From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 10:39:36 +0000 (+0200) Subject: 6.12-stable patches X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=c537b5a42b39e37dab4543c2353964e304c7f894;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch drm-imagination-count-paired-job-fence-as-dependency-in-prepare_job.patch drm-imagination-fit-paired-fragment-job-in-the-correct-cccb.patch drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch --- diff --git a/queue-6.12/drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch b/queue-6.12/drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch new file mode 100644 index 0000000000..4d6977b1b9 --- /dev/null +++ b/queue-6.12/drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch @@ -0,0 +1,106 @@ +From 32bd35f068a3507a1b3922cd12ea2985fc58c85b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timur=20Krist=C3=B3f?= +Date: Mon, 25 May 2026 13:33:20 +0200 +Subject: drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +commit 32bd35f068a3507a1b3922cd12ea2985fc58c85b upstream. + +UVD 4.x and older can only access MSG, FEEDBACK buffers from a +specific 256M VRAM segment that the VCPU BO is also located in. +We already modify all placements of the given BO to ensure +the BO is placed within this segment. + +Previously, it always assumed that the VCPU segment is +the first 256M of VRAM, even though under some conditions +the VCPU BO could be allocated outside this segment, +which made UVD non-functional as the BOs were +not inside the same segment as the UVD VCPU BO. + +Solve that by using the segment where the VCPU BO actually is. + +This fixes an issue with UVD failing to initialize on SI/CIK +when resizable BAR is enabled and the VCPU BO is allocated +in a different segment. + +v2: +- For other BOs, keep using the same UVD segment as before. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/3851 +Reviewed-by: Christian König +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +(cherry picked from commit cbfd4d3fc2061a1ec8e9d36e65973ac3e813358a) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 33 +++++++++++++++++++++++--------- + 1 file changed, 24 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +@@ -135,7 +135,7 @@ MODULE_FIRMWARE(FIRMWARE_VEGA12); + MODULE_FIRMWARE(FIRMWARE_VEGA20); + + static void amdgpu_uvd_idle_work_handler(struct work_struct *work); +-static void amdgpu_uvd_force_into_uvd_segment(struct amdgpu_bo *abo); ++static void amdgpu_uvd_force_into_vcpu_segment(struct amdgpu_bo *abo); + + static int amdgpu_uvd_create_msg_bo_helper(struct amdgpu_device *adev, + uint32_t size, +@@ -158,7 +158,7 @@ static int amdgpu_uvd_create_msg_bo_help + amdgpu_bo_kunmap(bo); + amdgpu_bo_unpin(bo); + amdgpu_bo_placement_from_domain(bo, AMDGPU_GEM_DOMAIN_VRAM); +- amdgpu_uvd_force_into_uvd_segment(bo); ++ amdgpu_uvd_force_into_vcpu_segment(bo); + r = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx); + if (r) + goto err; +@@ -544,6 +544,24 @@ void amdgpu_uvd_free_handles(struct amdg + } + } + ++static void amdgpu_uvd_force_into_vcpu_segment(struct amdgpu_bo *bo) ++{ ++ struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev); ++ struct amdgpu_bo *vcpu_bo = adev->uvd.inst[0].vcpu_bo; ++ struct amdgpu_res_cursor vcpu_cur; ++ ++ amdgpu_res_first(vcpu_bo->tbo.resource, 0, ++ amdgpu_bo_size(vcpu_bo), &vcpu_cur); ++ ++ bo->placement.num_placement = 1; ++ bo->placement.placement = &bo->placements[0]; ++ bo->placements[0].fpfn = ALIGN_DOWN(vcpu_cur.start, SZ_256M) >> PAGE_SHIFT; ++ bo->placements[0].lpfn = bo->placements[0].fpfn + (SZ_256M >> PAGE_SHIFT); ++ bo->placements[0].mem_type = vcpu_bo->tbo.resource->mem_type; ++ if (bo->placements[0].mem_type == TTM_PL_VRAM) ++ bo->placements[0].flags |= TTM_PL_FLAG_CONTIGUOUS; ++} ++ + static void amdgpu_uvd_force_into_uvd_segment(struct amdgpu_bo *abo) + { + int i; +@@ -594,13 +612,10 @@ static int amdgpu_uvd_cs_pass1(struct am + if (!ctx->parser->adev->uvd.address_64_bit) { + /* check if it's a message or feedback command */ + cmd = amdgpu_ib_get_value(ctx->ib, ctx->idx) >> 1; +- if (cmd == 0x0 || cmd == 0x3) { +- /* yes, force it into VRAM */ +- uint32_t domain = AMDGPU_GEM_DOMAIN_VRAM; +- +- amdgpu_bo_placement_from_domain(bo, domain); +- } +- amdgpu_uvd_force_into_uvd_segment(bo); ++ if (cmd == 0x0 || cmd == 0x3) ++ amdgpu_uvd_force_into_vcpu_segment(bo); ++ else ++ amdgpu_uvd_force_into_uvd_segment(bo); + + r = ttm_bo_validate(&bo->tbo, &bo->placement, &tctx); + } diff --git a/queue-6.12/drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch b/queue-6.12/drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch new file mode 100644 index 0000000000..854b05e323 --- /dev/null +++ b/queue-6.12/drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch @@ -0,0 +1,69 @@ +From 8002b744ad70055ef11ff7d0a7d685bfe8ffe6e4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timur=20Krist=C3=B3f?= +Date: Mon, 25 May 2026 13:33:19 +0200 +Subject: drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +commit 8002b744ad70055ef11ff7d0a7d685bfe8ffe6e4 upstream. + +These UVD versions don't fully support GPUVM and are only +validated to work when their VCPU BO is placed in VRAM. + +Signed-off-by: Timur Kristóf +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 01b8dfc0660db5d6cdd62c22dc20f774a26ce853) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +@@ -188,6 +188,7 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev + const struct common_firmware_header *hdr; + unsigned int family_id; + int i, j, r; ++ u32 vcpu_bo_domain; + + INIT_DELAYED_WORK(&adev->uvd.idle_work, amdgpu_uvd_idle_work_handler); + +@@ -319,12 +320,20 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev + if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) + bo_size += AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8); + ++ /* UVD 5.0 and newer HW can use 64 bit addressing. */ ++ adev->uvd.address_64_bit = ++ !amdgpu_device_ip_block_version_cmp(adev, AMD_IP_BLOCK_TYPE_UVD, 5, 0); ++ ++ vcpu_bo_domain = AMDGPU_GEM_DOMAIN_VRAM; ++ if (adev->uvd.address_64_bit) ++ vcpu_bo_domain |= AMDGPU_GEM_DOMAIN_GTT; ++ + for (j = 0; j < adev->uvd.num_uvd_inst; j++) { + if (adev->uvd.harvest_config & (1 << j)) + continue; ++ + r = amdgpu_bo_create_kernel(adev, bo_size, PAGE_SIZE, +- AMDGPU_GEM_DOMAIN_VRAM | +- AMDGPU_GEM_DOMAIN_GTT, ++ vcpu_bo_domain, + &adev->uvd.inst[j].vcpu_bo, + &adev->uvd.inst[j].gpu_addr, + &adev->uvd.inst[j].cpu_addr); +@@ -339,10 +348,6 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev + adev->uvd.filp[i] = NULL; + } + +- /* from uvd v5.0 HW addressing capacity increased to 64 bits */ +- if (!amdgpu_device_ip_block_version_cmp(adev, AMD_IP_BLOCK_TYPE_UVD, 5, 0)) +- adev->uvd.address_64_bit = true; +- + r = amdgpu_uvd_create_msg_bo_helper(adev, 128 << 10, &adev->uvd.ib_bo); + if (r) + return r; diff --git a/queue-6.12/drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch b/queue-6.12/drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch new file mode 100644 index 0000000000..3f4ff54680 --- /dev/null +++ b/queue-6.12/drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch @@ -0,0 +1,90 @@ +From 2d8b08844c0ecc6f2002fa68711e779aa18c8585 Mon Sep 17 00:00:00 2001 +From: Vitor Soares +Date: Tue, 5 May 2026 14:47:05 +0100 +Subject: drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() + +From: Vitor Soares + +commit 2d8b08844c0ecc6f2002fa68711e779aa18c8585 upstream. + +The deprecated UNIVERSAL_DEV_PM_OPS() macro uses the provided callbacks +for both runtime PM and system sleep. This causes the DSI clocks to be +disabled twice: once during runtime suspend and again during system +suspend, resulting in a WARN message from the clock framework when +attempting to disable already-disabled clocks. + +[ 84.384540] clk:231:5 already disabled +[ 84.388314] WARNING: CPU: 2 PID: 531 at /drivers/clk/clk.c:1181 clk_core_disable+0xa4/0xac +... +[ 84.579183] Call trace: +[ 84.581624] clk_core_disable+0xa4/0xac +[ 84.585457] clk_disable+0x30/0x4c +[ 84.588857] cdns_dsi_suspend+0x20/0x58 [cdns_dsi] +[ 84.593651] pm_generic_suspend+0x2c/0x44 +[ 84.597661] ti_sci_pd_suspend+0xbc/0x15c +[ 84.601670] dpm_run_callback+0x8c/0x14c +[ 84.605588] __device_suspend+0x1a0/0x56c +[ 84.609594] dpm_suspend+0x17c/0x21c +[ 84.613165] dpm_suspend_start+0xa0/0xa8 +[ 84.617083] suspend_devices_and_enter+0x12c/0x634 +[ 84.621872] pm_suspend+0x1fc/0x368 + +To address this issue, replace UNIVERSAL_DEV_PM_OPS() with +RUNTIME_PM_OPS(). Bridge and panel drivers should only deal with runtime +PM, as the DRM framework manages system-wide power transitions through +the bridge enable() and disable() hooks. + +Link: https://lore.kernel.org/all/fbde0659-78f3-46e4-98cf-d832f765a18b@ideasonboard.com/ +Cc: stable@vger.kernel.org # 6.1.x +Fixes: e19233955d9e ("drm/bridge: Add Cadence DSI driver") +Reviewed-by: Tomi Valkeinen +Signed-off-by: Vitor Soares +Reviewed-by: Luca Ceresoli +Link: https://patch.msgid.link/20260505134705.188661-2-ivitro@gmail.com +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c +@@ -1157,7 +1157,7 @@ static const struct mipi_dsi_host_ops cd + .transfer = cdns_dsi_transfer, + }; + +-static int __maybe_unused cdns_dsi_resume(struct device *dev) ++static int cdns_dsi_resume(struct device *dev) + { + struct cdns_dsi *dsi = dev_get_drvdata(dev); + +@@ -1168,7 +1168,7 @@ static int __maybe_unused cdns_dsi_resum + return 0; + } + +-static int __maybe_unused cdns_dsi_suspend(struct device *dev) ++static int cdns_dsi_suspend(struct device *dev) + { + struct cdns_dsi *dsi = dev_get_drvdata(dev); + +@@ -1178,8 +1178,9 @@ static int __maybe_unused cdns_dsi_suspe + return 0; + } + +-static UNIVERSAL_DEV_PM_OPS(cdns_dsi_pm_ops, cdns_dsi_suspend, cdns_dsi_resume, +- NULL); ++static const struct dev_pm_ops cdns_dsi_pm_ops = { ++ RUNTIME_PM_OPS(cdns_dsi_suspend, cdns_dsi_resume, NULL) ++}; + + static int cdns_dsi_drm_probe(struct platform_device *pdev) + { +@@ -1326,7 +1327,7 @@ static struct platform_driver cdns_dsi_p + .driver = { + .name = "cdns-dsi", + .of_match_table = cdns_dsi_of_match, +- .pm = &cdns_dsi_pm_ops, ++ .pm = pm_ptr(&cdns_dsi_pm_ops), + }, + }; + module_platform_driver(cdns_dsi_platform_driver); diff --git a/queue-6.12/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch b/queue-6.12/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch new file mode 100644 index 0000000000..ceac89a1ff --- /dev/null +++ b/queue-6.12/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch @@ -0,0 +1,67 @@ +From 55bd5e685bda455b9b50c835f8c8442d52a344a3 Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Fri, 10 Apr 2026 04:19:01 +0000 +Subject: drm/dp/mst: fix buffer overflows in sideband chunk accumulation + +From: Ashutosh Desai + +commit 55bd5e685bda455b9b50c835f8c8442d52a344a3 upstream. + +drm_dp_sideband_append_payload() has three related bugs when processing +device-provided sideband reply data: + +1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken + directly from the DP sideband header. If a device sends msg_len=0, + curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) + is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). + drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() + writes 255 bytes into msg[], both far out of bounds. + +2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is + only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks + until curchunk_idx reaches curchunk_len, writing up to 15 bytes past + the end of chunk[] into msg[]. + +3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to + msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], + so the memcpy can spill into adjacent struct fields. + +All three are reachable from any DP MST device that can forge sideband +reply messages on a physical connection. + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: # v3.17+ +Signed-off-by: Ashutosh Desai +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patch.msgid.link/20260410041901.2438960-1-ashutoshdesai993@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -780,6 +780,12 @@ static bool drm_dp_sideband_append_paylo + { + u8 crc4; + ++ /* curchunk_len must be >= 1 (min 1 CRC byte) and fit in chunk[] */ ++ if (!msg->curchunk_len || ++ msg->curchunk_len > ARRAY_SIZE(msg->chunk) || ++ msg->curchunk_idx + replybuflen > ARRAY_SIZE(msg->chunk)) ++ return false; ++ + memcpy(&msg->chunk[msg->curchunk_idx], replybuf, replybuflen); + msg->curchunk_idx += replybuflen; + +@@ -790,6 +796,9 @@ static bool drm_dp_sideband_append_paylo + print_hex_dump(KERN_DEBUG, "wrong crc", + DUMP_PREFIX_NONE, 16, 1, + msg->chunk, msg->curchunk_len, false); ++ /* Guard against accumulated msg[] overflow */ ++ if (msg->curlen + msg->curchunk_len - 1 > ARRAY_SIZE(msg->msg)) ++ return false; + /* copy chunk into bigger msg */ + memcpy(&msg->msg[msg->curlen], msg->chunk, msg->curchunk_len - 1); + msg->curlen += msg->curchunk_len - 1; diff --git a/queue-6.12/drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch b/queue-6.12/drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch new file mode 100644 index 0000000000..c28c0ed7de --- /dev/null +++ b/queue-6.12/drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch @@ -0,0 +1,61 @@ +From 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Sun, 10 May 2026 20:17:33 +0000 +Subject: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers + +From: Ashutosh Desai + +commit 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 upstream. + +drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw +message and then unconditionally does: + + memcpy(bytes, &raw->msg[idx], num_bytes); + +without checking that idx + num_bytes <= raw->curlen. raw->msg[] is +256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger +than the remaining payload, the memcpy reads past the received data +into whatever follows in raw->msg[]. + +drm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted +with a /* TODO check */ comment since the code was introduced). + +Fix both functions by using a single combined check +(idx + num_bytes > curlen) before each memcpy. Since num_bytes is u8, +it is always >= 0, so this strictly subsumes the simpler idx > curlen +form and no separate step is needed. + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: # v3.17+ +Signed-off-by: Ashutosh Desai +Reviewed-by: Lyude Paul +[added missing fixes tag] +Signed-off-by: Lyude Paul +Link: https://patch.msgid.link/20260510201733.2882224-1-ashutoshdesai993@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -862,7 +862,7 @@ static bool drm_dp_sideband_parse_remote + goto fail_len; + repmsg->u.remote_dpcd_read_ack.num_bytes = raw->msg[idx]; + idx++; +- if (idx > raw->curlen) ++ if (idx + repmsg->u.remote_dpcd_read_ack.num_bytes > raw->curlen) + goto fail_len; + + memcpy(repmsg->u.remote_dpcd_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_dpcd_read_ack.num_bytes); +@@ -898,7 +898,9 @@ static bool drm_dp_sideband_parse_remote + goto fail_len; + repmsg->u.remote_i2c_read_ack.num_bytes = raw->msg[idx]; + idx++; +- /* TODO check */ ++ if (idx + repmsg->u.remote_i2c_read_ack.num_bytes > raw->curlen) ++ goto fail_len; ++ + memcpy(repmsg->u.remote_i2c_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_i2c_read_ack.num_bytes); + return true; + fail_len: diff --git a/queue-6.12/drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch b/queue-6.12/drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch new file mode 100644 index 0000000000..b2fa3fe50e --- /dev/null +++ b/queue-6.12/drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch @@ -0,0 +1,90 @@ +From 6b89ba3dba2f583626fb693e47e951ffb8bf591f Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Sun, 10 May 2026 20:31:28 +0000 +Subject: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers + +From: Ashutosh Desai + +commit 6b89ba3dba2f583626fb693e47e951ffb8bf591f upstream. + +Three sideband reply parsers read 16-bit fields as: + + val = (raw->msg[idx] << 8) | (raw->msg[idx+1]); + +and check bounds only after the fact. When idx == raw->curlen, +raw->msg[idx+1] reads one byte past the received message data into +the following struct fields (curchunk_len, curchunk_idx, curlen). + +Affected functions: + - drm_dp_sideband_parse_enum_path_resources_ack() + full_payload_bw_number and avail_payload_bw_number fields + - drm_dp_sideband_parse_allocate_payload_ack() + allocated_pbn field + - drm_dp_sideband_parse_query_payload_ack() + allocated_pbn field + +Fix by using a single combined check (idx + 2 > curlen) before each +2-byte read. Since the check is strictly tighter than idx > curlen, +no separate step is needed. + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: # v3.17+ +Signed-off-by: Ashutosh Desai +Reviewed-by: Lyude Paul +[added fixes tag] +Signed-off-by: Lyude Paul +Link: https://patch.msgid.link/20260510203128.2884846-1-ashutoshdesai993@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 17 ++++------------- + 1 file changed, 4 insertions(+), 13 deletions(-) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -925,16 +925,13 @@ static bool drm_dp_sideband_parse_enum_p + repmsg->u.path_resources.port_number = (raw->msg[idx] >> 4) & 0xf; + repmsg->u.path_resources.fec_capable = raw->msg[idx] & 0x1; + idx++; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.path_resources.full_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]); + idx += 2; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.path_resources.avail_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]); +- idx += 2; +- if (idx > raw->curlen) +- goto fail_len; + return true; + fail_len: + DRM_DEBUG_KMS("enum resource parse length fail %d %d\n", idx, raw->curlen); +@@ -952,12 +949,9 @@ static bool drm_dp_sideband_parse_alloca + goto fail_len; + repmsg->u.allocate_payload.vcpi = raw->msg[idx]; + idx++; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.allocate_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx+1]); +- idx += 2; +- if (idx > raw->curlen) +- goto fail_len; + return true; + fail_len: + DRM_DEBUG_KMS("allocate payload parse length fail %d %d\n", idx, raw->curlen); +@@ -971,12 +965,9 @@ static bool drm_dp_sideband_parse_query_ + + repmsg->u.query_payload.port_number = (raw->msg[idx] >> 4) & 0xf; + idx++; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.query_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx + 1]); +- idx += 2; +- if (idx > raw->curlen) +- goto fail_len; + return true; + fail_len: + DRM_DEBUG_KMS("query payload parse length fail %d %d\n", idx, raw->curlen); diff --git a/queue-6.12/drm-imagination-count-paired-job-fence-as-dependency-in-prepare_job.patch b/queue-6.12/drm-imagination-count-paired-job-fence-as-dependency-in-prepare_job.patch new file mode 100644 index 0000000000..e42389df46 --- /dev/null +++ b/queue-6.12/drm-imagination-count-paired-job-fence-as-dependency-in-prepare_job.patch @@ -0,0 +1,134 @@ +From 9cd74f935306cd857f46686975c43383e1d95f94 Mon Sep 17 00:00:00 2001 +From: Alessio Belle +Date: Mon, 30 Mar 2026 08:56:36 +0100 +Subject: drm/imagination: Count paired job fence as dependency in prepare_job() + +From: Alessio Belle + +commit 9cd74f935306cd857f46686975c43383e1d95f94 upstream. + +The DRM scheduler's prepare_job() callback counts the remaining +non-signaled native dependencies for a job, preventing job submission +until those (plus job data and fence update) can fit in the job queue's +CCCB. + +This means checking which dependencies can be waited upon in the +firmware, i.e. whether they are backed by a UFO object, i.e. whether +their drm_sched_fence::parent has been assigned to a +pvr_queue_fence::base fence. That happens when the job owning the fence +is submitted to the firmware. + +Paired geometry and fragment jobs are submitted at the same time, which +means the dependency between them can't be checked this way before +submission. + +Update job_count_remaining_native_deps() to take into account the +dependency between paired jobs. + +This fixes cases where prepare_job() underestimated the space left in +an almost full fragment CCCB, wrongly unblocking run_job(), which then +returned early without writing the full sequence of commands to the +CCCB. + +The above lead to kernel warnings such as the following and potentially +job timeouts (depending on waiters on the missing commands): + + [ 375.702979] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#1: kworker/u16:3/47 + [ 375.703160] Modules linked in: + [ 375.703571] CPU: 1 UID: 0 PID: 47 Comm: kworker/u16:3 Tainted: G W 7.0.0-rc2-g817eb6b11ad5 #40 PREEMPT + [ 375.703613] Tainted: [W]=WARN + [ 375.703627] Hardware name: Texas Instruments AM625 SK (DT) + [ 375.703645] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched] + [ 375.703741] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + [ 375.703764] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] + [ 375.703847] lr : pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr] + [ 375.703921] sp : ffff800084a97650 + [ 375.703934] x29: ffff800084a97740 x28: 0000000000000958 x27: ffff80008565d000 + [ 375.703979] x26: 0000000000000030 x25: ffff800084a97680 x24: 0000000000001000 + [ 375.704017] x23: ffff800084a97820 x22: 1ffff00010952ecc x21: 0000000000000008 + [ 375.704056] x20: 00000000000006a8 x19: ffff00002ff7da88 x18: 0000000000000000 + [ 375.704093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000 + [ 375.704132] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 + [ 375.704168] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3 + [ 375.704206] x8 : 00000000f2f2f200 x7 : ffff700010952ecc x6 : 0000000000000008 + [ 375.704243] x5 : 0000000000000000 x4 : 1ffff00010acba00 x3 : 0000000000000000 + [ 375.704279] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f + [ 375.704317] Call trace: + [ 375.704331] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P) + [ 375.704411] pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr] + [ 375.704487] pvr_queue_run_job+0x3a4/0x990 [powervr] + [ 375.704562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched] + [ 375.704623] process_one_work+0x520/0x1288 + [ 375.704658] worker_thread+0x3f0/0xb3c + [ 375.704680] kthread+0x334/0x3d8 + [ 375.704706] ret_from_fork+0x10/0x20 + [ 375.704736] ---[ end trace 0000000000000000 ]--- + +Fixes: eaf01ee5ba28 ("drm/imagination: Implement job submission and scheduling") +Cc: stable@vger.kernel.org +Signed-off-by: Alessio Belle +Reviewed-by: Brajesh Gupta +Link: https://patch.msgid.link/20260330-job-submission-fixes-cleanup-v1-1-7de8c09cef8c@imgtec.com +Signed-off-by: Matt Coster +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/imagination/pvr_queue.c | 27 +++++++++++++++++++++++---- + 1 file changed, 23 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/imagination/pvr_queue.c ++++ b/drivers/gpu/drm/imagination/pvr_queue.c +@@ -179,7 +179,7 @@ static const struct dma_fence_ops pvr_qu + + /** + * to_pvr_queue_job_fence() - Return a pvr_queue_fence object if the fence is +- * backed by a UFO. ++ * already backed by a UFO. + * @f: The dma_fence to turn into a pvr_queue_fence. + * + * Return: +@@ -356,6 +356,15 @@ static u32 job_cmds_size(struct pvr_job + pvr_cccb_get_size_of_cmd_with_hdr(job->cmd_len); + } + ++static bool ++is_paired_job_fence(struct dma_fence *fence, struct pvr_job *job) ++{ ++ /* This assumes "fence" is one of "job"'s drm_sched_job::dependencies */ ++ return job->type == DRM_PVR_JOB_TYPE_FRAGMENT && ++ job->paired_job && ++ &job->paired_job->base.s_fence->scheduled == fence; ++} ++ + /** + * job_count_remaining_native_deps() - Count the number of non-signaled native dependencies. + * @job: Job to operate on. +@@ -371,6 +380,17 @@ static unsigned long job_count_remaining + xa_for_each(&job->base.dependencies, index, fence) { + struct pvr_queue_fence *jfence; + ++ if (is_paired_job_fence(fence, job)) { ++ /* ++ * A fence between paired jobs won't resolve to a pvr_queue_fence (i.e. ++ * be backed by a UFO) until the jobs have been submitted, together. ++ * The submitting code will insert a partial render fence command for this. ++ */ ++ WARN_ON(dma_fence_is_signaled(fence)); ++ remaining_count++; ++ continue; ++ } ++ + jfence = to_pvr_queue_job_fence(fence); + if (!jfence) + continue; +@@ -630,9 +650,8 @@ static void pvr_queue_submit_job_to_cccb + if (!jfence) + continue; + +- /* Skip the partial render fence, we will place it at the end. */ +- if (job->type == DRM_PVR_JOB_TYPE_FRAGMENT && job->paired_job && +- &job->paired_job->base.s_fence->scheduled == fence) ++ /* This fence will be placed last, as partial render fence. */ ++ if (is_paired_job_fence(fence, job)) + continue; + + if (dma_fence_is_signaled(&jfence->base)) diff --git a/queue-6.12/drm-imagination-fit-paired-fragment-job-in-the-correct-cccb.patch b/queue-6.12/drm-imagination-fit-paired-fragment-job-in-the-correct-cccb.patch new file mode 100644 index 0000000000..3cadfeafcd --- /dev/null +++ b/queue-6.12/drm-imagination-fit-paired-fragment-job-in-the-correct-cccb.patch @@ -0,0 +1,157 @@ +From 4baf9e70cb756d78dd56419f8baee2978a72d0c3 Mon Sep 17 00:00:00 2001 +From: Alessio Belle +Date: Mon, 30 Mar 2026 08:56:37 +0100 +Subject: drm/imagination: Fit paired fragment job in the correct CCCB + +From: Alessio Belle + +commit 4baf9e70cb756d78dd56419f8baee2978a72d0c3 upstream. + +For geometry jobs with a paired fragment job, at the moment, the +DRM scheduler's prepare_job() callback: + +- checks for internal (driver) dependencies for the geometry job; +- calls into pvr_queue_get_paired_frag_job_dep() to check for external + dependencies for the fragment job (the two jobs are submitted together + but the common scheduler code doesn't know about it, so this needs to + be done at this point in time); +- calls into the prepare_job() callback again, but for the fragment job, + to check its internal dependencies as well, passing the fragment job's + drm_sched_job and the geometry job's drm_sched_entity / pvr_queue. + +The problem with the last step is that pvr_queue_prepare_job() doesn't +always take the mismatched fragment job and geometry queue into account, +in particular when checking whether there is space for the fragment +command to be submitted, so the code ends up checking for space in the +geometry (i.e. wrong) CCCB. +The rest of the nested prepare_job() callback happens to work fine at +the moment as the other internal dependencies are not relevant for a +paired fragment job. + +Move the initialisation of a paired fragment job's done fence and CCCB +fence to pvr_queue_get_paired_frag_job_dep(), inferring the correct +queue from the fragment job itself. + +This fixes cases where prepare_job() wrongly assumed that there was +enough space for a paired fragment job in its own CCCB, unblocking +run_job(), which then returned early without writing the full sequence +of commands to the CCCB. + +The above lead to kernel warnings such as the following and potentially +job timeouts (depending on waiters on the missing commands): + + [ 552.421075] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#2: kworker/u16:5/63 + [ 552.421230] Modules linked in: + [ 552.421592] CPU: 2 UID: 0 PID: 63 Comm: kworker/u16:5 Tainted: G W 7.0.0-rc2-gc5d053e4dccb #39 PREEMPT + [ 552.421625] Tainted: [W]=WARN + [ 552.421637] Hardware name: Texas Instruments AM625 SK (DT) + [ 552.421655] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched] + [ 552.421744] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + [ 552.421766] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] + [ 552.421850] lr : pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr] + [ 552.421923] sp : ffff800084c47650 + [ 552.421936] x29: ffff800084c47740 x28: 0000000000000df8 x27: ffff800088a77000 + [ 552.421979] x26: 0000000000000030 x25: ffff800084c47680 x24: 0000000000001000 + [ 552.422017] x23: ffff800084c47820 x22: 1ffff00010988ecc x21: 0000000000000008 + [ 552.422055] x20: 0000000000000208 x19: ffff000006ad5a88 x18: 0000000000000000 + [ 552.422093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000 + [ 552.422130] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 + [ 552.422167] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3 + [ 552.422204] x8 : 00000000f2f2f200 x7 : ffff700010988ecc x6 : 0000000000000008 + [ 552.422241] x5 : 0000000000000000 x4 : 1ffff0001114ee00 x3 : 0000000000000000 + [ 552.422278] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f + [ 552.422316] Call trace: + [ 552.422330] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P) + [ 552.422411] pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr] + [ 552.422486] pvr_queue_run_job+0x3a4/0x990 [powervr] + [ 552.422562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched] + [ 552.422623] process_one_work+0x520/0x1288 + [ 552.422657] worker_thread+0x3f0/0xb3c + [ 552.422679] kthread+0x334/0x3d8 + [ 552.422706] ret_from_fork+0x10/0x20 + +Fixes: eaf01ee5ba28 ("drm/imagination: Implement job submission and scheduling") +Cc: stable@vger.kernel.org +Signed-off-by: Alessio Belle +Reviewed-by: Brajesh Gupta +Link: https://patch.msgid.link/20260330-job-submission-fixes-cleanup-v1-2-7de8c09cef8c@imgtec.com +Signed-off-by: Matt Coster +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/imagination/pvr_queue.c | 32 ++++++++++++++------------------ + 1 file changed, 14 insertions(+), 18 deletions(-) + +--- a/drivers/gpu/drm/imagination/pvr_queue.c ++++ b/drivers/gpu/drm/imagination/pvr_queue.c +@@ -488,10 +488,11 @@ pvr_queue_get_job_kccb_fence(struct pvr_ + } + + static struct dma_fence * +-pvr_queue_get_paired_frag_job_dep(struct pvr_queue *queue, struct pvr_job *job) ++pvr_queue_get_paired_frag_job_dep(struct pvr_job *job) + { + struct pvr_job *frag_job = job->type == DRM_PVR_JOB_TYPE_GEOMETRY ? + job->paired_job : NULL; ++ struct pvr_queue *frag_queue = frag_job ? frag_job->ctx->queues.fragment : NULL; + struct dma_fence *f; + unsigned long index; + +@@ -510,7 +511,10 @@ pvr_queue_get_paired_frag_job_dep(struct + return dma_fence_get(f); + } + +- return frag_job->base.sched->ops->prepare_job(&frag_job->base, &queue->entity); ++ /* Initialize the paired fragment job's done_fence, so we can signal it. */ ++ pvr_queue_job_fence_init(frag_job->done_fence, frag_queue); ++ ++ return pvr_queue_get_job_cccb_fence(frag_queue, frag_job); + } + + /** +@@ -529,11 +533,6 @@ pvr_queue_prepare_job(struct drm_sched_j + struct pvr_queue *queue = container_of(s_entity, struct pvr_queue, entity); + struct dma_fence *internal_dep = NULL; + +- /* +- * Initialize the done_fence, so we can signal it. This must be done +- * here because otherwise by the time of run_job() the job will end up +- * in the pending list without a valid fence. +- */ + if (job->type == DRM_PVR_JOB_TYPE_FRAGMENT && job->paired_job) { + /* + * This will be called on a paired fragment job after being +@@ -543,18 +542,15 @@ pvr_queue_prepare_job(struct drm_sched_j + */ + if (job->paired_job->has_pm_ref) + return NULL; +- +- /* +- * In this case we need to use the job's own ctx to initialise +- * the done_fence. The other steps are done in the ctx of the +- * paired geometry job. +- */ +- pvr_queue_job_fence_init(job->done_fence, +- job->ctx->queues.fragment); +- } else { +- pvr_queue_job_fence_init(job->done_fence, queue); + } + ++ /* ++ * Initialize the done_fence, so we can signal it. This must be done ++ * here because otherwise by the time of run_job() the job will end up ++ * in the pending list without a valid fence. ++ */ ++ pvr_queue_job_fence_init(job->done_fence, queue); ++ + /* CCCB fence is used to make sure we have enough space in the CCCB to + * submit our commands. + */ +@@ -575,7 +571,7 @@ pvr_queue_prepare_job(struct drm_sched_j + + /* The paired job fence should come last, when everything else is ready. */ + if (!internal_dep) +- internal_dep = pvr_queue_get_paired_frag_job_dep(queue, job); ++ internal_dep = pvr_queue_get_paired_frag_job_dep(job); + + return internal_dep; + } diff --git a/queue-6.12/drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch b/queue-6.12/drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch new file mode 100644 index 0000000000..bbf35f5af5 --- /dev/null +++ b/queue-6.12/drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch @@ -0,0 +1,36 @@ +From 7cbba8a8ba0219a267844d3116dbc77cecb4fcf8 Mon Sep 17 00:00:00 2001 +From: Biju Das +Date: Mon, 30 Mar 2026 11:44:45 +0100 +Subject: drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay + +From: Biju Das + +commit 7cbba8a8ba0219a267844d3116dbc77cecb4fcf8 upstream. + +The RZ/G2L hardware manual (Rev. 1.50, May 2025), Section 34.4.2.1, +requires waiting at least 1 msec after deasserting the CMN_RSTB signal +before the DSI-Tx module is ready. Increase the delay from 1 usec to +1 msec by replacing udelay(1) with fsleep(1000) for RZ/G2L SoCs. + +Fixes: 7a043f978ed1 ("drm: rcar-du: Add RZ/G2L DSI driver") +Cc: stable@vger.kernel.org +Reviewed-by: Tommaso Merciai +Tested-by: Tommaso Merciai +Link: https://patch.msgid.link/20260330104450.128512-3-biju.das.jz@bp.renesas.com +Signed-off-by: Biju Das +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c ++++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c +@@ -238,7 +238,7 @@ static int rzg2l_mipi_dsi_dphy_init(stru + if (ret < 0) + return ret; + +- udelay(1); ++ fsleep(1000); + + return 0; + } diff --git a/queue-6.12/drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch b/queue-6.12/drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch new file mode 100644 index 0000000000..09f6345311 --- /dev/null +++ b/queue-6.12/drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch @@ -0,0 +1,38 @@ +From 46c31e1604d121221167cb09380de8c7d53290b9 Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Fri, 30 Jan 2026 23:35:42 +0300 +Subject: drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() + +From: Sergey Shtylyov + +commit 46c31e1604d121221167cb09380de8c7d53290b9 upstream. + +The result of cdn_dp_reg_write() is checked everywhere (with the error +being logged by the callers) except one place in cdn_dp_config_video(). +Add the missing result check, bailing out early on error... + +Found by Linux Verification Center (linuxtesting.org) with the Svace static +analysis tool. + +Fixes: 1a0f7ed3abe2 ("drm/rockchip: cdn-dp: add cdn DP support for rk3399") +Signed-off-by: Sergey Shtylyov +Cc: stable@vger.kernel.org +Reviewed-by: Chaoyi Chen +Signed-off-by: Heiko Stuebner +Link: https://patch.msgid.link/adf6b313-f7db-4d8f-9000-8c65446ba041@auroraos.dev +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c ++++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c +@@ -683,6 +683,8 @@ int cdn_dp_config_video(struct cdn_dp_de + val = div_u64(8 * (symbol + 1), bit_per_pix) - val; + val += 2; + ret = cdn_dp_reg_write(dp, DP_VC_TABLE(15), val); ++ if (ret) ++ goto err_config_video; + + switch (video->color_depth) { + case 6: diff --git a/queue-6.12/series b/queue-6.12/series index 193c9516ab..410e2b6c1e 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -250,3 +250,13 @@ ice-fix-lag-recipe-to-profile-association.patch rds-tcp-unregister-sysctl-before-tearing-down-listen.patch net-airoha-fix-ets-channel-derivation-in-airoha_tc_s.patch bpf-sockmap-fix-cork-use-after-free-in-tcp_bpf_sendm.patch +drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch +drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch +drm-imagination-count-paired-job-fence-as-dependency-in-prepare_job.patch +drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch +drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch +drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch +drm-imagination-fit-paired-fragment-job-in-the-correct-cccb.patch +drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch +drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch +drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch