--- /dev/null
+From a6e14b976be48eebd8769cb5b883a6af7fc5ade1 Mon Sep 17 00:00:00 2001
+From: WenTao Liang <vulab@iscas.ac.cn>
+Date: Fri, 26 Jun 2026 20:45:55 +0800
+Subject: drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
+
+From: WenTao Liang <vulab@iscas.ac.cn>
+
+commit a6e14b976be48eebd8769cb5b883a6af7fc5ade1 upstream.
+
+prev_sink is unconditionally retained via dc_sink_retain at function
+ entry, but the DP alt mode timeout path inside SIGNAL_TYPE_DISPLAY_PORT
+ returns false without releasing prev_sink. All other return paths in the
+ function correctly call dc_sink_release(prev_sink), making this the only
+ missing cleanup.
+
+Fixes: 54618888d1ea ("drm/amd/display: break down dc_link.c")
+Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20260626124555.36910-1-vulab@iscas.ac.cn
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 45510cf662dcf46b5d8926d454f338809f107b9d)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/link/link_detection.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+@@ -958,8 +958,11 @@ static bool detect_link_and_local_sink(s
+ link->link_enc->features.flags.bits.DP_IS_USB_C == 1) {
+
+ /* if alt mode times out, return false */
+- if (!wait_for_entering_dp_alt_mode(link))
++ if (!wait_for_entering_dp_alt_mode(link)) {
++ if (prev_sink)
++ dc_sink_release(prev_sink);
+ return false;
++ }
+ }
+
+ if (!detect_dp(link, &sink_caps, reason)) {
--- /dev/null
+From ac11060c6d4959e2d4ceada037d2e1e1bfcf6645 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Wed, 10 Jun 2026 17:18:17 +0200
+Subject: drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit ac11060c6d4959e2d4ceada037d2e1e1bfcf6645 upstream.
+
+The mode-setting pipeline can disabled damage clippings for a commit
+by setting ignore_damage_clips in struct drm_plane_state. The commit
+will then do a full display update.
+
+Test the flag in DCN code and do a full update in DCN code if it has
+been set.
+
+Commit 35ed38d58257 ("drm: Allow drivers to indicate the damage helpers
+to ignore damage clips") introduced ignore_damage_clips to selectively
+ignore damage clipping in certain framebuffer changes. This driver does
+not do that, but DRM's damage iterator will soon rely on the flag.
+Therefore supporting it here as well make sense for consistency.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: 35ed38d58257 ("drm: Allow drivers to indicate the damage helpers to ignore damage clips")
+Cc: Javier Martinez Canillas <javierm@redhat.com>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Zack Rusin <zackr@vmware.com>
+Cc: dri-devel@lists.freedesktop.org
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit a24019f6480fad5c077b5956eed942c8960323d6)
+Cc: <stable@vger.kernel.org> # v6.8+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -5180,8 +5180,8 @@ static void fill_dc_dirty_rects(struct d
+ {
+ struct dm_crtc_state *dm_crtc_state = to_dm_crtc_state(crtc_state);
+ struct rect *dirty_rects = flip_addrs->dirty_rects;
+- u32 num_clips;
+- struct drm_mode_rect *clips;
++ u32 num_clips = 0;
++ struct drm_mode_rect *clips = NULL;
+ bool bb_changed;
+ bool fb_changed;
+ u32 i = 0;
+@@ -5197,8 +5197,10 @@ static void fill_dc_dirty_rects(struct d
+ if (new_plane_state->rotation != DRM_MODE_ROTATE_0)
+ goto ffu;
+
+- num_clips = drm_plane_get_damage_clips_count(new_plane_state);
+- clips = drm_plane_get_damage_clips(new_plane_state);
++ if (!new_plane_state->ignore_damage_clips) {
++ num_clips = drm_plane_get_damage_clips_count(new_plane_state);
++ clips = drm_plane_get_damage_clips(new_plane_state);
++ }
+
+ if (!dm_crtc_state->mpo_requested) {
+ if (!num_clips || num_clips > DC_MAX_DIRTY_RECTS)
--- /dev/null
+From 9e98ed3113943257ad6e5c1e6beddbdb482a70ad Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:26:28 -0400
+Subject: drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 9e98ed3113943257ad6e5c1e6beddbdb482a70ad upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
+@@ -520,7 +520,7 @@ static void sdma_v5_0_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -531,7 +531,7 @@ static void sdma_v5_0_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3));
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(seq));
--- /dev/null
+From b9dd618a635d39fbb211454b6e8837b2a7f10fb0 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:27:15 -0400
+Subject: drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b9dd618a635d39fbb211454b6e8837b2a7f10fb0 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ae658afc7f47f6147371ec42cc6b1a793dfdb5af)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
+@@ -337,7 +337,7 @@ static void sdma_v5_2_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -348,7 +348,7 @@ static void sdma_v5_2_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3));
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(seq));
--- /dev/null
+From ec42c96c322e5cc48099ab5e67b5cbe236cb1949 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:27:54 -0400
+Subject: drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit ec42c96c322e5cc48099ab5e67b5cbe236cb1949 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c
+@@ -343,7 +343,7 @@ static void sdma_v6_0_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -354,7 +354,7 @@ static void sdma_v6_0_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3));
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(seq));
--- /dev/null
+From 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Sat, 20 Jun 2026 21:43:34 -0500
+Subject: drm/virtio: bound EDID block reads to the response buffer
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd upstream.
+
+virtio_get_edid_block() validates the read offset only against the
+device-supplied resp->size field, never against the fixed-size resp->edid
+array. The EDID block index is driven by the device-supplied extension
+count, so a malicious virtio-gpu backend can advertise a large size
+together with a high block count and read far past the array into adjacent
+kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds
+read / info leak).
+
+Also reject any read whose end exceeds the size of the edid array.
+Conforming EDID responses stay within the array and are unaffected.
+
+Fixes: b4b01b4995fb ("drm/virtio: add edid support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Link: https://patch.msgid.link/20260620-b4-disp-22bba7bf-v1-1-b95924cee742@proton.me
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_vq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -723,7 +723,8 @@ static int virtio_get_edid_block(void *d
+ struct virtio_gpu_resp_edid *resp = data;
+ size_t start = block * EDID_LENGTH;
+
+- if (start + len > le32_to_cpu(resp->size))
++ if (start + len > le32_to_cpu(resp->size) ||
++ start + len > sizeof(resp->edid))
+ return -EINVAL;
+ memcpy(buf, resp->edid + start, len);
+ return 0;
drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch
drm-radeon-fix-r100_copy_blit-for-large-bos.patch
drm-amdkfd-check-bounds-in-allocate_event_notification_slot.patch
+drm-amd-display-handle-struct-drm_plane_state.ignore_damage_clips.patch
+drm-amd-display-detect_link_and_local_sink-dp-alt-mode-timeout-path-leaks-prev_sink-reference.patch
+drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch
+drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch
+drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch
+drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch
drm-displayid-fix-tiled-display-topology-id-size.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
