5.15-stable patches

added patches:
	drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch
	drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch
	drm-i915-return-null-on-error-in-active_instance.patch

diff --git a/queue-5.15/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch b/queue-5.15/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch
new file mode 100644 (file)
index 0000000..e68098e
--- /dev/null
+++ b/queue-5.15/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch
@@ -0,0 +1,84 @@
+From eed3de2acf6aa5154d49098b026710b646db67ee Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 1 Jul 2026 10:30:30 +0300
+Subject: drm/i915/gem: Do not leak siblings[] on proto context error
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit eed3de2acf6aa5154d49098b026710b646db67ee upstream.
+
+After a successful BALANCE/PARALLEL_SUBMIT extension on context
+creation, error during processing of next user extension leaks
+the siblings[] array. Fix that.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)")
+Cc: Faith Ekstrand <faith.ekstrand@collabora.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.15+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c |   22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -565,8 +565,8 @@ static int set_proto_ctx_engines(struct
+               struct intel_engine_cs *engine;
+ 
+               if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) {
+-                      kfree(set.engines);
+-                      return -EFAULT;
++                      err = -EFAULT;
++                      goto err;
+               }
+ 
+               memset(&set.engines[n], 0, sizeof(set.engines[n]));
+@@ -582,8 +582,8 @@ static int set_proto_ctx_engines(struct
+                       drm_dbg(&i915->drm,
+                               "Invalid engine[%d]: { class:%d, instance:%d }\n",
+                               n, ci.engine_class, ci.engine_instance);
+-                      kfree(set.engines);
+-                      return -ENOENT;
++                      err = -ENOENT;
++                      goto err;
+               }
+ 
+               set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL;
+@@ -596,15 +596,21 @@ static int set_proto_ctx_engines(struct
+                                          set_proto_ctx_engines_extensions,
+                                          ARRAY_SIZE(set_proto_ctx_engines_extensions),
+                                          &set);
+-      if (err) {
+-              kfree(set.engines);
+-              return err;
+-      }
++      if (err)
++              goto err_extensions;
+ 
+       pc->num_user_engines = set.num_engines;
+       pc->user_engines = set.engines;
+ 
+       return 0;
++
++err_extensions:
++      for (n = 0; n < set.num_engines; n++)
++              kfree(set.engines[n].siblings);
++err:
++      kfree(set.engines);
++
++      return err;
+ }
+ 
+ static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv,

diff --git a/queue-5.15/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch b/queue-5.15/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch
new file mode 100644 (file)
index 0000000..8d9bae5
--- /dev/null
+++ b/queue-5.15/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch
@@ -0,0 +1,46 @@
+From 2b56757a9a7456825eb668fde92299e01c5e2721 Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 1 Jul 2026 10:55:55 +0300
+Subject: drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 2b56757a9a7456825eb668fde92299e01c5e2721 upstream.
+
+Setting context engine slot N into I915_ENGINE_CLASS_INVALID /
+I915_ENGINE_CLASS_INVALID_NONE and attempting to apply
+I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL.
+Fix that.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)")
+Cc: Faith Ekstrand <faith.ekstrand@collabora.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.15+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://patch.msgid.link/20260701075555.52142-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -652,7 +652,7 @@ static int set_proto_ctx_sseu(struct drm
+               pe = &pc->user_engines[idx];
+ 
+               /* Only render engine supports RPCS configuration. */
+-              if (pe->engine->class != RENDER_CLASS)
++              if (!pe->engine || pe->engine->class != RENDER_CLASS)
+                       return -EINVAL;
+ 
+               sseu = &pe->sseu;

diff --git a/queue-5.15/drm-i915-return-null-on-error-in-active_instance.patch b/queue-5.15/drm-i915-return-null-on-error-in-active_instance.patch
new file mode 100644 (file)
index 0000000..3fc350f
--- /dev/null
+++ b/queue-5.15/drm-i915-return-null-on-error-in-active_instance.patch
@@ -0,0 +1,58 @@
+From 1e33f0de5fdcd09e51fdec1e5822448970b6420f Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Wed, 24 Jun 2026 12:09:40 +0300
+Subject: drm/i915: Return NULL on error in active_instance
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+
+commit 1e33f0de5fdcd09e51fdec1e5822448970b6420f upstream.
+
+Avoid returning &node->base when node is NULL due to OOM
+during GFP_ATOMIC allocation.
+
+Discovered using AI-assisted static analysis confirmed by
+Intel Product Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: bfaae47db3c0 ("drm/i915: make lockdep slightly happier about execbuf.")
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: <stable@vger.kernel.org> # v5.13+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Link: https://patch.msgid.link/20260624090940.74840-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 6029bc064f0b1bac184203a50fbaaf070fa18832)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_active.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_active.c
++++ b/drivers/gpu/drm/i915/i915_active.c
+@@ -319,7 +319,7 @@ active_instance(struct i915_active *ref,
+        */
+       node = kmem_cache_alloc(slab_cache, GFP_ATOMIC);
+       if (!node)
+-              goto out;
++              goto err;
+ 
+       __i915_active_fence_init(&node->base, NULL, node_retire);
+       node->ref = ref;
+@@ -333,6 +333,11 @@ out:
+       spin_unlock_irq(&ref->tree_lock);
+ 
+       return &node->base;
++
++err:
++      spin_unlock_irq(&ref->tree_lock);
++
++      return NULL;
+ }
+ 
+ void __i915_active_init(struct i915_active *ref,

diff --git a/queue-5.15/series b/queue-5.15/series
index 0598901a93b9833becd1e4fc5b84d2c911452d0c..3056d60255057aae90938d48d757b3710f8fe8b4 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -146,3 +146,6 @@ drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch
 drm-radeon-fix-r100_copy_blit-for-large-bos.patch
 drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch
 drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch
+drm-i915-return-null-on-error-in-active_instance.patch
+drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch
+drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch