  xe:
   - Restore IDLEDLY regiter on engine reset

  amdgpu:
   - GEM_OP warning fix
   - GEM_OP locking fix
   - Userq fixes
   - DCN 2.1 refclk fix
   - SI fix
   - HMM fixes

  amdkfd:
   - svm_range_set_attr locking fix
   - CRIU restore fix
   - KFD debugger fix

  amdxdna:
   - require IOMMU on AIE2

  hyperv:
   - improve protocol validation

  ivpu:
   - test write offset in debugfs

  rocket:
   - fix UAF in bo creation"

* tag 'drm-fixes-2026-05-30' of https://gitlab.freedesktop.org/drm/kernel: (33 commits)
  drm/gem: fix race between change_handle and handle_delete
  drm: prevent integer overflows in dumb buffer creation helpers
  dma-buf: fix UAF in dma_buf_fd() tracepoint
  drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
  drm/amdgpu: fix amdgpu_hmm_range_get_pages
  drm/amdgpu/userq: use array instead of list for userq_vas
  drm/amdgpu/userq: move mqd_destroy to later stage to keep core obj valid
  drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
  drm/amdgpu/userq: remove amdgpu_userq_create/destroy_object wrapper
  drm/amd/pm/si: Disregard vblank time when no displays are connected
  drm/amdkfd: Check for pdd drm file first in CRIU restore path
  drm/amdgpu: fix potential overflow in fs_info.debugfs_name
  drm/amdgpu/userq: make sure queue is valid in the hang_detect_work
  drm/amdgpu/userq: reserve root bo without interruption
  drm/amdgpu/userq: add amdgpu_bo_unpin when amdgpu_ttm_alloc_gart fails
  drm/amdgpu: simplify return value in amdgpu_userq_get_doorbell_index
  drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
  drm/amd/display: Write REFCLK to 48MHz on DCN21
  drm/amdgpu/userq: Fix the mutex_init cleanup for fence_drv_lock
  drm/amdgpu/userq: Fix doorbell object cleanup of queue
  ...