--- /dev/null
+From 93475c34111916df71c63e510fc52db01351f809 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Fri, 12 Jun 2026 21:11:53 -0500
+Subject: drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit 93475c34111916df71c63e510fc52db01351f809 upstream.
+
+The AMDGPU_GEM_OP_GET_MAPPING_INFO path of amdgpu_gem_op_ioctl() looks
+up the bo_va for the buffer object in the caller's VM via
+amdgpu_vm_bo_find(), but uses the returned pointer without checking it.
+
+amdgpu_vm_bo_find() returns NULL when the BO has no bo_va in that VM,
+which is the normal case for a BO that has never been mapped. The result
+is fed straight into amdgpu_vm_bo_va_for_each_valid_mapping(), which
+expands to list_for_each_entry(mapping, &(bo_va)->valids, list) and
+dereferences bo_va, causing a NULL pointer dereference.
+
+This is reachable by any process able to issue the ioctl (render group)
+simply by requesting mapping info for an unmapped BO.
+
+Return -ENOENT when no bo_va is found, jumping to out_exec so the
+drm_exec context and GEM object reference are released.
+
+Fixes: 4d82724f7f2b ("drm/amdgpu: Add mapping info option for GEM_OP ioctl")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 528b19377affc1cc7362a70a254c1dda793595f9)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+@@ -1075,6 +1075,11 @@ int amdgpu_gem_op_ioctl(struct drm_devic
+ * If that number is larger than the size of the array, the ioctl must
+ * be retried.
+ */
++ if (!bo_va) {
++ r = -ENOENT;
++ goto out_exec;
++ }
++
+ if (args->num_entries > INT_MAX / sizeof(*vm_entries)) {
+ r = -EINVAL;
+ goto out_exec;
--- /dev/null
+From 3e864bf2a32a1cbdf1e0f9c5a5a4176e8575f4a3 Mon Sep 17 00:00:00 2001
+From: Asad Kamal <asad.kamal@amd.com>
+Date: Fri, 5 Jun 2026 23:44:08 +0800
+Subject: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
+
+From: Asad Kamal <asad.kamal@amd.com>
+
+commit 3e864bf2a32a1cbdf1e0f9c5a5a4176e8575f4a3 upstream.
+
+The cleaner shader sysfs path allocates a 16-dword (64 byte) IB but
+incorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is
+0xff, so the loop wrote 256 dwords into a 64-byte buffer, causing a
+kernel page fault.
+
+The IB only needs to be a minimal NOP shell to schedule the job; the
+cleaner shader itself is emitted on the ring via emit_cleaner_shader().
+Fill 16 dwords to match the allocation.
+
+v2: Use ib_size_dw variable (Lijo)
+
+Fixes: d361ad5d2fc0 ("drm/amdgpu: Add sysfs interface for running cleaner shader")
+Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Asad Kamal <asad.kamal@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit bf21af331ebf72d0935fd70c73192414a422c03a)
+CC: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+@@ -1456,12 +1456,13 @@ static int amdgpu_gfx_run_cleaner_shader
+ struct amdgpu_device *adev = ring->adev;
+ struct drm_gpu_scheduler *sched = &ring->sched;
+ struct drm_sched_entity entity;
++ unsigned int ib_size_dw = 16;
+ static atomic_t counter;
+ struct dma_fence *f;
+ struct amdgpu_job *job;
+ struct amdgpu_ib *ib;
+ void *owner;
+- int i, r;
++ int r;
+
+ /* Initialize the scheduler entity */
+ r = drm_sched_entity_init(&entity, DRM_SCHED_PRIORITY_NORMAL,
+@@ -1479,7 +1480,7 @@ static int amdgpu_gfx_run_cleaner_shader
+ owner = (void *)(unsigned long)atomic_inc_return(&counter);
+
+ r = amdgpu_job_alloc_with_ib(ring->adev, &entity, owner,
+- 64, 0, &job,
++ ib_size_dw * sizeof(uint32_t), 0, &job,
+ AMDGPU_KERNEL_JOB_ID_CLEANER_SHADER);
+ if (r)
+ goto err;
+@@ -1489,9 +1490,8 @@ static int amdgpu_gfx_run_cleaner_shader
+ job->run_cleaner_shader = true;
+
+ ib = &job->ibs[0];
+- for (i = 0; i <= ring->funcs->align_mask; ++i)
+- ib->ptr[i] = ring->funcs->nop;
+- ib->length_dw = ring->funcs->align_mask + 1;
++ memset32(ib->ptr, ring->funcs->nop, ib_size_dw);
++ ib->length_dw = ib_size_dw;
+
+ f = amdgpu_job_submit(job);
+
--- /dev/null
+From 32bd35f068a3507a1b3922cd12ea2985fc58c85b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timur=20Krist=C3=B3f?= <timur.kristof@gmail.com>
+Date: Mon, 25 May 2026 13:33:20 +0200
+Subject: drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+commit 32bd35f068a3507a1b3922cd12ea2985fc58c85b upstream.
+
+UVD 4.x and older can only access MSG, FEEDBACK buffers from a
+specific 256M VRAM segment that the VCPU BO is also located in.
+We already modify all placements of the given BO to ensure
+the BO is placed within this segment.
+
+Previously, it always assumed that the VCPU segment is
+the first 256M of VRAM, even though under some conditions
+the VCPU BO could be allocated outside this segment,
+which made UVD non-functional as the BOs were
+not inside the same segment as the UVD VCPU BO.
+
+Solve that by using the segment where the VCPU BO actually is.
+
+This fixes an issue with UVD failing to initialize on SI/CIK
+when resizable BAR is enabled and the VCPU BO is allocated
+in a different segment.
+
+v2:
+- For other BOs, keep using the same UVD segment as before.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/3851
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit cbfd4d3fc2061a1ec8e9d36e65973ac3e813358a)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 33 +++++++++++++++++++++++---------
+ 1 file changed, 24 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+@@ -135,7 +135,7 @@ MODULE_FIRMWARE(FIRMWARE_VEGA12);
+ MODULE_FIRMWARE(FIRMWARE_VEGA20);
+
+ static void amdgpu_uvd_idle_work_handler(struct work_struct *work);
+-static void amdgpu_uvd_force_into_uvd_segment(struct amdgpu_bo *abo);
++static void amdgpu_uvd_force_into_vcpu_segment(struct amdgpu_bo *abo);
+
+ static int amdgpu_uvd_create_msg_bo_helper(struct amdgpu_device *adev,
+ uint32_t size,
+@@ -158,7 +158,7 @@ static int amdgpu_uvd_create_msg_bo_help
+ amdgpu_bo_kunmap(bo);
+ amdgpu_bo_unpin(bo);
+ amdgpu_bo_placement_from_domain(bo, AMDGPU_GEM_DOMAIN_VRAM);
+- amdgpu_uvd_force_into_uvd_segment(bo);
++ amdgpu_uvd_force_into_vcpu_segment(bo);
+ r = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx);
+ if (r)
+ goto err;
+@@ -544,6 +544,24 @@ void amdgpu_uvd_free_handles(struct amdg
+ }
+ }
+
++static void amdgpu_uvd_force_into_vcpu_segment(struct amdgpu_bo *bo)
++{
++ struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev);
++ struct amdgpu_bo *vcpu_bo = adev->uvd.inst[0].vcpu_bo;
++ struct amdgpu_res_cursor vcpu_cur;
++
++ amdgpu_res_first(vcpu_bo->tbo.resource, 0,
++ amdgpu_bo_size(vcpu_bo), &vcpu_cur);
++
++ bo->placement.num_placement = 1;
++ bo->placement.placement = &bo->placements[0];
++ bo->placements[0].fpfn = ALIGN_DOWN(vcpu_cur.start, SZ_256M) >> PAGE_SHIFT;
++ bo->placements[0].lpfn = bo->placements[0].fpfn + (SZ_256M >> PAGE_SHIFT);
++ bo->placements[0].mem_type = vcpu_bo->tbo.resource->mem_type;
++ if (bo->placements[0].mem_type == TTM_PL_VRAM)
++ bo->placements[0].flags |= TTM_PL_FLAG_CONTIGUOUS;
++}
++
+ static void amdgpu_uvd_force_into_uvd_segment(struct amdgpu_bo *abo)
+ {
+ int i;
+@@ -594,13 +612,10 @@ static int amdgpu_uvd_cs_pass1(struct am
+ if (!ctx->parser->adev->uvd.address_64_bit) {
+ /* check if it's a message or feedback command */
+ cmd = amdgpu_ib_get_value(ctx->ib, ctx->idx) >> 1;
+- if (cmd == 0x0 || cmd == 0x3) {
+- /* yes, force it into VRAM */
+- uint32_t domain = AMDGPU_GEM_DOMAIN_VRAM;
+-
+- amdgpu_bo_placement_from_domain(bo, domain);
+- }
+- amdgpu_uvd_force_into_uvd_segment(bo);
++ if (cmd == 0x0 || cmd == 0x3)
++ amdgpu_uvd_force_into_vcpu_segment(bo);
++ else
++ amdgpu_uvd_force_into_uvd_segment(bo);
+
+ r = ttm_bo_validate(&bo->tbo, &bo->placement, &tctx);
+ }
--- /dev/null
+From 8002b744ad70055ef11ff7d0a7d685bfe8ffe6e4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timur=20Krist=C3=B3f?= <timur.kristof@gmail.com>
+Date: Mon, 25 May 2026 13:33:19 +0200
+Subject: drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+commit 8002b744ad70055ef11ff7d0a7d685bfe8ffe6e4 upstream.
+
+These UVD versions don't fully support GPUVM and are only
+validated to work when their VCPU BO is placed in VRAM.
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 01b8dfc0660db5d6cdd62c22dc20f774a26ce853)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+@@ -188,6 +188,7 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev
+ const struct common_firmware_header *hdr;
+ unsigned int family_id;
+ int i, j, r;
++ u32 vcpu_bo_domain;
+
+ INIT_DELAYED_WORK(&adev->uvd.idle_work, amdgpu_uvd_idle_work_handler);
+
+@@ -319,12 +320,20 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev
+ if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP)
+ bo_size += AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8);
+
++ /* UVD 5.0 and newer HW can use 64 bit addressing. */
++ adev->uvd.address_64_bit =
++ !amdgpu_device_ip_block_version_cmp(adev, AMD_IP_BLOCK_TYPE_UVD, 5, 0);
++
++ vcpu_bo_domain = AMDGPU_GEM_DOMAIN_VRAM;
++ if (adev->uvd.address_64_bit)
++ vcpu_bo_domain |= AMDGPU_GEM_DOMAIN_GTT;
++
+ for (j = 0; j < adev->uvd.num_uvd_inst; j++) {
+ if (adev->uvd.harvest_config & (1 << j))
+ continue;
++
+ r = amdgpu_bo_create_kernel(adev, bo_size, PAGE_SIZE,
+- AMDGPU_GEM_DOMAIN_VRAM |
+- AMDGPU_GEM_DOMAIN_GTT,
++ vcpu_bo_domain,
+ &adev->uvd.inst[j].vcpu_bo,
+ &adev->uvd.inst[j].gpu_addr,
+ &adev->uvd.inst[j].cpu_addr);
+@@ -339,10 +348,6 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev
+ adev->uvd.filp[i] = NULL;
+ }
+
+- /* from uvd v5.0 HW addressing capacity increased to 64 bits */
+- if (!amdgpu_device_ip_block_version_cmp(adev, AMD_IP_BLOCK_TYPE_UVD, 5, 0))
+- adev->uvd.address_64_bit = true;
+-
+ r = amdgpu_uvd_create_msg_bo_helper(adev, 128 << 10, &adev->uvd.ib_bo);
+ if (r)
+ return r;
--- /dev/null
+From 2d8b08844c0ecc6f2002fa68711e779aa18c8585 Mon Sep 17 00:00:00 2001
+From: Vitor Soares <vitor.soares@toradex.com>
+Date: Tue, 5 May 2026 14:47:05 +0100
+Subject: drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
+
+From: Vitor Soares <vitor.soares@toradex.com>
+
+commit 2d8b08844c0ecc6f2002fa68711e779aa18c8585 upstream.
+
+The deprecated UNIVERSAL_DEV_PM_OPS() macro uses the provided callbacks
+for both runtime PM and system sleep. This causes the DSI clocks to be
+disabled twice: once during runtime suspend and again during system
+suspend, resulting in a WARN message from the clock framework when
+attempting to disable already-disabled clocks.
+
+[ 84.384540] clk:231:5 already disabled
+[ 84.388314] WARNING: CPU: 2 PID: 531 at /drivers/clk/clk.c:1181 clk_core_disable+0xa4/0xac
+...
+[ 84.579183] Call trace:
+[ 84.581624] clk_core_disable+0xa4/0xac
+[ 84.585457] clk_disable+0x30/0x4c
+[ 84.588857] cdns_dsi_suspend+0x20/0x58 [cdns_dsi]
+[ 84.593651] pm_generic_suspend+0x2c/0x44
+[ 84.597661] ti_sci_pd_suspend+0xbc/0x15c
+[ 84.601670] dpm_run_callback+0x8c/0x14c
+[ 84.605588] __device_suspend+0x1a0/0x56c
+[ 84.609594] dpm_suspend+0x17c/0x21c
+[ 84.613165] dpm_suspend_start+0xa0/0xa8
+[ 84.617083] suspend_devices_and_enter+0x12c/0x634
+[ 84.621872] pm_suspend+0x1fc/0x368
+
+To address this issue, replace UNIVERSAL_DEV_PM_OPS() with
+RUNTIME_PM_OPS(). Bridge and panel drivers should only deal with runtime
+PM, as the DRM framework manages system-wide power transitions through
+the bridge enable() and disable() hooks.
+
+Link: https://lore.kernel.org/all/fbde0659-78f3-46e4-98cf-d832f765a18b@ideasonboard.com/
+Cc: stable@vger.kernel.org # 6.1.x
+Fixes: e19233955d9e ("drm/bridge: Add Cadence DSI driver")
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Link: https://patch.msgid.link/20260505134705.188661-2-ivitro@gmail.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+@@ -1230,7 +1230,7 @@ static const struct mipi_dsi_host_ops cd
+ .transfer = cdns_dsi_transfer,
+ };
+
+-static int __maybe_unused cdns_dsi_resume(struct device *dev)
++static int cdns_dsi_resume(struct device *dev)
+ {
+ struct cdns_dsi *dsi = dev_get_drvdata(dev);
+
+@@ -1241,7 +1241,7 @@ static int __maybe_unused cdns_dsi_resum
+ return 0;
+ }
+
+-static int __maybe_unused cdns_dsi_suspend(struct device *dev)
++static int cdns_dsi_suspend(struct device *dev)
+ {
+ struct cdns_dsi *dsi = dev_get_drvdata(dev);
+
+@@ -1251,8 +1251,9 @@ static int __maybe_unused cdns_dsi_suspe
+ return 0;
+ }
+
+-static UNIVERSAL_DEV_PM_OPS(cdns_dsi_pm_ops, cdns_dsi_suspend, cdns_dsi_resume,
+- NULL);
++static const struct dev_pm_ops cdns_dsi_pm_ops = {
++ RUNTIME_PM_OPS(cdns_dsi_suspend, cdns_dsi_resume, NULL)
++};
+
+ static int cdns_dsi_drm_probe(struct platform_device *pdev)
+ {
+@@ -1399,7 +1400,7 @@ static struct platform_driver cdns_dsi_p
+ .driver = {
+ .name = "cdns-dsi",
+ .of_match_table = cdns_dsi_of_match,
+- .pm = &cdns_dsi_pm_ops,
++ .pm = pm_ptr(&cdns_dsi_pm_ops),
+ },
+ };
+ module_platform_driver(cdns_dsi_platform_driver);
--- /dev/null
+From 55bd5e685bda455b9b50c835f8c8442d52a344a3 Mon Sep 17 00:00:00 2001
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Date: Fri, 10 Apr 2026 04:19:01 +0000
+Subject: drm/dp/mst: fix buffer overflows in sideband chunk accumulation
+
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+
+commit 55bd5e685bda455b9b50c835f8c8442d52a344a3 upstream.
+
+drm_dp_sideband_append_payload() has three related bugs when processing
+device-provided sideband reply data:
+
+1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken
+ directly from the DP sideband header. If a device sends msg_len=0,
+ curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len)
+ is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).
+ drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()
+ writes 255 bytes into msg[], both far out of bounds.
+
+2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is
+ only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks
+ until curchunk_idx reaches curchunk_len, writing up to 15 bytes past
+ the end of chunk[] into msg[].
+
+3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to
+ msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256],
+ so the memcpy can spill into adjacent struct fields.
+
+All three are reachable from any DP MST device that can forge sideband
+reply messages on a physical connection.
+
+Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
+Cc: <stable@vger.kernel.org> # v3.17+
+Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20260410041901.2438960-1-ashutoshdesai993@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -789,6 +789,12 @@ static bool drm_dp_sideband_append_paylo
+ {
+ u8 crc4;
+
++ /* curchunk_len must be >= 1 (min 1 CRC byte) and fit in chunk[] */
++ if (!msg->curchunk_len ||
++ msg->curchunk_len > ARRAY_SIZE(msg->chunk) ||
++ msg->curchunk_idx + replybuflen > ARRAY_SIZE(msg->chunk))
++ return false;
++
+ memcpy(&msg->chunk[msg->curchunk_idx], replybuf, replybuflen);
+ msg->curchunk_idx += replybuflen;
+
+@@ -799,6 +805,9 @@ static bool drm_dp_sideband_append_paylo
+ print_hex_dump(KERN_DEBUG, "wrong crc",
+ DUMP_PREFIX_NONE, 16, 1,
+ msg->chunk, msg->curchunk_len, false);
++ /* Guard against accumulated msg[] overflow */
++ if (msg->curlen + msg->curchunk_len - 1 > ARRAY_SIZE(msg->msg))
++ return false;
+ /* copy chunk into bigger msg */
+ memcpy(&msg->msg[msg->curlen], msg->chunk, msg->curchunk_len - 1);
+ msg->curlen += msg->curchunk_len - 1;
--- /dev/null
+From 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 Mon Sep 17 00:00:00 2001
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Date: Sun, 10 May 2026 20:17:33 +0000
+Subject: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
+
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+
+commit 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 upstream.
+
+drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw
+message and then unconditionally does:
+
+ memcpy(bytes, &raw->msg[idx], num_bytes);
+
+without checking that idx + num_bytes <= raw->curlen. raw->msg[] is
+256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger
+than the remaining payload, the memcpy reads past the received data
+into whatever follows in raw->msg[].
+
+drm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted
+with a /* TODO check */ comment since the code was introduced).
+
+Fix both functions by using a single combined check
+(idx + num_bytes > curlen) before each memcpy. Since num_bytes is u8,
+it is always >= 0, so this strictly subsumes the simpler idx > curlen
+form and no separate step is needed.
+
+Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
+Cc: <stable@vger.kernel.org> # v3.17+
+Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+[added missing fixes tag]
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20260510201733.2882224-1-ashutoshdesai993@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -871,7 +871,7 @@ static bool drm_dp_sideband_parse_remote
+ goto fail_len;
+ repmsg->u.remote_dpcd_read_ack.num_bytes = raw->msg[idx];
+ idx++;
+- if (idx > raw->curlen)
++ if (idx + repmsg->u.remote_dpcd_read_ack.num_bytes > raw->curlen)
+ goto fail_len;
+
+ memcpy(repmsg->u.remote_dpcd_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_dpcd_read_ack.num_bytes);
+@@ -907,7 +907,9 @@ static bool drm_dp_sideband_parse_remote
+ goto fail_len;
+ repmsg->u.remote_i2c_read_ack.num_bytes = raw->msg[idx];
+ idx++;
+- /* TODO check */
++ if (idx + repmsg->u.remote_i2c_read_ack.num_bytes > raw->curlen)
++ goto fail_len;
++
+ memcpy(repmsg->u.remote_i2c_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_i2c_read_ack.num_bytes);
+ return true;
+ fail_len:
--- /dev/null
+From 6b89ba3dba2f583626fb693e47e951ffb8bf591f Mon Sep 17 00:00:00 2001
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Date: Sun, 10 May 2026 20:31:28 +0000
+Subject: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
+
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+
+commit 6b89ba3dba2f583626fb693e47e951ffb8bf591f upstream.
+
+Three sideband reply parsers read 16-bit fields as:
+
+ val = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
+
+and check bounds only after the fact. When idx == raw->curlen,
+raw->msg[idx+1] reads one byte past the received message data into
+the following struct fields (curchunk_len, curchunk_idx, curlen).
+
+Affected functions:
+ - drm_dp_sideband_parse_enum_path_resources_ack()
+ full_payload_bw_number and avail_payload_bw_number fields
+ - drm_dp_sideband_parse_allocate_payload_ack()
+ allocated_pbn field
+ - drm_dp_sideband_parse_query_payload_ack()
+ allocated_pbn field
+
+Fix by using a single combined check (idx + 2 > curlen) before each
+2-byte read. Since the check is strictly tighter than idx > curlen,
+no separate step is needed.
+
+Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
+Cc: <stable@vger.kernel.org> # v3.17+
+Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+[added fixes tag]
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20260510203128.2884846-1-ashutoshdesai993@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 17 ++++-------------
+ 1 file changed, 4 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -934,16 +934,13 @@ static bool drm_dp_sideband_parse_enum_p
+ repmsg->u.path_resources.port_number = (raw->msg[idx] >> 4) & 0xf;
+ repmsg->u.path_resources.fec_capable = raw->msg[idx] & 0x1;
+ idx++;
+- if (idx > raw->curlen)
++ if (idx + 2 > raw->curlen)
+ goto fail_len;
+ repmsg->u.path_resources.full_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
+ idx += 2;
+- if (idx > raw->curlen)
++ if (idx + 2 > raw->curlen)
+ goto fail_len;
+ repmsg->u.path_resources.avail_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
+- idx += 2;
+- if (idx > raw->curlen)
+- goto fail_len;
+ return true;
+ fail_len:
+ DRM_DEBUG_KMS("enum resource parse length fail %d %d\n", idx, raw->curlen);
+@@ -961,12 +958,9 @@ static bool drm_dp_sideband_parse_alloca
+ goto fail_len;
+ repmsg->u.allocate_payload.vcpi = raw->msg[idx];
+ idx++;
+- if (idx > raw->curlen)
++ if (idx + 2 > raw->curlen)
+ goto fail_len;
+ repmsg->u.allocate_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
+- idx += 2;
+- if (idx > raw->curlen)
+- goto fail_len;
+ return true;
+ fail_len:
+ DRM_DEBUG_KMS("allocate payload parse length fail %d %d\n", idx, raw->curlen);
+@@ -980,12 +974,9 @@ static bool drm_dp_sideband_parse_query_
+
+ repmsg->u.query_payload.port_number = (raw->msg[idx] >> 4) & 0xf;
+ idx++;
+- if (idx > raw->curlen)
++ if (idx + 2 > raw->curlen)
+ goto fail_len;
+ repmsg->u.query_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx + 1]);
+- idx += 2;
+- if (idx > raw->curlen)
+- goto fail_len;
+ return true;
+ fail_len:
+ DRM_DEBUG_KMS("query payload parse length fail %d %d\n", idx, raw->curlen);
--- /dev/null
+From 9cd74f935306cd857f46686975c43383e1d95f94 Mon Sep 17 00:00:00 2001
+From: Alessio Belle <alessio.belle@imgtec.com>
+Date: Mon, 30 Mar 2026 08:56:36 +0100
+Subject: drm/imagination: Count paired job fence as dependency in prepare_job()
+
+From: Alessio Belle <alessio.belle@imgtec.com>
+
+commit 9cd74f935306cd857f46686975c43383e1d95f94 upstream.
+
+The DRM scheduler's prepare_job() callback counts the remaining
+non-signaled native dependencies for a job, preventing job submission
+until those (plus job data and fence update) can fit in the job queue's
+CCCB.
+
+This means checking which dependencies can be waited upon in the
+firmware, i.e. whether they are backed by a UFO object, i.e. whether
+their drm_sched_fence::parent has been assigned to a
+pvr_queue_fence::base fence. That happens when the job owning the fence
+is submitted to the firmware.
+
+Paired geometry and fragment jobs are submitted at the same time, which
+means the dependency between them can't be checked this way before
+submission.
+
+Update job_count_remaining_native_deps() to take into account the
+dependency between paired jobs.
+
+This fixes cases where prepare_job() underestimated the space left in
+an almost full fragment CCCB, wrongly unblocking run_job(), which then
+returned early without writing the full sequence of commands to the
+CCCB.
+
+The above lead to kernel warnings such as the following and potentially
+job timeouts (depending on waiters on the missing commands):
+
+ [ 375.702979] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#1: kworker/u16:3/47
+ [ 375.703160] Modules linked in:
+ [ 375.703571] CPU: 1 UID: 0 PID: 47 Comm: kworker/u16:3 Tainted: G W 7.0.0-rc2-g817eb6b11ad5 #40 PREEMPT
+ [ 375.703613] Tainted: [W]=WARN
+ [ 375.703627] Hardware name: Texas Instruments AM625 SK (DT)
+ [ 375.703645] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]
+ [ 375.703741] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ [ 375.703764] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]
+ [ 375.703847] lr : pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr]
+ [ 375.703921] sp : ffff800084a97650
+ [ 375.703934] x29: ffff800084a97740 x28: 0000000000000958 x27: ffff80008565d000
+ [ 375.703979] x26: 0000000000000030 x25: ffff800084a97680 x24: 0000000000001000
+ [ 375.704017] x23: ffff800084a97820 x22: 1ffff00010952ecc x21: 0000000000000008
+ [ 375.704056] x20: 00000000000006a8 x19: ffff00002ff7da88 x18: 0000000000000000
+ [ 375.704093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000
+ [ 375.704132] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
+ [ 375.704168] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3
+ [ 375.704206] x8 : 00000000f2f2f200 x7 : ffff700010952ecc x6 : 0000000000000008
+ [ 375.704243] x5 : 0000000000000000 x4 : 1ffff00010acba00 x3 : 0000000000000000
+ [ 375.704279] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f
+ [ 375.704317] Call trace:
+ [ 375.704331] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)
+ [ 375.704411] pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr]
+ [ 375.704487] pvr_queue_run_job+0x3a4/0x990 [powervr]
+ [ 375.704562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched]
+ [ 375.704623] process_one_work+0x520/0x1288
+ [ 375.704658] worker_thread+0x3f0/0xb3c
+ [ 375.704680] kthread+0x334/0x3d8
+ [ 375.704706] ret_from_fork+0x10/0x20
+ [ 375.704736] ---[ end trace 0000000000000000 ]---
+
+Fixes: eaf01ee5ba28 ("drm/imagination: Implement job submission and scheduling")
+Cc: stable@vger.kernel.org
+Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
+Reviewed-by: Brajesh Gupta <brajesh.gupta@imgtec.com>
+Link: https://patch.msgid.link/20260330-job-submission-fixes-cleanup-v1-1-7de8c09cef8c@imgtec.com
+Signed-off-by: Matt Coster <matt.coster@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/imagination/pvr_queue.c | 27 +++++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/imagination/pvr_queue.c
++++ b/drivers/gpu/drm/imagination/pvr_queue.c
+@@ -179,7 +179,7 @@ static const struct dma_fence_ops pvr_qu
+
+ /**
+ * to_pvr_queue_job_fence() - Return a pvr_queue_fence object if the fence is
+- * backed by a UFO.
++ * already backed by a UFO.
+ * @f: The dma_fence to turn into a pvr_queue_fence.
+ *
+ * Return:
+@@ -356,6 +356,15 @@ static u32 job_cmds_size(struct pvr_job
+ pvr_cccb_get_size_of_cmd_with_hdr(job->cmd_len);
+ }
+
++static bool
++is_paired_job_fence(struct dma_fence *fence, struct pvr_job *job)
++{
++ /* This assumes "fence" is one of "job"'s drm_sched_job::dependencies */
++ return job->type == DRM_PVR_JOB_TYPE_FRAGMENT &&
++ job->paired_job &&
++ &job->paired_job->base.s_fence->scheduled == fence;
++}
++
+ /**
+ * job_count_remaining_native_deps() - Count the number of non-signaled native dependencies.
+ * @job: Job to operate on.
+@@ -371,6 +380,17 @@ static unsigned long job_count_remaining
+ xa_for_each(&job->base.dependencies, index, fence) {
+ struct pvr_queue_fence *jfence;
+
++ if (is_paired_job_fence(fence, job)) {
++ /*
++ * A fence between paired jobs won't resolve to a pvr_queue_fence (i.e.
++ * be backed by a UFO) until the jobs have been submitted, together.
++ * The submitting code will insert a partial render fence command for this.
++ */
++ WARN_ON(dma_fence_is_signaled(fence));
++ remaining_count++;
++ continue;
++ }
++
+ jfence = to_pvr_queue_job_fence(fence);
+ if (!jfence)
+ continue;
+@@ -630,9 +650,8 @@ static void pvr_queue_submit_job_to_cccb
+ if (!jfence)
+ continue;
+
+- /* Skip the partial render fence, we will place it at the end. */
+- if (job->type == DRM_PVR_JOB_TYPE_FRAGMENT && job->paired_job &&
+- &job->paired_job->base.s_fence->scheduled == fence)
++ /* This fence will be placed last, as partial render fence. */
++ if (is_paired_job_fence(fence, job))
+ continue;
+
+ if (dma_fence_is_signaled(&jfence->base))
--- /dev/null
+From 4baf9e70cb756d78dd56419f8baee2978a72d0c3 Mon Sep 17 00:00:00 2001
+From: Alessio Belle <alessio.belle@imgtec.com>
+Date: Mon, 30 Mar 2026 08:56:37 +0100
+Subject: drm/imagination: Fit paired fragment job in the correct CCCB
+
+From: Alessio Belle <alessio.belle@imgtec.com>
+
+commit 4baf9e70cb756d78dd56419f8baee2978a72d0c3 upstream.
+
+For geometry jobs with a paired fragment job, at the moment, the
+DRM scheduler's prepare_job() callback:
+
+- checks for internal (driver) dependencies for the geometry job;
+- calls into pvr_queue_get_paired_frag_job_dep() to check for external
+ dependencies for the fragment job (the two jobs are submitted together
+ but the common scheduler code doesn't know about it, so this needs to
+ be done at this point in time);
+- calls into the prepare_job() callback again, but for the fragment job,
+ to check its internal dependencies as well, passing the fragment job's
+ drm_sched_job and the geometry job's drm_sched_entity / pvr_queue.
+
+The problem with the last step is that pvr_queue_prepare_job() doesn't
+always take the mismatched fragment job and geometry queue into account,
+in particular when checking whether there is space for the fragment
+command to be submitted, so the code ends up checking for space in the
+geometry (i.e. wrong) CCCB.
+The rest of the nested prepare_job() callback happens to work fine at
+the moment as the other internal dependencies are not relevant for a
+paired fragment job.
+
+Move the initialisation of a paired fragment job's done fence and CCCB
+fence to pvr_queue_get_paired_frag_job_dep(), inferring the correct
+queue from the fragment job itself.
+
+This fixes cases where prepare_job() wrongly assumed that there was
+enough space for a paired fragment job in its own CCCB, unblocking
+run_job(), which then returned early without writing the full sequence
+of commands to the CCCB.
+
+The above lead to kernel warnings such as the following and potentially
+job timeouts (depending on waiters on the missing commands):
+
+ [ 552.421075] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#2: kworker/u16:5/63
+ [ 552.421230] Modules linked in:
+ [ 552.421592] CPU: 2 UID: 0 PID: 63 Comm: kworker/u16:5 Tainted: G W 7.0.0-rc2-gc5d053e4dccb #39 PREEMPT
+ [ 552.421625] Tainted: [W]=WARN
+ [ 552.421637] Hardware name: Texas Instruments AM625 SK (DT)
+ [ 552.421655] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]
+ [ 552.421744] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ [ 552.421766] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]
+ [ 552.421850] lr : pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]
+ [ 552.421923] sp : ffff800084c47650
+ [ 552.421936] x29: ffff800084c47740 x28: 0000000000000df8 x27: ffff800088a77000
+ [ 552.421979] x26: 0000000000000030 x25: ffff800084c47680 x24: 0000000000001000
+ [ 552.422017] x23: ffff800084c47820 x22: 1ffff00010988ecc x21: 0000000000000008
+ [ 552.422055] x20: 0000000000000208 x19: ffff000006ad5a88 x18: 0000000000000000
+ [ 552.422093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000
+ [ 552.422130] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
+ [ 552.422167] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3
+ [ 552.422204] x8 : 00000000f2f2f200 x7 : ffff700010988ecc x6 : 0000000000000008
+ [ 552.422241] x5 : 0000000000000000 x4 : 1ffff0001114ee00 x3 : 0000000000000000
+ [ 552.422278] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f
+ [ 552.422316] Call trace:
+ [ 552.422330] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)
+ [ 552.422411] pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]
+ [ 552.422486] pvr_queue_run_job+0x3a4/0x990 [powervr]
+ [ 552.422562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched]
+ [ 552.422623] process_one_work+0x520/0x1288
+ [ 552.422657] worker_thread+0x3f0/0xb3c
+ [ 552.422679] kthread+0x334/0x3d8
+ [ 552.422706] ret_from_fork+0x10/0x20
+
+Fixes: eaf01ee5ba28 ("drm/imagination: Implement job submission and scheduling")
+Cc: stable@vger.kernel.org
+Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
+Reviewed-by: Brajesh Gupta <brajesh.gupta@imgtec.com>
+Link: https://patch.msgid.link/20260330-job-submission-fixes-cleanup-v1-2-7de8c09cef8c@imgtec.com
+Signed-off-by: Matt Coster <matt.coster@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/imagination/pvr_queue.c | 32 ++++++++++++++------------------
+ 1 file changed, 14 insertions(+), 18 deletions(-)
+
+--- a/drivers/gpu/drm/imagination/pvr_queue.c
++++ b/drivers/gpu/drm/imagination/pvr_queue.c
+@@ -488,10 +488,11 @@ pvr_queue_get_job_kccb_fence(struct pvr_
+ }
+
+ static struct dma_fence *
+-pvr_queue_get_paired_frag_job_dep(struct pvr_queue *queue, struct pvr_job *job)
++pvr_queue_get_paired_frag_job_dep(struct pvr_job *job)
+ {
+ struct pvr_job *frag_job = job->type == DRM_PVR_JOB_TYPE_GEOMETRY ?
+ job->paired_job : NULL;
++ struct pvr_queue *frag_queue = frag_job ? frag_job->ctx->queues.fragment : NULL;
+ struct dma_fence *f;
+ unsigned long index;
+
+@@ -510,7 +511,10 @@ pvr_queue_get_paired_frag_job_dep(struct
+ return dma_fence_get(f);
+ }
+
+- return frag_job->base.sched->ops->prepare_job(&frag_job->base, &queue->entity);
++ /* Initialize the paired fragment job's done_fence, so we can signal it. */
++ pvr_queue_job_fence_init(frag_job->done_fence, frag_queue);
++
++ return pvr_queue_get_job_cccb_fence(frag_queue, frag_job);
+ }
+
+ /**
+@@ -529,11 +533,6 @@ pvr_queue_prepare_job(struct drm_sched_j
+ struct pvr_queue *queue = container_of(s_entity, struct pvr_queue, entity);
+ struct dma_fence *internal_dep = NULL;
+
+- /*
+- * Initialize the done_fence, so we can signal it. This must be done
+- * here because otherwise by the time of run_job() the job will end up
+- * in the pending list without a valid fence.
+- */
+ if (job->type == DRM_PVR_JOB_TYPE_FRAGMENT && job->paired_job) {
+ /*
+ * This will be called on a paired fragment job after being
+@@ -543,18 +542,15 @@ pvr_queue_prepare_job(struct drm_sched_j
+ */
+ if (job->paired_job->has_pm_ref)
+ return NULL;
+-
+- /*
+- * In this case we need to use the job's own ctx to initialise
+- * the done_fence. The other steps are done in the ctx of the
+- * paired geometry job.
+- */
+- pvr_queue_job_fence_init(job->done_fence,
+- job->ctx->queues.fragment);
+- } else {
+- pvr_queue_job_fence_init(job->done_fence, queue);
+ }
+
++ /*
++ * Initialize the done_fence, so we can signal it. This must be done
++ * here because otherwise by the time of run_job() the job will end up
++ * in the pending list without a valid fence.
++ */
++ pvr_queue_job_fence_init(job->done_fence, queue);
++
+ /* CCCB fence is used to make sure we have enough space in the CCCB to
+ * submit our commands.
+ */
+@@ -575,7 +571,7 @@ pvr_queue_prepare_job(struct drm_sched_j
+
+ /* The paired job fence should come last, when everything else is ready. */
+ if (!internal_dep)
+- internal_dep = pvr_queue_get_paired_frag_job_dep(queue, job);
++ internal_dep = pvr_queue_get_paired_frag_job_dep(job);
+
+ return internal_dep;
+ }
--- /dev/null
+From 7cbba8a8ba0219a267844d3116dbc77cecb4fcf8 Mon Sep 17 00:00:00 2001
+From: Biju Das <biju.das.jz@bp.renesas.com>
+Date: Mon, 30 Mar 2026 11:44:45 +0100
+Subject: drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+commit 7cbba8a8ba0219a267844d3116dbc77cecb4fcf8 upstream.
+
+The RZ/G2L hardware manual (Rev. 1.50, May 2025), Section 34.4.2.1,
+requires waiting at least 1 msec after deasserting the CMN_RSTB signal
+before the DSI-Tx module is ready. Increase the delay from 1 usec to
+1 msec by replacing udelay(1) with fsleep(1000) for RZ/G2L SoCs.
+
+Fixes: 7a043f978ed1 ("drm: rcar-du: Add RZ/G2L DSI driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
+Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
+Link: https://patch.msgid.link/20260330104450.128512-3-biju.das.jz@bp.renesas.com
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
++++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
+@@ -272,7 +272,7 @@ static int rzg2l_mipi_dsi_dphy_init(stru
+ if (ret < 0)
+ return ret;
+
+- udelay(1);
++ fsleep(1000);
+
+ return 0;
+ }
--- /dev/null
+From 5bfa858d53bb252d7a012c2e0a97ae18182edfb1 Mon Sep 17 00:00:00 2001
+From: Biju Das <biju.das.jz@bp.renesas.com>
+Date: Mon, 30 Mar 2026 11:44:44 +0100
+Subject: drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing()
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+commit 5bfa858d53bb252d7a012c2e0a97ae18182edfb1 upstream.
+
+The RZ/G2L hardware manual (Rev. 1.50, May 2025), Section 34.4.2.1,
+requires display timings to be set after the HS clock is started. Move
+rzg2l_mipi_dsi_set_display_timing() from
+rzg2l_mipi_dsi_atomic_pre_enable() to rzg2l_mipi_dsi_atomic_enable(),
+placing it after rzg2l_mipi_dsi_start_hs_clock(). Drop the unused ret
+variable from rzg2l_mipi_dsi_atomic_pre_enable().
+
+Fixes: 5ce16c169a4c ("drm: renesas: rz-du: Add atomic_pre_enable")
+Fixes: 7a043f978ed1 ("drm: rcar-du: Add RZ/G2L DSI driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
+Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
+Link: https://patch.msgid.link/20260330104450.128512-2-biju.das.jz@bp.renesas.com
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
++++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
+@@ -604,29 +604,33 @@ static void rzg2l_mipi_dsi_atomic_pre_en
+ const struct drm_display_mode *mode;
+ struct drm_connector *connector;
+ struct drm_crtc *crtc;
+- int ret;
+
+ connector = drm_atomic_get_new_connector_for_encoder(state, bridge->encoder);
+ crtc = drm_atomic_get_new_connector_state(state, connector)->crtc;
+ mode = &drm_atomic_get_new_crtc_state(state, crtc)->adjusted_mode;
+
+- ret = rzg2l_mipi_dsi_startup(dsi, mode);
+- if (ret < 0)
+- return;
+-
+- rzg2l_mipi_dsi_set_display_timing(dsi, mode);
++ rzg2l_mipi_dsi_startup(dsi, mode);
+ }
+
+ static void rzg2l_mipi_dsi_atomic_enable(struct drm_bridge *bridge,
+ struct drm_atomic_state *state)
+ {
+ struct rzg2l_mipi_dsi *dsi = bridge_to_rzg2l_mipi_dsi(bridge);
++ const struct drm_display_mode *mode;
++ struct drm_connector *connector;
++ struct drm_crtc *crtc;
+ int ret;
+
+ ret = rzg2l_mipi_dsi_start_hs_clock(dsi);
+ if (ret < 0)
+ goto err_stop;
+
++ connector = drm_atomic_get_new_connector_for_encoder(state, bridge->encoder);
++ crtc = drm_atomic_get_new_connector_state(state, connector)->crtc;
++ mode = &drm_atomic_get_new_crtc_state(state, crtc)->adjusted_mode;
++
++ rzg2l_mipi_dsi_set_display_timing(dsi, mode);
++
+ ret = rzg2l_mipi_dsi_start_video(dsi);
+ if (ret < 0)
+ goto err_stop_clock;
--- /dev/null
+From 45895f4d4d5f222d07412f90664f88b059627859 Mon Sep 17 00:00:00 2001
+From: Chen Ni <nichen@iscas.ac.cn>
+Date: Mon, 9 Feb 2026 11:31:23 +0800
+Subject: drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+commit 45895f4d4d5f222d07412f90664f88b059627859 upstream.
+
+Add missing error check for platform_get_resource() return value to
+prevent NULL pointer dereference when memory resource is not available.
+
+Fixes: 718b3bb9c0ab ("drm/rockchip: analogix_dp: Expand device data to support multiple edp display")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patch.msgid.link/20260209033123.1089370-1-nichen@iscas.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
++++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+@@ -469,6 +469,8 @@ static int rockchip_dp_probe(struct plat
+ return -ENOMEM;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!res)
++ return -EINVAL;
+
+ i = 0;
+ while (dp_data[i].reg) {
--- /dev/null
+From 46c31e1604d121221167cb09380de8c7d53290b9 Mon Sep 17 00:00:00 2001
+From: Sergey Shtylyov <s.shtylyov@auroraos.dev>
+Date: Fri, 30 Jan 2026 23:35:42 +0300
+Subject: drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
+
+From: Sergey Shtylyov <s.shtylyov@auroraos.dev>
+
+commit 46c31e1604d121221167cb09380de8c7d53290b9 upstream.
+
+The result of cdn_dp_reg_write() is checked everywhere (with the error
+being logged by the callers) except one place in cdn_dp_config_video().
+Add the missing result check, bailing out early on error...
+
+Found by Linux Verification Center (linuxtesting.org) with the Svace static
+analysis tool.
+
+Fixes: 1a0f7ed3abe2 ("drm/rockchip: cdn-dp: add cdn DP support for rk3399")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@auroraos.dev>
+Cc: stable@vger.kernel.org
+Reviewed-by: Chaoyi Chen <chaoyi.chen@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patch.msgid.link/adf6b313-f7db-4d8f-9000-8c65446ba041@auroraos.dev
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c
++++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
+@@ -683,6 +683,8 @@ int cdn_dp_config_video(struct cdn_dp_de
+ val = div_u64(8 * (symbol + 1), bit_per_pix) - val;
+ val += 2;
+ ret = cdn_dp_reg_write(dp, DP_VC_TABLE(15), val);
++ if (ret)
++ goto err_config_video;
+
+ switch (video->color_depth) {
+ case 6:
--- /dev/null
+From 83084bb36847cbd2b13743f7333aaca12613a72b Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Date: Wed, 11 Mar 2026 11:14:44 +0200
+Subject: drm/tidss: Fix missing drm_bridge_add() call
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+commit 83084bb36847cbd2b13743f7333aaca12613a72b upstream.
+
+tidss encoder-bridge is not added with drm_bridge_add() call, which
+leads to:
+
+[drm] Missing drm_bridge_add() before attach
+
+Add the missing call, using devm_drm_bridge_add() variant to get the
+drm_bridge_remove() handled automatically.
+
+The commit marked with the Fixes tag (from v6.6) is the commit that
+added the encoder bridge without drm_bridge_add(). However, this fix is
+not directly applicable there as devm_drm_bridge_alloc() was not used to
+alloc the bridge, so using devm version for drm_bridge_add() wouldn't be
+safe. Instead, drm_bridge_add() and drm_bridge_remove() would be needed
+there, but that would require new plumbing code as we don't have a
+separate cleanup function in the tidss_encoder.c, not in the tidss_kms.c
+from which the encoder is created.
+
+Also, there has been no reported bugs caused by the missing
+drm_bridge_add(). The drm_bridge_add() initializes the bridge's
+hpd_mutex, but HPD is not used for the encoder bridge. drm_bridge_add()
+also adds the bridge to the global bridge_list, which is only used in
+of_drm_find_bridge(), and again that is not used for the encoder bridge.
+
+Thus, while the original commit is not right, there should be no bugs
+caused by it, and for the time being I'm not sending a patch for the
+stable kernels for the original commit.
+
+This fix applies on top of commit 66cdf05f8548 ("drm/tidss: encoder:
+convert to devm_drm_bridge_alloc()"), which changes the tidss_encoder.c
+to use the devm variant (added in v6.17). The warning print was added in
+v6.19, so applying this fix to v6.17+ gets rid of the warning for all
+kernel versions.
+
+Cc: stable@vger.kernel.org # v6.17+
+Fixes: c932ced6b585 ("drm/tidss: Update encoder/bridge chain connect model")
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patch.msgid.link/20260311-tidss-minor-fixes-v2-2-cb4479784458@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/tidss/tidss_encoder.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_encoder.c b/drivers/gpu/drm/tidss/tidss_encoder.c
+index 81a04f767770..db467bbcdb77 100644
+--- a/drivers/gpu/drm/tidss/tidss_encoder.c
++++ b/drivers/gpu/drm/tidss/tidss_encoder.c
+@@ -106,6 +106,8 @@ int tidss_encoder_create(struct tidss_device *tidss,
+ enc = &t_enc->encoder;
+ enc->possible_crtcs = possible_crtcs;
+
++ devm_drm_bridge_add(tidss->dev, &t_enc->bridge);
++
+ /* Attaching first bridge to the encoder */
+ ret = drm_bridge_attach(enc, &t_enc->bridge, NULL,
+ DRM_BRIDGE_ATTACH_NO_CONNECTOR);
+--
+2.55.0
+
mctp-check-register_netdevice_notifier-error-in-mctp.patch
net-airoha-fix-ets-channel-derivation-in-airoha_tc_s.patch
bpf-sockmap-fix-cork-use-after-free-in-tcp_bpf_sendm.patch
+drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch
+drm-renesas-rzg2l_mipi_dsi-move-rzg2l_mipi_dsi_set_display_timing.patch
+drm-tidss-fix-missing-drm_bridge_add-call.patch
+drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch
+drm-rockchip-analogix_dp-add-missing-error-check-for-platform_get_resource.patch
+drm-imagination-count-paired-job-fence-as-dependency-in-prepare_job.patch
+drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch
+drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch
+drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch
+drm-imagination-fit-paired-fragment-job-in-the-correct-cccb.patch
+drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch
+drm-amdgpu-gfx-fix-cleaner-shader-ib-buffer-overflow.patch
+drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch
+drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch
+drm-amdgpu-check-amdgpu_vm_bo_find-result-in-get_mapping_info.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
