--- /dev/null
+From e987eabc02646920cd13ab75902693e99735eca0 Mon Sep 17 00:00:00 2001
+From: Yang Wang <kevinyang.wang@amd.com>
+Date: Mon, 6 Jul 2026 09:29:24 +0800
+Subject: drm/amd/pm: fix smu14 power limit range calculation
+
+From: Yang Wang <kevinyang.wang@amd.com>
+
+commit e987eabc02646920cd13ab75902693e99735eca0 upstream.
+
+SMU14 derives the default PPT limit from SocketPowerLimitAc/Dc, but
+MsgLimits.Power may expose a different firmware limit for the same PPT0
+throttler. Using those values independently as fixed min/max bases can
+report an incorrect configurable power range.
+
+Keep the socket power limit as the default value and as the fallback for
+current-limit queries. Calculate the reported range from both firmware
+values instead, using the lower value as the minimum base and the higher
+value as the maximum base before applying OD percentages.
+
+Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit c936b8126b444401318fcbeb1828488cc5312dee)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 28 ++++++++++---------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
+@@ -1672,19 +1672,23 @@ static int smu_v14_0_2_get_power_limit(s
+ table_context->power_play_table;
+ PPTable_t *pptable = table_context->driver_pptable;
+ CustomSkuTable_t *skutable = &pptable->CustomSkuTable;
+- int16_t od_percent_upper = 0, od_percent_lower = 0;
++ uint32_t pp_limit = smu->adev->pm.ac_power ?
++ skutable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] :
++ skutable->SocketPowerLimitDc[PPT_THROTTLER_PPT0];
+ uint32_t msg_limit = pptable->SkuTable.MsgLimits.Power[PPT_THROTTLER_PPT0][POWER_SOURCE_AC];
+- uint32_t power_limit;
++ uint32_t min_limit = min_t(uint32_t, pp_limit, msg_limit);
++ uint32_t max_limit = max_t(uint32_t, pp_limit, msg_limit);
++ int16_t od_percent_upper = 0, od_percent_lower = 0;
++ int ret;
+
+- if (smu_v14_0_get_current_power_limit(smu, &power_limit))
+- power_limit = smu->adev->pm.ac_power ?
+- skutable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] :
+- skutable->SocketPowerLimitDc[PPT_THROTTLER_PPT0];
++ if (current_power_limit) {
++ ret = smu_v14_0_get_current_power_limit(smu, current_power_limit);
++ if (ret)
++ *current_power_limit = pp_limit;
++ }
+
+- if (current_power_limit)
+- *current_power_limit = power_limit;
+ if (default_power_limit)
+- *default_power_limit = power_limit;
++ *default_power_limit = pp_limit;
+
+ if (powerplay_table) {
+ if (smu->od_enabled &&
+@@ -1698,15 +1702,15 @@ static int smu_v14_0_2_get_power_limit(s
+ }
+
+ dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n",
+- od_percent_upper, od_percent_lower, power_limit);
++ od_percent_upper, od_percent_lower, pp_limit);
+
+ if (max_power_limit) {
+- *max_power_limit = msg_limit * (100 + od_percent_upper);
++ *max_power_limit = max_limit * (100 + od_percent_upper);
+ *max_power_limit /= 100;
+ }
+
+ if (min_power_limit) {
+- *min_power_limit = power_limit * (100 + od_percent_lower);
++ *min_power_limit = min_limit * (100 + od_percent_lower);
+ *min_power_limit /= 100;
+ }
+
--- /dev/null
+From 04cc4aa3617b0ed67e859f91f09de5d896a46f3a Mon Sep 17 00:00:00 2001
+From: Shahyan Soltani <shahyan.soltani@amd.com>
+Date: Mon, 6 Jul 2026 08:15:21 -0400
+Subject: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shahyan Soltani <shahyan.soltani@amd.com>
+
+commit 04cc4aa3617b0ed67e859f91f09de5d896a46f3a upstream.
+
+The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only
+valid while the lock is still being held. Once xa_unlock_irqrestore is
+called and returned, the pointer is no longer under lock and is subject
+to modification. Since, the caller still dereferences vm->task_info in
+amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a
+use after unlock problem.
+
+Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid()
+through removing the amdgpu_vm_get_vm_from_pasid() function from
+amdgpu_vm.c and making the relevant code inline to hold the lock while
+it is still in use.
+
+Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 25 ++++++++++---------------
+ 1 file changed, 10 insertions(+), 15 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -2308,19 +2308,6 @@ static void amdgpu_vm_destroy_task_info(
+ kfree(ti);
+ }
+
+-static inline struct amdgpu_vm *
+-amdgpu_vm_get_vm_from_pasid(struct amdgpu_device *adev, u32 pasid)
+-{
+- struct amdgpu_vm *vm;
+- unsigned long flags;
+-
+- xa_lock_irqsave(&adev->vm_manager.pasids, flags);
+- vm = xa_load(&adev->vm_manager.pasids, pasid);
+- xa_unlock_irqrestore(&adev->vm_manager.pasids, flags);
+-
+- return vm;
+-}
+-
+ /**
+ * amdgpu_vm_put_task_info - reference down the vm task_info ptr
+ *
+@@ -2366,8 +2353,16 @@ amdgpu_vm_get_task_info_vm(struct amdgpu
+ struct amdgpu_task_info *
+ amdgpu_vm_get_task_info_pasid(struct amdgpu_device *adev, u32 pasid)
+ {
+- return amdgpu_vm_get_task_info_vm(
+- amdgpu_vm_get_vm_from_pasid(adev, pasid));
++ struct amdgpu_task_info *ti;
++ struct amdgpu_vm *vm;
++ unsigned long flags;
++
++ xa_lock_irqsave(&adev->vm_manager.pasids, flags);
++ vm = xa_load(&adev->vm_manager.pasids, pasid);
++ ti = amdgpu_vm_get_task_info_vm(vm);
++ xa_unlock_irqrestore(&adev->vm_manager.pasids, flags);
++
++ return ti;
+ }
+
+ static int amdgpu_vm_create_task_info(struct amdgpu_vm *vm)
--- /dev/null
+From f0262c3a3f14d60140f6b826d40d44edf62c36d6 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 26 Jun 2026 16:29:13 -0400
+Subject: drm/gfx10: Program DB_RING_CONTROL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit f0262c3a3f14d60140f6b826d40d44edf62c36d6 upstream.
+
+This is needed to allocate occlusion counters across
+both gfx pipes.
+
+Fixes: b7a1a0ef12b8 ("drm/amd/amdgpu: add pipe1 hardware support")
+Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6807352cbabb74b61ba42888769283af72191f66)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -5195,6 +5195,15 @@ static void gfx_v10_0_constants_init(str
+ gfx_v10_0_get_tcc_info(adev);
+ adev->gfx.config.pa_sc_tile_steering_override =
+ gfx_v10_0_init_pa_sc_tile_steering_override(adev);
++ /* Program DB_RING_CONTROL for multiple GFX pipes
++ * Default power up value is 1.
++ * Possible values:
++ * 0 - split occlusion counters between gfx pipes
++ * 1 - all occlusion counters to pipe 0
++ * 2 - all occlusion counters to pipe 1
++ */
++ WREG32_FIELD15(GC, 0, DB_RING_CONTROL, COUNTER_CONTROL,
++ (adev->gfx.me.num_pipe_per_me > 1) ? 0 : 1);
+
+ /* XXX SH_MEM regs */
+ /* where to put LDS, scratch, GPUVM in FSA64 space */
--- /dev/null
+From 2084503f2d087bf956198e7f6eb25b03a7049cb2 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Fri, 26 Jun 2026 17:01:55 +0300
+Subject: drm/i915/bios: range check LFP Data Block panel_type2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 2084503f2d087bf956198e7f6eb25b03a7049cb2 upstream.
+
+While the panel_type from LFP Data Block is range checked, panel_type2
+is not. Add a few helpers for range checking, and use them to not only
+check panel_type2, but also improve clarity and correctness in the panel
+type selection.
+
+Discovered using AI-assisted static analysis confirmed by Intel Product
+Security.
+
+v2:
+- Fix commit message typo (Michał)
+- Add is_panel_type_pnp() (Ville)
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT")
+Cc: stable@vger.kernel.org # v6.0+
+Cc: Animesh Manna <animesh.manna@intel.com>
+Cc: Ville Syrjälä <ville.syrjala@intel.com>
+Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> # v1
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patch.msgid.link/20260626140155.1389655-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit c9ebe5d2f25729d6cfbbb1235d640bf67f9275df)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_bios.c | 36 +++++++++++++++++++++++-------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_bios.c
++++ b/drivers/gpu/drm/i915/display/intel_bios.c
+@@ -620,6 +620,21 @@ get_lfp_data_tail(const struct bdb_lfp_d
+ return NULL;
+ }
+
++static bool is_panel_type_valid(int panel_type)
++{
++ return panel_type >= 0 && panel_type < 16;
++}
++
++static bool is_panel_type_pnp(int panel_type)
++{
++ return panel_type == 0xff;
++}
++
++static bool is_panel_type_valid_or_pnp(int panel_type)
++{
++ return is_panel_type_valid(panel_type) || is_panel_type_pnp(panel_type);
++}
++
+ static int opregion_get_panel_type(struct intel_display *display,
+ const struct intel_bios_encoder_data *devdata,
+ const struct drm_edid *drm_edid, bool use_fallback)
+@@ -637,15 +652,21 @@ static int vbt_get_panel_type(struct int
+ if (!lfp_options)
+ return -1;
+
+- if (lfp_options->panel_type > 0xf &&
+- lfp_options->panel_type != 0xff) {
++ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type)) {
+ drm_dbg_kms(display->drm, "Invalid VBT panel type 0x%x\n",
+ lfp_options->panel_type);
+ return -1;
+ }
+
+- if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2)
++ if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2) {
++ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type2)) {
++ drm_dbg_kms(display->drm, "Invalid VBT panel type 2 0x%x\n",
++ lfp_options->panel_type2);
++ return -1;
++ }
++
+ return lfp_options->panel_type2;
++ }
+
+ drm_WARN_ON(display->drm,
+ devdata && devdata->child.handle != DEVICE_HANDLE_LFP1);
+@@ -759,13 +780,12 @@ static int get_panel_type(struct intel_d
+ panel_types[i].name, panel_types[i].panel_type);
+ }
+
+- if (panel_types[PANEL_TYPE_OPREGION].panel_type >= 0)
++ if (is_panel_type_valid(panel_types[PANEL_TYPE_OPREGION].panel_type))
+ i = PANEL_TYPE_OPREGION;
+- else if (panel_types[PANEL_TYPE_VBT].panel_type == 0xff &&
+- panel_types[PANEL_TYPE_PNPID].panel_type >= 0)
++ else if (is_panel_type_pnp(panel_types[PANEL_TYPE_VBT].panel_type) &&
++ is_panel_type_valid(panel_types[PANEL_TYPE_PNPID].panel_type))
+ i = PANEL_TYPE_PNPID;
+- else if (panel_types[PANEL_TYPE_VBT].panel_type != 0xff &&
+- panel_types[PANEL_TYPE_VBT].panel_type >= 0)
++ else if (is_panel_type_valid(panel_types[PANEL_TYPE_VBT].panel_type))
+ i = PANEL_TYPE_VBT;
+ else
+ i = PANEL_TYPE_FALLBACK;
--- /dev/null
+From eed3de2acf6aa5154d49098b026710b646db67ee Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 1 Jul 2026 10:30:30 +0300
+Subject: drm/i915/gem: Do not leak siblings[] on proto context error
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit eed3de2acf6aa5154d49098b026710b646db67ee upstream.
+
+After a successful BALANCE/PARALLEL_SUBMIT extension on context
+creation, error during processing of next user extension leaks
+the siblings[] array. Fix that.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)")
+Cc: Faith Ekstrand <faith.ekstrand@collabora.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.15+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -771,8 +771,8 @@ static int set_proto_ctx_engines(struct
+ struct intel_engine_cs *engine;
+
+ if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) {
+- kfree(set.engines);
+- return -EFAULT;
++ err = -EFAULT;
++ goto err;
+ }
+
+ memset(&set.engines[n], 0, sizeof(set.engines[n]));
+@@ -788,8 +788,8 @@ static int set_proto_ctx_engines(struct
+ drm_dbg(&i915->drm,
+ "Invalid engine[%d]: { class:%d, instance:%d }\n",
+ n, ci.engine_class, ci.engine_instance);
+- kfree(set.engines);
+- return -ENOENT;
++ err = -ENOENT;
++ goto err;
+ }
+
+ set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL;
+@@ -802,15 +802,21 @@ static int set_proto_ctx_engines(struct
+ set_proto_ctx_engines_extensions,
+ ARRAY_SIZE(set_proto_ctx_engines_extensions),
+ &set);
+- if (err) {
+- kfree(set.engines);
+- return err;
+- }
++ if (err)
++ goto err_extensions;
+
+ pc->num_user_engines = set.num_engines;
+ pc->user_engines = set.engines;
+
+ return 0;
++
++err_extensions:
++ for (n = 0; n < set.num_engines; n++)
++ kfree(set.engines[n].siblings);
++err:
++ kfree(set.engines);
++
++ return err;
+ }
+
+ static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv,
--- /dev/null
+From 2b56757a9a7456825eb668fde92299e01c5e2721 Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 1 Jul 2026 10:55:55 +0300
+Subject: drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 2b56757a9a7456825eb668fde92299e01c5e2721 upstream.
+
+Setting context engine slot N into I915_ENGINE_CLASS_INVALID /
+I915_ENGINE_CLASS_INVALID_NONE and attempting to apply
+I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL.
+Fix that.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)")
+Cc: Faith Ekstrand <faith.ekstrand@collabora.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.15+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://patch.msgid.link/20260701075555.52142-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -858,7 +858,7 @@ static int set_proto_ctx_sseu(struct drm
+ pe = &pc->user_engines[idx];
+
+ /* Only render engine supports RPCS configuration. */
+- if (pe->engine->class != RENDER_CLASS)
++ if (!pe->engine || pe->engine->class != RENDER_CLASS)
+ return -EINVAL;
+
+ sseu = &pe->sseu;
--- /dev/null
+From 1e33f0de5fdcd09e51fdec1e5822448970b6420f Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 24 Jun 2026 12:09:40 +0300
+Subject: drm/i915: Return NULL on error in active_instance
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 1e33f0de5fdcd09e51fdec1e5822448970b6420f upstream.
+
+Avoid returning &node->base when node is NULL due to OOM
+during GFP_ATOMIC allocation.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: bfaae47db3c0 ("drm/i915: make lockdep slightly happier about execbuf.")
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: <stable@vger.kernel.org> # v5.13+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Link: https://patch.msgid.link/20260624090940.74840-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 6029bc064f0b1bac184203a50fbaaf070fa18832)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_active.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_active.c
++++ b/drivers/gpu/drm/i915/i915_active.c
+@@ -319,7 +319,7 @@ active_instance(struct i915_active *ref,
+ */
+ node = kmem_cache_alloc(slab_cache, GFP_ATOMIC);
+ if (!node)
+- goto out;
++ goto err;
+
+ __i915_active_fence_init(&node->base, NULL, node_retire);
+ node->ref = ref;
+@@ -333,6 +333,11 @@ out:
+ spin_unlock_irq(&ref->tree_lock);
+
+ return &node->base;
++
++err:
++ spin_unlock_irq(&ref->tree_lock);
++
++ return NULL;
+ }
+
+ void __i915_active_init(struct i915_active *ref,
drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch
drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch
drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch
+drm-i915-return-null-on-error-in-active_instance.patch
+drm-i915-bios-range-check-lfp-data-block-panel_type2.patch
+drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch
+drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch
+drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch
+drm-amd-pm-fix-smu14-power-limit-range-calculation.patch
+drm-gfx10-program-db_ring_control.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
