From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 12:45:14 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v6.1.179~43 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=eb7e4b9ba8e1f8762b9586051c431e59d87bce91;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: drm-amd-display-dce100-skip-non-dp-stream-encoders-for-dp-mst.patch drm-amd-display-set-new_stream-to-null-after-release.patch drm-amd-pm-ci-don-t-disable-mclk-dpm-on-bonaire-0x6658-r7-260x.patch drm-amdgpu-fix-vfct-bus-number-matching-with-soft-filter.patch drm-panthor-return-error-on-truncated-firmware.patch --- diff --git a/queue-6.12/drm-amd-display-dce100-skip-non-dp-stream-encoders-for-dp-mst.patch b/queue-6.12/drm-amd-display-dce100-skip-non-dp-stream-encoders-for-dp-mst.patch new file mode 100644 index 0000000000..f22ea9589f --- /dev/null +++ b/queue-6.12/drm-amd-display-dce100-skip-non-dp-stream-encoders-for-dp-mst.patch @@ -0,0 +1,62 @@ +From d340cba0df4cf327c7e89c7c1a4e79d4771d7dd5 Mon Sep 17 00:00:00 2001 +From: Andriy Korud +Date: Fri, 10 Jul 2026 12:52:26 +0200 +Subject: drm/amd/display: dce100: skip non-DP stream encoders for DP MST + +From: Andriy Korud + +commit d340cba0df4cf327c7e89c7c1a4e79d4771d7dd5 upstream. + +On DCE8-class ASICs (e.g. Bonaire), the resource pool contains digital +DIG stream encoders plus one analog DAC encoder. When assigning a stream +encoder for a second DisplayPort MST stream, if the preferred digital +encoder is already acquired, dce100_find_first_free_match_stream_enc_for_link() +falls back to the first free pool entry. That entry may be the analog +encoder, whose funcs table lacks DP hooks such as dp_set_stream_attribute. +The subsequent atomic commit then dereferences NULL function pointers in +link_set_dpms_on() and crashes. + +Skip encoders without dp_set_stream_attribute when the stream uses a DP +signal (including MST). Use dc_is_dp_signal(stream->signal) for the MST +fallback path instead of checking only the link connector signal. + +Tested on: +- GPU: AMD Radeon R7 260X (Bonaire / DCE8) +- Board: Supermicro C9X299-PG300 +- Setup: DP MST daisy chain, hotplug second monitor or have it connected on boot +- Kernel: 7.1.3 (issue observed since 6.19) +- Result: kernel oops without patch; dual monitors stable with patch + +Signed-off-by: Andriy Korud +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5162 +Signed-off-by: Alex Deucher +(cherry picked from commit 28ec64943e3ee4d9b8d30cea61e380f1429953a8) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/resource/dce100/dce100_resource.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/resource/dce100/dce100_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dce100/dce100_resource.c +@@ -939,6 +939,11 @@ struct stream_encoder *dce100_find_first + for (i = 0; i < pool->stream_enc_count; i++) { + if (!res_ctx->is_stream_enc_acquired[i] && + pool->stream_enc[i]) { ++ /* DP/MST needs a digital encoder; skip analog/no-DP encoders */ ++ if (dc_is_dp_signal(stream->signal) && ++ (!pool->stream_enc[i]->funcs || ++ !pool->stream_enc[i]->funcs->dp_set_stream_attribute)) ++ continue; + /* Store first available for MST second display + * in daisy chain use case + */ +@@ -962,7 +967,7 @@ struct stream_encoder *dce100_find_first + * required for non DP connectors. + */ + +- if (j >= 0 && link->connector_signal == SIGNAL_TYPE_DISPLAY_PORT) ++ if (j >= 0 && dc_is_dp_signal(stream->signal)) + return pool->stream_enc[j]; + + return NULL; diff --git a/queue-6.12/drm-amd-display-set-new_stream-to-null-after-release.patch b/queue-6.12/drm-amd-display-set-new_stream-to-null-after-release.patch new file mode 100644 index 0000000000..8dda3ccb44 --- /dev/null +++ b/queue-6.12/drm-amd-display-set-new_stream-to-null-after-release.patch @@ -0,0 +1,39 @@ +From 9fa26b9eed6195bf840f39ac183b9a6237548755 Mon Sep 17 00:00:00 2001 +From: WenTao Liang +Date: Sun, 28 Jun 2026 15:27:40 +0800 +Subject: drm/amd/display: set new_stream to NULL after release + +From: WenTao Liang + +commit 9fa26b9eed6195bf840f39ac183b9a6237548755 upstream. + +In dm_update_crtc_state(), the skip_modeset path releases new_stream +via dc_stream_release() but does not set the pointer to NULL. + +If a later error (e.g., color management failure) triggers the fail +label, the error path calls dc_stream_release() again on the same +dangling pointer, causing a double release and potential use-after-free. + +Fix this by setting new_stream to NULL after the initial release. + +Fixes: 9b690ef3c704 ("drm/amd/display: Avoid full modeset when not required") +Signed-off-by: WenTao Liang +Reviewed-by: George Zhang +Signed-off-by: Alex Deucher +(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10836,6 +10836,7 @@ skip_modeset: + /* Release extra reference */ + if (new_stream) + dc_stream_release(new_stream); ++ new_stream = NULL; + + /* + * We want to do dc stream updates that do not require a diff --git a/queue-6.12/drm-amd-pm-ci-don-t-disable-mclk-dpm-on-bonaire-0x6658-r7-260x.patch b/queue-6.12/drm-amd-pm-ci-don-t-disable-mclk-dpm-on-bonaire-0x6658-r7-260x.patch new file mode 100644 index 0000000000..667903af3d --- /dev/null +++ b/queue-6.12/drm-amd-pm-ci-don-t-disable-mclk-dpm-on-bonaire-0x6658-r7-260x.patch @@ -0,0 +1,63 @@ +From 85371c5ef502d10add72eab38711e191dccea981 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timur=20Krist=C3=B3f?= +Date: Mon, 13 Jul 2026 08:14:43 +0200 +Subject: drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +commit 85371c5ef502d10add72eab38711e191dccea981 upstream. + +The old radeon driver has a documented workaround in ci_dpm.c +which claims that Bonaire 0x6658 with old memory controller +firmware is unstable with MCLK DPM, so as a precaution I +disabled MCLK DPM on this ASIC in amdgpu. + +Note that the old MC firmware is not actually used with +amdgpu, but in theory it's possible that the VBIOS sets +up the ASIC with an old MC firmware that is already running +when amdgpu initializes (in which case amdgpu doesn't +load its own firmware). + +What I expected to happen is that the GPU would simply use +its maximum memory clock, and indeed this is what seemed +to happen according to amdgpu_pm_info which reads the +current MCLK value from the SMU. +However, some users reported a huge perf regression +and upon a closer look it seems that the GPU seems to +not actually use the highest MCLK value, despite the SMU +reporting that it does. + +Let's not disable MCLK DPM on Bonaire 0x6658 (R7 260X). + +Keep MCLK DPM disabled on R9 M380 in the 2015 iMac +because that still hangs if we enable it. + +Fixes: 9851f29cb06c ("drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs") +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +(cherry picked from commit d34acad064ee7d82bd18f5d87592c422d4d323ac) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c +@@ -106,11 +106,8 @@ int hwmgr_early_init(struct pp_hwmgr *hw + hwmgr->od_enabled = false; + switch (hwmgr->chip_id) { + case CHIP_BONAIRE: +- /* R9 M380 in iMac 2015: SMU hangs when enabling MCLK DPM +- * R7 260X cards with old MC ucode: MCLK DPM is unstable +- */ +- if (adev->pdev->subsystem_vendor == 0x106B || +- adev->pdev->device == 0x6658) { ++ /* R9 M380 in iMac 2015: SMU hangs when enabling MCLK DPM */ ++ if (adev->pdev->subsystem_vendor == 0x106B) { + dev_info(adev->dev, "disabling MCLK DPM on quirky ASIC"); + adev->pm.pp_feature &= ~PP_MCLK_DPM_MASK; + hwmgr->feature_mask &= ~PP_MCLK_DPM_MASK; diff --git a/queue-6.12/drm-amdgpu-fix-vfct-bus-number-matching-with-soft-filter.patch b/queue-6.12/drm-amdgpu-fix-vfct-bus-number-matching-with-soft-filter.patch new file mode 100644 index 0000000000..aca1cfec11 --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-vfct-bus-number-matching-with-soft-filter.patch @@ -0,0 +1,95 @@ +From db7e8108809a2245f0a17ba323f027cac0941ffb Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Wed, 8 Jul 2026 14:35:14 -0500 +Subject: drm/amdgpu: Fix VFCT bus number matching with soft filter + +From: Mario Limonciello + +commit db7e8108809a2245f0a17ba323f027cac0941ffb upstream. + +On systems where PCI bus renumbering occurs (e.g. pci=realloc, +resource conflicts), the runtime bus number may differ from the +BIOS POST bus number recorded in the VFCT table. This causes +amdgpu_acpi_vfct_bios() to fail finding the VBIOS even though +the correct device entry exists. + +Introduce amdgpu_acpi_vfct_match() which treats the bus number +as a soft filter: vendor/device/function identity is the hard +requirement, while exact bus match is the preferred path. When +bus numbers disagree but device identity matches, accept the +VFCT entry and log a dev_notice for diagnostics. + +Reported-by: Oz Tiram +Closes: https://lore.kernel.org/amd-gfx/20260621173211.28443-1-oz@shift-computing.de/ +Reviewed-by: Alex Deucher +Link: https://patch.msgid.link/20260708193518.702584-2-mario.limonciello@amd.com +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 11c141672045ffc0187aa604f2c0f597bc334fb2) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 45 +++++++++++++++++++++++++++---- + 1 file changed, 40 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c +@@ -345,6 +345,45 @@ static bool amdgpu_read_disabled_bios(st + } + + #ifdef CONFIG_ACPI ++/** ++ * amdgpu_acpi_vfct_match() - Check if a VFCT entry matches the device ++ * @adev: AMDGPU device ++ * @vhdr: VFCT image header to check ++ * ++ * VFCT entries contain the PCI bus number as recorded during BIOS POST. ++ * On systems where the kernel renumbers PCI buses (e.g. pci=realloc or ++ * resource conflicts), the runtime bus number may differ from the POST ++ * value. Match by device identity (vendor + device + function) and use ++ * the bus number as a preference: exact bus match is preferred, but when ++ * the bus numbers disagree we accept the entry if the device identity ++ * matches. ++ * ++ * Returns: 0 on match, -ENODEV on no match ++ */ ++static int amdgpu_acpi_vfct_match(struct amdgpu_device *adev, ++ VFCT_IMAGE_HEADER *vhdr) ++{ ++ /* Vendor and device IDs must always match */ ++ if (vhdr->VendorID != adev->pdev->vendor || ++ vhdr->DeviceID != adev->pdev->device) ++ return -ENODEV; ++ ++ if (vhdr->PCIDevice != PCI_SLOT(adev->pdev->devfn) || ++ vhdr->PCIFunction != PCI_FUNC(adev->pdev->devfn)) ++ return -ENODEV; ++ ++ /* Exact bus number match - preferred */ ++ if (vhdr->PCIBus == adev->pdev->bus->number) ++ return 0; ++ ++ /* Bus mismatch but device identity matches (PCI renumbering case) */ ++ dev_notice(adev->dev, ++ "VFCT bus number mismatch: table %u != runtime %u, matching by device identity (vendor 0x%04x device 0x%04x)\n", ++ vhdr->PCIBus, adev->pdev->bus->number, ++ adev->pdev->vendor, adev->pdev->device); ++ return 0; ++} ++ + static bool amdgpu_acpi_vfct_bios(struct amdgpu_device *adev) + { + struct acpi_table_header *hdr; +@@ -380,11 +419,7 @@ static bool amdgpu_acpi_vfct_bios(struct + } + + if (vhdr->ImageLength && +- vhdr->PCIBus == adev->pdev->bus->number && +- vhdr->PCIDevice == PCI_SLOT(adev->pdev->devfn) && +- vhdr->PCIFunction == PCI_FUNC(adev->pdev->devfn) && +- vhdr->VendorID == adev->pdev->vendor && +- vhdr->DeviceID == adev->pdev->device) { ++ !amdgpu_acpi_vfct_match(adev, vhdr)) { + adev->bios = kmemdup(&vbios->VbiosContent, + vhdr->ImageLength, + GFP_KERNEL); diff --git a/queue-6.12/drm-panthor-return-error-on-truncated-firmware.patch b/queue-6.12/drm-panthor-return-error-on-truncated-firmware.patch new file mode 100644 index 0000000000..a6f4d6cefb --- /dev/null +++ b/queue-6.12/drm-panthor-return-error-on-truncated-firmware.patch @@ -0,0 +1,38 @@ +From 4a2c8cbe9bcba170706fdf08b1c84b6cbcf5b044 Mon Sep 17 00:00:00 2001 +From: Osama Abdelkader +Date: Tue, 14 Jul 2026 18:30:55 +0200 +Subject: drm/panthor: return error on truncated firmware + +From: Osama Abdelkader + +commit 4a2c8cbe9bcba170706fdf08b1c84b6cbcf5b044 upstream. + +panthor_fw_load() detects truncated firmware images, but jumps to the +common cleanup path without setting ret. If no previous error was recorded, +the function can return 0 and treat the invalid firmware as successfully +loaded. + +Set ret to -EINVAL before leaving the truncated-image path. + +Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") +Cc: stable@vger.kernel.org +Signed-off-by: Osama Abdelkader +Reviewed-by: Liviu Dudau +Reviewed-by: Boris Brezillon +Link: https://patch.msgid.link/20260714163056.22329-1-osama.abdelkader@gmail.com +Signed-off-by: Liviu Dudau +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panthor/panthor_fw.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/panthor/panthor_fw.c ++++ b/drivers/gpu/drm/panthor/panthor_fw.c +@@ -732,6 +732,7 @@ static int panthor_fw_load(struct pantho + } + + if (hdr.size > iter.size) { ++ ret = -EINVAL; + drm_err(&ptdev->base, "Firmware image is truncated\n"); + goto out; + } diff --git a/queue-6.12/series b/queue-6.12/series index e9aa5c7c32..83617ac271 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -289,3 +289,8 @@ drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch drm-amd-pm-fix-smu14-power-limit-range-calculation.patch drm-gfx10-program-db_ring_control.patch +drm-panthor-return-error-on-truncated-firmware.patch +drm-amdgpu-fix-vfct-bus-number-matching-with-soft-filter.patch +drm-amd-pm-ci-don-t-disable-mclk-dpm-on-bonaire-0x6658-r7-260x.patch +drm-amd-display-set-new_stream-to-null-after-release.patch +drm-amd-display-dce100-skip-non-dp-stream-encoders-for-dp-mst.patch