--- /dev/null
+From 32bd35f068a3507a1b3922cd12ea2985fc58c85b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timur=20Krist=C3=B3f?= <timur.kristof@gmail.com>
+Date: Mon, 25 May 2026 13:33:20 +0200
+Subject: drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+commit 32bd35f068a3507a1b3922cd12ea2985fc58c85b upstream.
+
+UVD 4.x and older can only access MSG, FEEDBACK buffers from a
+specific 256M VRAM segment that the VCPU BO is also located in.
+We already modify all placements of the given BO to ensure
+the BO is placed within this segment.
+
+Previously, it always assumed that the VCPU segment is
+the first 256M of VRAM, even though under some conditions
+the VCPU BO could be allocated outside this segment,
+which made UVD non-functional as the BOs were
+not inside the same segment as the UVD VCPU BO.
+
+Solve that by using the segment where the VCPU BO actually is.
+
+This fixes an issue with UVD failing to initialize on SI/CIK
+when resizable BAR is enabled and the VCPU BO is allocated
+in a different segment.
+
+v2:
+- For other BOs, keep using the same UVD segment as before.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/3851
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit cbfd4d3fc2061a1ec8e9d36e65973ac3e813358a)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 33 +++++++++++++++++++++++---------
+ 1 file changed, 24 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+@@ -135,7 +135,7 @@ MODULE_FIRMWARE(FIRMWARE_VEGA12);
+ MODULE_FIRMWARE(FIRMWARE_VEGA20);
+
+ static void amdgpu_uvd_idle_work_handler(struct work_struct *work);
+-static void amdgpu_uvd_force_into_uvd_segment(struct amdgpu_bo *abo);
++static void amdgpu_uvd_force_into_vcpu_segment(struct amdgpu_bo *abo);
+
+ static int amdgpu_uvd_create_msg_bo_helper(struct amdgpu_device *adev,
+ uint32_t size,
+@@ -158,7 +158,7 @@ static int amdgpu_uvd_create_msg_bo_help
+ amdgpu_bo_kunmap(bo);
+ amdgpu_bo_unpin(bo);
+ amdgpu_bo_placement_from_domain(bo, AMDGPU_GEM_DOMAIN_VRAM);
+- amdgpu_uvd_force_into_uvd_segment(bo);
++ amdgpu_uvd_force_into_vcpu_segment(bo);
+ r = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx);
+ if (r)
+ goto err;
+@@ -539,6 +539,24 @@ void amdgpu_uvd_free_handles(struct amdg
+ }
+ }
+
++static void amdgpu_uvd_force_into_vcpu_segment(struct amdgpu_bo *bo)
++{
++ struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev);
++ struct amdgpu_bo *vcpu_bo = adev->uvd.inst[0].vcpu_bo;
++ struct amdgpu_res_cursor vcpu_cur;
++
++ amdgpu_res_first(vcpu_bo->tbo.resource, 0,
++ amdgpu_bo_size(vcpu_bo), &vcpu_cur);
++
++ bo->placement.num_placement = 1;
++ bo->placement.placement = &bo->placements[0];
++ bo->placements[0].fpfn = ALIGN_DOWN(vcpu_cur.start, SZ_256M) >> PAGE_SHIFT;
++ bo->placements[0].lpfn = bo->placements[0].fpfn + (SZ_256M >> PAGE_SHIFT);
++ bo->placements[0].mem_type = vcpu_bo->tbo.resource->mem_type;
++ if (bo->placements[0].mem_type == TTM_PL_VRAM)
++ bo->placements[0].flags |= TTM_PL_FLAG_CONTIGUOUS;
++}
++
+ static void amdgpu_uvd_force_into_uvd_segment(struct amdgpu_bo *abo)
+ {
+ int i;
+@@ -587,13 +605,10 @@ static int amdgpu_uvd_cs_pass1(struct am
+ if (!ctx->parser->adev->uvd.address_64_bit) {
+ /* check if it's a message or feedback command */
+ cmd = amdgpu_ib_get_value(ctx->ib, ctx->idx) >> 1;
+- if (cmd == 0x0 || cmd == 0x3) {
+- /* yes, force it into VRAM */
+- uint32_t domain = AMDGPU_GEM_DOMAIN_VRAM;
+-
+- amdgpu_bo_placement_from_domain(bo, domain);
+- }
+- amdgpu_uvd_force_into_uvd_segment(bo);
++ if (cmd == 0x0 || cmd == 0x3)
++ amdgpu_uvd_force_into_vcpu_segment(bo);
++ else
++ amdgpu_uvd_force_into_uvd_segment(bo);
+
+ r = ttm_bo_validate(&bo->tbo, &bo->placement, &tctx);
+ }
--- /dev/null
+From 8002b744ad70055ef11ff7d0a7d685bfe8ffe6e4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timur=20Krist=C3=B3f?= <timur.kristof@gmail.com>
+Date: Mon, 25 May 2026 13:33:19 +0200
+Subject: drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+commit 8002b744ad70055ef11ff7d0a7d685bfe8ffe6e4 upstream.
+
+These UVD versions don't fully support GPUVM and are only
+validated to work when their VCPU BO is placed in VRAM.
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 01b8dfc0660db5d6cdd62c22dc20f774a26ce853)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+@@ -188,6 +188,7 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev
+ const struct common_firmware_header *hdr;
+ unsigned int family_id;
+ int i, j, r;
++ u32 vcpu_bo_domain;
+
+ INIT_DELAYED_WORK(&adev->uvd.idle_work, amdgpu_uvd_idle_work_handler);
+
+@@ -319,12 +320,20 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev
+ if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP)
+ bo_size += AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8);
+
++ /* UVD 5.0 and newer HW can use 64 bit addressing. */
++ adev->uvd.address_64_bit =
++ !amdgpu_device_ip_block_version_cmp(adev, AMD_IP_BLOCK_TYPE_UVD, 5, 0);
++
++ vcpu_bo_domain = AMDGPU_GEM_DOMAIN_VRAM;
++ if (adev->uvd.address_64_bit)
++ vcpu_bo_domain |= AMDGPU_GEM_DOMAIN_GTT;
++
+ for (j = 0; j < adev->uvd.num_uvd_inst; j++) {
+ if (adev->uvd.harvest_config & (1 << j))
+ continue;
++
+ r = amdgpu_bo_create_kernel(adev, bo_size, PAGE_SIZE,
+- AMDGPU_GEM_DOMAIN_VRAM |
+- AMDGPU_GEM_DOMAIN_GTT,
++ vcpu_bo_domain,
+ &adev->uvd.inst[j].vcpu_bo,
+ &adev->uvd.inst[j].gpu_addr,
+ &adev->uvd.inst[j].cpu_addr);
+@@ -339,10 +348,6 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev
+ adev->uvd.filp[i] = NULL;
+ }
+
+- /* from uvd v5.0 HW addressing capacity increased to 64 bits */
+- if (!amdgpu_device_ip_block_version_cmp(adev, AMD_IP_BLOCK_TYPE_UVD, 5, 0))
+- adev->uvd.address_64_bit = true;
+-
+ r = amdgpu_uvd_create_msg_bo_helper(adev, 128 << 10, &adev->uvd.ib_bo);
+ if (r)
+ return r;
--- /dev/null
+From 2d8b08844c0ecc6f2002fa68711e779aa18c8585 Mon Sep 17 00:00:00 2001
+From: Vitor Soares <vitor.soares@toradex.com>
+Date: Tue, 5 May 2026 14:47:05 +0100
+Subject: drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
+
+From: Vitor Soares <vitor.soares@toradex.com>
+
+commit 2d8b08844c0ecc6f2002fa68711e779aa18c8585 upstream.
+
+The deprecated UNIVERSAL_DEV_PM_OPS() macro uses the provided callbacks
+for both runtime PM and system sleep. This causes the DSI clocks to be
+disabled twice: once during runtime suspend and again during system
+suspend, resulting in a WARN message from the clock framework when
+attempting to disable already-disabled clocks.
+
+[ 84.384540] clk:231:5 already disabled
+[ 84.388314] WARNING: CPU: 2 PID: 531 at /drivers/clk/clk.c:1181 clk_core_disable+0xa4/0xac
+...
+[ 84.579183] Call trace:
+[ 84.581624] clk_core_disable+0xa4/0xac
+[ 84.585457] clk_disable+0x30/0x4c
+[ 84.588857] cdns_dsi_suspend+0x20/0x58 [cdns_dsi]
+[ 84.593651] pm_generic_suspend+0x2c/0x44
+[ 84.597661] ti_sci_pd_suspend+0xbc/0x15c
+[ 84.601670] dpm_run_callback+0x8c/0x14c
+[ 84.605588] __device_suspend+0x1a0/0x56c
+[ 84.609594] dpm_suspend+0x17c/0x21c
+[ 84.613165] dpm_suspend_start+0xa0/0xa8
+[ 84.617083] suspend_devices_and_enter+0x12c/0x634
+[ 84.621872] pm_suspend+0x1fc/0x368
+
+To address this issue, replace UNIVERSAL_DEV_PM_OPS() with
+RUNTIME_PM_OPS(). Bridge and panel drivers should only deal with runtime
+PM, as the DRM framework manages system-wide power transitions through
+the bridge enable() and disable() hooks.
+
+Link: https://lore.kernel.org/all/fbde0659-78f3-46e4-98cf-d832f765a18b@ideasonboard.com/
+Cc: stable@vger.kernel.org # 6.1.x
+Fixes: e19233955d9e ("drm/bridge: Add Cadence DSI driver")
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Link: https://patch.msgid.link/20260505134705.188661-2-ivitro@gmail.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+@@ -1157,7 +1157,7 @@ static const struct mipi_dsi_host_ops cd
+ .transfer = cdns_dsi_transfer,
+ };
+
+-static int __maybe_unused cdns_dsi_resume(struct device *dev)
++static int cdns_dsi_resume(struct device *dev)
+ {
+ struct cdns_dsi *dsi = dev_get_drvdata(dev);
+
+@@ -1168,7 +1168,7 @@ static int __maybe_unused cdns_dsi_resum
+ return 0;
+ }
+
+-static int __maybe_unused cdns_dsi_suspend(struct device *dev)
++static int cdns_dsi_suspend(struct device *dev)
+ {
+ struct cdns_dsi *dsi = dev_get_drvdata(dev);
+
+@@ -1178,8 +1178,9 @@ static int __maybe_unused cdns_dsi_suspe
+ return 0;
+ }
+
+-static UNIVERSAL_DEV_PM_OPS(cdns_dsi_pm_ops, cdns_dsi_suspend, cdns_dsi_resume,
+- NULL);
++static const struct dev_pm_ops cdns_dsi_pm_ops = {
++ RUNTIME_PM_OPS(cdns_dsi_suspend, cdns_dsi_resume, NULL)
++};
+
+ static int cdns_dsi_drm_probe(struct platform_device *pdev)
+ {
+@@ -1326,7 +1327,7 @@ static struct platform_driver cdns_dsi_p
+ .driver = {
+ .name = "cdns-dsi",
+ .of_match_table = cdns_dsi_of_match,
+- .pm = &cdns_dsi_pm_ops,
++ .pm = pm_ptr(&cdns_dsi_pm_ops),
+ },
+ };
+ module_platform_driver(cdns_dsi_platform_driver);
--- /dev/null
+From 55bd5e685bda455b9b50c835f8c8442d52a344a3 Mon Sep 17 00:00:00 2001
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Date: Fri, 10 Apr 2026 04:19:01 +0000
+Subject: drm/dp/mst: fix buffer overflows in sideband chunk accumulation
+
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+
+commit 55bd5e685bda455b9b50c835f8c8442d52a344a3 upstream.
+
+drm_dp_sideband_append_payload() has three related bugs when processing
+device-provided sideband reply data:
+
+1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken
+ directly from the DP sideband header. If a device sends msg_len=0,
+ curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len)
+ is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).
+ drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()
+ writes 255 bytes into msg[], both far out of bounds.
+
+2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is
+ only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks
+ until curchunk_idx reaches curchunk_len, writing up to 15 bytes past
+ the end of chunk[] into msg[].
+
+3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to
+ msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256],
+ so the memcpy can spill into adjacent struct fields.
+
+All three are reachable from any DP MST device that can forge sideband
+reply messages on a physical connection.
+
+Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
+Cc: <stable@vger.kernel.org> # v3.17+
+Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20260410041901.2438960-1-ashutoshdesai993@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -779,6 +779,12 @@ static bool drm_dp_sideband_append_paylo
+ {
+ u8 crc4;
+
++ /* curchunk_len must be >= 1 (min 1 CRC byte) and fit in chunk[] */
++ if (!msg->curchunk_len ||
++ msg->curchunk_len > ARRAY_SIZE(msg->chunk) ||
++ msg->curchunk_idx + replybuflen > ARRAY_SIZE(msg->chunk))
++ return false;
++
+ memcpy(&msg->chunk[msg->curchunk_idx], replybuf, replybuflen);
+ msg->curchunk_idx += replybuflen;
+
+@@ -789,6 +795,9 @@ static bool drm_dp_sideband_append_paylo
+ print_hex_dump(KERN_DEBUG, "wrong crc",
+ DUMP_PREFIX_NONE, 16, 1,
+ msg->chunk, msg->curchunk_len, false);
++ /* Guard against accumulated msg[] overflow */
++ if (msg->curlen + msg->curchunk_len - 1 > ARRAY_SIZE(msg->msg))
++ return false;
+ /* copy chunk into bigger msg */
+ memcpy(&msg->msg[msg->curlen], msg->chunk, msg->curchunk_len - 1);
+ msg->curlen += msg->curchunk_len - 1;
--- /dev/null
+From 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 Mon Sep 17 00:00:00 2001
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Date: Sun, 10 May 2026 20:17:33 +0000
+Subject: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
+
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+
+commit 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 upstream.
+
+drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw
+message and then unconditionally does:
+
+ memcpy(bytes, &raw->msg[idx], num_bytes);
+
+without checking that idx + num_bytes <= raw->curlen. raw->msg[] is
+256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger
+than the remaining payload, the memcpy reads past the received data
+into whatever follows in raw->msg[].
+
+drm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted
+with a /* TODO check */ comment since the code was introduced).
+
+Fix both functions by using a single combined check
+(idx + num_bytes > curlen) before each memcpy. Since num_bytes is u8,
+it is always >= 0, so this strictly subsumes the simpler idx > curlen
+form and no separate step is needed.
+
+Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
+Cc: <stable@vger.kernel.org> # v3.17+
+Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+[added missing fixes tag]
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20260510201733.2882224-1-ashutoshdesai993@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -861,7 +861,7 @@ static bool drm_dp_sideband_parse_remote
+ goto fail_len;
+ repmsg->u.remote_dpcd_read_ack.num_bytes = raw->msg[idx];
+ idx++;
+- if (idx > raw->curlen)
++ if (idx + repmsg->u.remote_dpcd_read_ack.num_bytes > raw->curlen)
+ goto fail_len;
+
+ memcpy(repmsg->u.remote_dpcd_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_dpcd_read_ack.num_bytes);
+@@ -897,7 +897,9 @@ static bool drm_dp_sideband_parse_remote
+ goto fail_len;
+ repmsg->u.remote_i2c_read_ack.num_bytes = raw->msg[idx];
+ idx++;
+- /* TODO check */
++ if (idx + repmsg->u.remote_i2c_read_ack.num_bytes > raw->curlen)
++ goto fail_len;
++
+ memcpy(repmsg->u.remote_i2c_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_i2c_read_ack.num_bytes);
+ return true;
+ fail_len:
--- /dev/null
+From 6b89ba3dba2f583626fb693e47e951ffb8bf591f Mon Sep 17 00:00:00 2001
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Date: Sun, 10 May 2026 20:31:28 +0000
+Subject: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
+
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+
+commit 6b89ba3dba2f583626fb693e47e951ffb8bf591f upstream.
+
+Three sideband reply parsers read 16-bit fields as:
+
+ val = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
+
+and check bounds only after the fact. When idx == raw->curlen,
+raw->msg[idx+1] reads one byte past the received message data into
+the following struct fields (curchunk_len, curchunk_idx, curlen).
+
+Affected functions:
+ - drm_dp_sideband_parse_enum_path_resources_ack()
+ full_payload_bw_number and avail_payload_bw_number fields
+ - drm_dp_sideband_parse_allocate_payload_ack()
+ allocated_pbn field
+ - drm_dp_sideband_parse_query_payload_ack()
+ allocated_pbn field
+
+Fix by using a single combined check (idx + 2 > curlen) before each
+2-byte read. Since the check is strictly tighter than idx > curlen,
+no separate step is needed.
+
+Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
+Cc: <stable@vger.kernel.org> # v3.17+
+Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+[added fixes tag]
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20260510203128.2884846-1-ashutoshdesai993@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 17 ++++-------------
+ 1 file changed, 4 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -924,16 +924,13 @@ static bool drm_dp_sideband_parse_enum_p
+ repmsg->u.path_resources.port_number = (raw->msg[idx] >> 4) & 0xf;
+ repmsg->u.path_resources.fec_capable = raw->msg[idx] & 0x1;
+ idx++;
+- if (idx > raw->curlen)
++ if (idx + 2 > raw->curlen)
+ goto fail_len;
+ repmsg->u.path_resources.full_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
+ idx += 2;
+- if (idx > raw->curlen)
++ if (idx + 2 > raw->curlen)
+ goto fail_len;
+ repmsg->u.path_resources.avail_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
+- idx += 2;
+- if (idx > raw->curlen)
+- goto fail_len;
+ return true;
+ fail_len:
+ DRM_DEBUG_KMS("enum resource parse length fail %d %d\n", idx, raw->curlen);
+@@ -951,12 +948,9 @@ static bool drm_dp_sideband_parse_alloca
+ goto fail_len;
+ repmsg->u.allocate_payload.vcpi = raw->msg[idx];
+ idx++;
+- if (idx > raw->curlen)
++ if (idx + 2 > raw->curlen)
+ goto fail_len;
+ repmsg->u.allocate_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
+- idx += 2;
+- if (idx > raw->curlen)
+- goto fail_len;
+ return true;
+ fail_len:
+ DRM_DEBUG_KMS("allocate payload parse length fail %d %d\n", idx, raw->curlen);
+@@ -970,12 +964,9 @@ static bool drm_dp_sideband_parse_query_
+
+ repmsg->u.query_payload.port_number = (raw->msg[idx] >> 4) & 0xf;
+ idx++;
+- if (idx > raw->curlen)
++ if (idx + 2 > raw->curlen)
+ goto fail_len;
+ repmsg->u.query_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx + 1]);
+- idx += 2;
+- if (idx > raw->curlen)
+- goto fail_len;
+ return true;
+ fail_len:
+ DRM_DEBUG_KMS("query payload parse length fail %d %d\n", idx, raw->curlen);
--- /dev/null
+From 46c31e1604d121221167cb09380de8c7d53290b9 Mon Sep 17 00:00:00 2001
+From: Sergey Shtylyov <s.shtylyov@auroraos.dev>
+Date: Fri, 30 Jan 2026 23:35:42 +0300
+Subject: drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
+
+From: Sergey Shtylyov <s.shtylyov@auroraos.dev>
+
+commit 46c31e1604d121221167cb09380de8c7d53290b9 upstream.
+
+The result of cdn_dp_reg_write() is checked everywhere (with the error
+being logged by the callers) except one place in cdn_dp_config_video().
+Add the missing result check, bailing out early on error...
+
+Found by Linux Verification Center (linuxtesting.org) with the Svace static
+analysis tool.
+
+Fixes: 1a0f7ed3abe2 ("drm/rockchip: cdn-dp: add cdn DP support for rk3399")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@auroraos.dev>
+Cc: stable@vger.kernel.org
+Reviewed-by: Chaoyi Chen <chaoyi.chen@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patch.msgid.link/adf6b313-f7db-4d8f-9000-8c65446ba041@auroraos.dev
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c
++++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
+@@ -683,6 +683,8 @@ int cdn_dp_config_video(struct cdn_dp_de
+ val = div_u64(8 * (symbol + 1), bit_per_pix) - val;
+ val += 2;
+ ret = cdn_dp_reg_write(dp, DP_VC_TABLE(15), val);
++ if (ret)
++ goto err_config_video;
+
+ switch (video->color_depth) {
+ case 6:
net-ipv6-fix-dif-and-sdif-mismatch-in-raw6_icmp_erro.patch
ice-fix-lag-recipe-to-profile-association.patch
bpf-sockmap-fix-cork-use-after-free-in-tcp_bpf_sendm.patch
+drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch
+drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch
+drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch
+drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch
+drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch
+drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch
+drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
