From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 12:40:22 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v6.1.179~50 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=7ddaa64b1bd5e70e97b78e6eb341a84baa47f686;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: drm-amd-pm-fix-smu14-power-limit-range-calculation.patch drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch drm-gfx10-program-db_ring_control.patch drm-i915-bios-range-check-lfp-data-block-panel_type2.patch drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch drm-i915-return-null-on-error-in-active_instance.patch --- diff --git a/queue-6.12/drm-amd-pm-fix-smu14-power-limit-range-calculation.patch b/queue-6.12/drm-amd-pm-fix-smu14-power-limit-range-calculation.patch new file mode 100644 index 0000000000..87859da54b --- /dev/null +++ b/queue-6.12/drm-amd-pm-fix-smu14-power-limit-range-calculation.patch @@ -0,0 +1,83 @@ +From e987eabc02646920cd13ab75902693e99735eca0 Mon Sep 17 00:00:00 2001 +From: Yang Wang +Date: Mon, 6 Jul 2026 09:29:24 +0800 +Subject: drm/amd/pm: fix smu14 power limit range calculation + +From: Yang Wang + +commit e987eabc02646920cd13ab75902693e99735eca0 upstream. + +SMU14 derives the default PPT limit from SocketPowerLimitAc/Dc, but +MsgLimits.Power may expose a different firmware limit for the same PPT0 +throttler. Using those values independently as fixed min/max bases can +report an incorrect configurable power range. + +Keep the socket power limit as the default value and as the fallback for +current-limit queries. Calculate the reported range from both firmware +values instead, using the lower value as the minimum base and the higher +value as the maximum base before applying OD percentages. + +Signed-off-by: Yang Wang +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +(cherry picked from commit c936b8126b444401318fcbeb1828488cc5312dee) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 28 ++++++++++--------- + 1 file changed, 16 insertions(+), 12 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +@@ -1672,19 +1672,23 @@ static int smu_v14_0_2_get_power_limit(s + table_context->power_play_table; + PPTable_t *pptable = table_context->driver_pptable; + CustomSkuTable_t *skutable = &pptable->CustomSkuTable; +- int16_t od_percent_upper = 0, od_percent_lower = 0; ++ uint32_t pp_limit = smu->adev->pm.ac_power ? ++ skutable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] : ++ skutable->SocketPowerLimitDc[PPT_THROTTLER_PPT0]; + uint32_t msg_limit = pptable->SkuTable.MsgLimits.Power[PPT_THROTTLER_PPT0][POWER_SOURCE_AC]; +- uint32_t power_limit; ++ uint32_t min_limit = min_t(uint32_t, pp_limit, msg_limit); ++ uint32_t max_limit = max_t(uint32_t, pp_limit, msg_limit); ++ int16_t od_percent_upper = 0, od_percent_lower = 0; ++ int ret; + +- if (smu_v14_0_get_current_power_limit(smu, &power_limit)) +- power_limit = smu->adev->pm.ac_power ? +- skutable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] : +- skutable->SocketPowerLimitDc[PPT_THROTTLER_PPT0]; ++ if (current_power_limit) { ++ ret = smu_v14_0_get_current_power_limit(smu, current_power_limit); ++ if (ret) ++ *current_power_limit = pp_limit; ++ } + +- if (current_power_limit) +- *current_power_limit = power_limit; + if (default_power_limit) +- *default_power_limit = power_limit; ++ *default_power_limit = pp_limit; + + if (powerplay_table) { + if (smu->od_enabled && +@@ -1698,15 +1702,15 @@ static int smu_v14_0_2_get_power_limit(s + } + + dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n", +- od_percent_upper, od_percent_lower, power_limit); ++ od_percent_upper, od_percent_lower, pp_limit); + + if (max_power_limit) { +- *max_power_limit = msg_limit * (100 + od_percent_upper); ++ *max_power_limit = max_limit * (100 + od_percent_upper); + *max_power_limit /= 100; + } + + if (min_power_limit) { +- *min_power_limit = power_limit * (100 + od_percent_lower); ++ *min_power_limit = min_limit * (100 + od_percent_lower); + *min_power_limit /= 100; + } + diff --git a/queue-6.12/drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch b/queue-6.12/drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch new file mode 100644 index 0000000000..172fe358e8 --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch @@ -0,0 +1,75 @@ +From 04cc4aa3617b0ed67e859f91f09de5d896a46f3a Mon Sep 17 00:00:00 2001 +From: Shahyan Soltani +Date: Mon, 6 Jul 2026 08:15:21 -0400 +Subject: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shahyan Soltani + +commit 04cc4aa3617b0ed67e859f91f09de5d896a46f3a upstream. + +The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only +valid while the lock is still being held. Once xa_unlock_irqrestore is +called and returned, the pointer is no longer under lock and is subject +to modification. Since, the caller still dereferences vm->task_info in +amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a +use after unlock problem. + +Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid() +through removing the amdgpu_vm_get_vm_from_pasid() function from +amdgpu_vm.c and making the relevant code inline to hold the lock while +it is still in use. + +Signed-off-by: Shahyan Soltani +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 25 ++++++++++--------------- + 1 file changed, 10 insertions(+), 15 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -2308,19 +2308,6 @@ static void amdgpu_vm_destroy_task_info( + kfree(ti); + } + +-static inline struct amdgpu_vm * +-amdgpu_vm_get_vm_from_pasid(struct amdgpu_device *adev, u32 pasid) +-{ +- struct amdgpu_vm *vm; +- unsigned long flags; +- +- xa_lock_irqsave(&adev->vm_manager.pasids, flags); +- vm = xa_load(&adev->vm_manager.pasids, pasid); +- xa_unlock_irqrestore(&adev->vm_manager.pasids, flags); +- +- return vm; +-} +- + /** + * amdgpu_vm_put_task_info - reference down the vm task_info ptr + * +@@ -2366,8 +2353,16 @@ amdgpu_vm_get_task_info_vm(struct amdgpu + struct amdgpu_task_info * + amdgpu_vm_get_task_info_pasid(struct amdgpu_device *adev, u32 pasid) + { +- return amdgpu_vm_get_task_info_vm( +- amdgpu_vm_get_vm_from_pasid(adev, pasid)); ++ struct amdgpu_task_info *ti; ++ struct amdgpu_vm *vm; ++ unsigned long flags; ++ ++ xa_lock_irqsave(&adev->vm_manager.pasids, flags); ++ vm = xa_load(&adev->vm_manager.pasids, pasid); ++ ti = amdgpu_vm_get_task_info_vm(vm); ++ xa_unlock_irqrestore(&adev->vm_manager.pasids, flags); ++ ++ return ti; + } + + static int amdgpu_vm_create_task_info(struct amdgpu_vm *vm) diff --git a/queue-6.12/drm-gfx10-program-db_ring_control.patch b/queue-6.12/drm-gfx10-program-db_ring_control.patch new file mode 100644 index 0000000000..01efa3a7de --- /dev/null +++ b/queue-6.12/drm-gfx10-program-db_ring_control.patch @@ -0,0 +1,43 @@ +From f0262c3a3f14d60140f6b826d40d44edf62c36d6 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 26 Jun 2026 16:29:13 -0400 +Subject: drm/gfx10: Program DB_RING_CONTROL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit f0262c3a3f14d60140f6b826d40d44edf62c36d6 upstream. + +This is needed to allocate occlusion counters across +both gfx pipes. + +Fixes: b7a1a0ef12b8 ("drm/amd/amdgpu: add pipe1 hardware support") +Reviewed-by: Timur Kristóf +Signed-off-by: Alex Deucher +(cherry picked from commit 6807352cbabb74b61ba42888769283af72191f66) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -5195,6 +5195,15 @@ static void gfx_v10_0_constants_init(str + gfx_v10_0_get_tcc_info(adev); + adev->gfx.config.pa_sc_tile_steering_override = + gfx_v10_0_init_pa_sc_tile_steering_override(adev); ++ /* Program DB_RING_CONTROL for multiple GFX pipes ++ * Default power up value is 1. ++ * Possible values: ++ * 0 - split occlusion counters between gfx pipes ++ * 1 - all occlusion counters to pipe 0 ++ * 2 - all occlusion counters to pipe 1 ++ */ ++ WREG32_FIELD15(GC, 0, DB_RING_CONTROL, COUNTER_CONTROL, ++ (adev->gfx.me.num_pipe_per_me > 1) ? 0 : 1); + + /* XXX SH_MEM regs */ + /* where to put LDS, scratch, GPUVM in FSA64 space */ diff --git a/queue-6.12/drm-i915-bios-range-check-lfp-data-block-panel_type2.patch b/queue-6.12/drm-i915-bios-range-check-lfp-data-block-panel_type2.patch new file mode 100644 index 0000000000..73b1724f7d --- /dev/null +++ b/queue-6.12/drm-i915-bios-range-check-lfp-data-block-panel_type2.patch @@ -0,0 +1,107 @@ +From 2084503f2d087bf956198e7f6eb25b03a7049cb2 Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Fri, 26 Jun 2026 17:01:55 +0300 +Subject: drm/i915/bios: range check LFP Data Block panel_type2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +commit 2084503f2d087bf956198e7f6eb25b03a7049cb2 upstream. + +While the panel_type from LFP Data Block is range checked, panel_type2 +is not. Add a few helpers for range checking, and use them to not only +check panel_type2, but also improve clarity and correctness in the panel +type selection. + +Discovered using AI-assisted static analysis confirmed by Intel Product +Security. + +v2: +- Fix commit message typo (Michał) +- Add is_panel_type_pnp() (Ville) + +Reported-by: Martin Hodo +Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT") +Cc: stable@vger.kernel.org # v6.0+ +Cc: Animesh Manna +Cc: Ville Syrjälä +Reviewed-by: Michał Grzelak # v1 +Reviewed-by: Ville Syrjälä +Link: https://patch.msgid.link/20260626140155.1389655-1-jani.nikula@intel.com +Signed-off-by: Jani Nikula +(cherry picked from commit c9ebe5d2f25729d6cfbbb1235d640bf67f9275df) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_bios.c | 36 +++++++++++++++++++++++------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_bios.c ++++ b/drivers/gpu/drm/i915/display/intel_bios.c +@@ -620,6 +620,21 @@ get_lfp_data_tail(const struct bdb_lfp_d + return NULL; + } + ++static bool is_panel_type_valid(int panel_type) ++{ ++ return panel_type >= 0 && panel_type < 16; ++} ++ ++static bool is_panel_type_pnp(int panel_type) ++{ ++ return panel_type == 0xff; ++} ++ ++static bool is_panel_type_valid_or_pnp(int panel_type) ++{ ++ return is_panel_type_valid(panel_type) || is_panel_type_pnp(panel_type); ++} ++ + static int opregion_get_panel_type(struct intel_display *display, + const struct intel_bios_encoder_data *devdata, + const struct drm_edid *drm_edid, bool use_fallback) +@@ -637,15 +652,21 @@ static int vbt_get_panel_type(struct int + if (!lfp_options) + return -1; + +- if (lfp_options->panel_type > 0xf && +- lfp_options->panel_type != 0xff) { ++ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type)) { + drm_dbg_kms(display->drm, "Invalid VBT panel type 0x%x\n", + lfp_options->panel_type); + return -1; + } + +- if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2) ++ if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2) { ++ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type2)) { ++ drm_dbg_kms(display->drm, "Invalid VBT panel type 2 0x%x\n", ++ lfp_options->panel_type2); ++ return -1; ++ } ++ + return lfp_options->panel_type2; ++ } + + drm_WARN_ON(display->drm, + devdata && devdata->child.handle != DEVICE_HANDLE_LFP1); +@@ -759,13 +780,12 @@ static int get_panel_type(struct intel_d + panel_types[i].name, panel_types[i].panel_type); + } + +- if (panel_types[PANEL_TYPE_OPREGION].panel_type >= 0) ++ if (is_panel_type_valid(panel_types[PANEL_TYPE_OPREGION].panel_type)) + i = PANEL_TYPE_OPREGION; +- else if (panel_types[PANEL_TYPE_VBT].panel_type == 0xff && +- panel_types[PANEL_TYPE_PNPID].panel_type >= 0) ++ else if (is_panel_type_pnp(panel_types[PANEL_TYPE_VBT].panel_type) && ++ is_panel_type_valid(panel_types[PANEL_TYPE_PNPID].panel_type)) + i = PANEL_TYPE_PNPID; +- else if (panel_types[PANEL_TYPE_VBT].panel_type != 0xff && +- panel_types[PANEL_TYPE_VBT].panel_type >= 0) ++ else if (is_panel_type_valid(panel_types[PANEL_TYPE_VBT].panel_type)) + i = PANEL_TYPE_VBT; + else + i = PANEL_TYPE_FALLBACK; diff --git a/queue-6.12/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch b/queue-6.12/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch new file mode 100644 index 0000000000..ebca890189 --- /dev/null +++ b/queue-6.12/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch @@ -0,0 +1,84 @@ +From eed3de2acf6aa5154d49098b026710b646db67ee Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 1 Jul 2026 10:30:30 +0300 +Subject: drm/i915/gem: Do not leak siblings[] on proto context error + +From: Joonas Lahtinen + +commit eed3de2acf6aa5154d49098b026710b646db67ee upstream. + +After a successful BALANCE/PARALLEL_SUBMIT extension on context +creation, error during processing of next user extension leaks +the siblings[] array. Fix that. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") +Cc: Faith Ekstrand +Cc: Simona Vetter +Cc: Tvrtko Ursulin +Cc: Maarten Lankhorst +Cc: # v5.15+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Maarten Lankhorst +Signed-off-by: Tvrtko Ursulin +Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gem/i915_gem_context.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c +@@ -771,8 +771,8 @@ static int set_proto_ctx_engines(struct + struct intel_engine_cs *engine; + + if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) { +- kfree(set.engines); +- return -EFAULT; ++ err = -EFAULT; ++ goto err; + } + + memset(&set.engines[n], 0, sizeof(set.engines[n])); +@@ -788,8 +788,8 @@ static int set_proto_ctx_engines(struct + drm_dbg(&i915->drm, + "Invalid engine[%d]: { class:%d, instance:%d }\n", + n, ci.engine_class, ci.engine_instance); +- kfree(set.engines); +- return -ENOENT; ++ err = -ENOENT; ++ goto err; + } + + set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL; +@@ -802,15 +802,21 @@ static int set_proto_ctx_engines(struct + set_proto_ctx_engines_extensions, + ARRAY_SIZE(set_proto_ctx_engines_extensions), + &set); +- if (err) { +- kfree(set.engines); +- return err; +- } ++ if (err) ++ goto err_extensions; + + pc->num_user_engines = set.num_engines; + pc->user_engines = set.engines; + + return 0; ++ ++err_extensions: ++ for (n = 0; n < set.num_engines; n++) ++ kfree(set.engines[n].siblings); ++err: ++ kfree(set.engines); ++ ++ return err; + } + + static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv, diff --git a/queue-6.12/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch b/queue-6.12/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch new file mode 100644 index 0000000000..8dffe316d7 --- /dev/null +++ b/queue-6.12/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch @@ -0,0 +1,46 @@ +From 2b56757a9a7456825eb668fde92299e01c5e2721 Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 1 Jul 2026 10:55:55 +0300 +Subject: drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU + +From: Joonas Lahtinen + +commit 2b56757a9a7456825eb668fde92299e01c5e2721 upstream. + +Setting context engine slot N into I915_ENGINE_CLASS_INVALID / +I915_ENGINE_CLASS_INVALID_NONE and attempting to apply +I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL. +Fix that. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") +Cc: Faith Ekstrand +Cc: Simona Vetter +Cc: Tvrtko Ursulin +Cc: Maarten Lankhorst +Cc: # v5.15+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Maarten Lankhorst +Reviewed-by: Andi Shyti +Link: https://patch.msgid.link/20260701075555.52142-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gem/i915_gem_context.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c +@@ -858,7 +858,7 @@ static int set_proto_ctx_sseu(struct drm + pe = &pc->user_engines[idx]; + + /* Only render engine supports RPCS configuration. */ +- if (pe->engine->class != RENDER_CLASS) ++ if (!pe->engine || pe->engine->class != RENDER_CLASS) + return -EINVAL; + + sseu = &pe->sseu; diff --git a/queue-6.12/drm-i915-return-null-on-error-in-active_instance.patch b/queue-6.12/drm-i915-return-null-on-error-in-active_instance.patch new file mode 100644 index 0000000000..3fc350f8b6 --- /dev/null +++ b/queue-6.12/drm-i915-return-null-on-error-in-active_instance.patch @@ -0,0 +1,58 @@ +From 1e33f0de5fdcd09e51fdec1e5822448970b6420f Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 24 Jun 2026 12:09:40 +0300 +Subject: drm/i915: Return NULL on error in active_instance +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Joonas Lahtinen + +commit 1e33f0de5fdcd09e51fdec1e5822448970b6420f upstream. + +Avoid returning &node->base when node is NULL due to OOM +during GFP_ATOMIC allocation. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: bfaae47db3c0 ("drm/i915: make lockdep slightly happier about execbuf.") +Cc: Maarten Lankhorst +Cc: Thomas Hellström +Cc: Simona Vetter +Cc: # v5.13+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Sebastian Brzezinka +Reviewed-by: Maarten Lankhorst +Link: https://patch.msgid.link/20260624090940.74840-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit 6029bc064f0b1bac184203a50fbaaf070fa18832) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/i915_active.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_active.c ++++ b/drivers/gpu/drm/i915/i915_active.c +@@ -319,7 +319,7 @@ active_instance(struct i915_active *ref, + */ + node = kmem_cache_alloc(slab_cache, GFP_ATOMIC); + if (!node) +- goto out; ++ goto err; + + __i915_active_fence_init(&node->base, NULL, node_retire); + node->ref = ref; +@@ -333,6 +333,11 @@ out: + spin_unlock_irq(&ref->tree_lock); + + return &node->base; ++ ++err: ++ spin_unlock_irq(&ref->tree_lock); ++ ++ return NULL; + } + + void __i915_active_init(struct i915_active *ref, diff --git a/queue-6.12/series b/queue-6.12/series index a0e6b037ab..e9aa5c7c32 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -282,3 +282,10 @@ drm-amdgpu-sdma7.0-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch +drm-i915-return-null-on-error-in-active_instance.patch +drm-i915-bios-range-check-lfp-data-block-panel_type2.patch +drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch +drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch +drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch +drm-amd-pm-fix-smu14-power-limit-range-calculation.patch +drm-gfx10-program-db_ring_control.patch