From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 12:40:31 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v6.1.179~49 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=f329bce7114ae4a68c3781675c5dc5f7b197384a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: drm-amd-amdgpu-disable-aspm-on-vi-if-pcie-dpm-is-disabled.patch drm-amd-pm-fix-smu14-power-limit-range-calculation.patch drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch drm-gfx10-program-db_ring_control.patch drm-i915-bios-range-check-lfp-data-block-panel_type2.patch drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch drm-i915-mst-limit-dp-mst-esi-service-loop.patch drm-i915-return-null-on-error-in-active_instance.patch drm-virtio-don-t-detach-gem-from-a-non-created-context.patch --- diff --git a/queue-6.18/drm-amd-amdgpu-disable-aspm-on-vi-if-pcie-dpm-is-disabled.patch b/queue-6.18/drm-amd-amdgpu-disable-aspm-on-vi-if-pcie-dpm-is-disabled.patch new file mode 100644 index 0000000000..bea6f269a0 --- /dev/null +++ b/queue-6.18/drm-amd-amdgpu-disable-aspm-on-vi-if-pcie-dpm-is-disabled.patch @@ -0,0 +1,35 @@ +From 18a7826aea6fd09f2d371c02cec70c7234fc4879 Mon Sep 17 00:00:00 2001 +From: Kenneth Feng +Date: Thu, 25 Jun 2026 17:48:22 +0800 +Subject: drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled + +From: Kenneth Feng + +commit 18a7826aea6fd09f2d371c02cec70c7234fc4879 upstream. + +Disable ASPM on VI if PCIE dpm is disabled. + +Fixes: bb00bf17328d ("drm/amd/amdgpu: decouple ASPM with pcie dpm") +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5370 +Signed-off-by: Kenneth Feng +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +(cherry picked from commit 873a8d6b3c0a386408c891e4ff1c684fa11783e1) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -1888,7 +1888,8 @@ static bool amdgpu_device_aspm_support_q + * It's unclear if this is a platform-specific or GPU-specific issue. + * Disable ASPM on SI for the time being. + */ +- if (adev->family == AMDGPU_FAMILY_SI) ++ if (adev->family == AMDGPU_FAMILY_SI || ++ (!(adev->pm.pp_feature & PP_PCIE_DPM_MASK) && adev->family == AMDGPU_FAMILY_VI)) + return true; + + #if IS_ENABLED(CONFIG_X86) diff --git a/queue-6.18/drm-amd-pm-fix-smu14-power-limit-range-calculation.patch b/queue-6.18/drm-amd-pm-fix-smu14-power-limit-range-calculation.patch new file mode 100644 index 0000000000..b3cee88f01 --- /dev/null +++ b/queue-6.18/drm-amd-pm-fix-smu14-power-limit-range-calculation.patch @@ -0,0 +1,83 @@ +From e987eabc02646920cd13ab75902693e99735eca0 Mon Sep 17 00:00:00 2001 +From: Yang Wang +Date: Mon, 6 Jul 2026 09:29:24 +0800 +Subject: drm/amd/pm: fix smu14 power limit range calculation + +From: Yang Wang + +commit e987eabc02646920cd13ab75902693e99735eca0 upstream. + +SMU14 derives the default PPT limit from SocketPowerLimitAc/Dc, but +MsgLimits.Power may expose a different firmware limit for the same PPT0 +throttler. Using those values independently as fixed min/max bases can +report an incorrect configurable power range. + +Keep the socket power limit as the default value and as the fallback for +current-limit queries. Calculate the reported range from both firmware +values instead, using the lower value as the minimum base and the higher +value as the maximum base before applying OD percentages. + +Signed-off-by: Yang Wang +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +(cherry picked from commit c936b8126b444401318fcbeb1828488cc5312dee) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 28 ++++++++++--------- + 1 file changed, 16 insertions(+), 12 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +@@ -1701,19 +1701,23 @@ static int smu_v14_0_2_get_power_limit(s + table_context->power_play_table; + PPTable_t *pptable = table_context->driver_pptable; + CustomSkuTable_t *skutable = &pptable->CustomSkuTable; +- int16_t od_percent_upper = 0, od_percent_lower = 0; ++ uint32_t pp_limit = smu->adev->pm.ac_power ? ++ skutable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] : ++ skutable->SocketPowerLimitDc[PPT_THROTTLER_PPT0]; + uint32_t msg_limit = pptable->SkuTable.MsgLimits.Power[PPT_THROTTLER_PPT0][POWER_SOURCE_AC]; +- uint32_t power_limit; ++ uint32_t min_limit = min_t(uint32_t, pp_limit, msg_limit); ++ uint32_t max_limit = max_t(uint32_t, pp_limit, msg_limit); ++ int16_t od_percent_upper = 0, od_percent_lower = 0; ++ int ret; + +- if (smu_v14_0_get_current_power_limit(smu, &power_limit)) +- power_limit = smu->adev->pm.ac_power ? +- skutable->SocketPowerLimitAc[PPT_THROTTLER_PPT0] : +- skutable->SocketPowerLimitDc[PPT_THROTTLER_PPT0]; ++ if (current_power_limit) { ++ ret = smu_v14_0_get_current_power_limit(smu, current_power_limit); ++ if (ret) ++ *current_power_limit = pp_limit; ++ } + +- if (current_power_limit) +- *current_power_limit = power_limit; + if (default_power_limit) +- *default_power_limit = power_limit; ++ *default_power_limit = pp_limit; + + if (powerplay_table) { + if (smu->od_enabled && +@@ -1727,15 +1731,15 @@ static int smu_v14_0_2_get_power_limit(s + } + + dev_dbg(smu->adev->dev, "od percent upper:%d, od percent lower:%d (default power: %d)\n", +- od_percent_upper, od_percent_lower, power_limit); ++ od_percent_upper, od_percent_lower, pp_limit); + + if (max_power_limit) { +- *max_power_limit = msg_limit * (100 + od_percent_upper); ++ *max_power_limit = max_limit * (100 + od_percent_upper); + *max_power_limit /= 100; + } + + if (min_power_limit) { +- *min_power_limit = power_limit * (100 + od_percent_lower); ++ *min_power_limit = min_limit * (100 + od_percent_lower); + *min_power_limit /= 100; + } + diff --git a/queue-6.18/drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch b/queue-6.18/drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch new file mode 100644 index 0000000000..5dd20ca15f --- /dev/null +++ b/queue-6.18/drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch @@ -0,0 +1,75 @@ +From 04cc4aa3617b0ed67e859f91f09de5d896a46f3a Mon Sep 17 00:00:00 2001 +From: Shahyan Soltani +Date: Mon, 6 Jul 2026 08:15:21 -0400 +Subject: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shahyan Soltani + +commit 04cc4aa3617b0ed67e859f91f09de5d896a46f3a upstream. + +The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only +valid while the lock is still being held. Once xa_unlock_irqrestore is +called and returned, the pointer is no longer under lock and is subject +to modification. Since, the caller still dereferences vm->task_info in +amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a +use after unlock problem. + +Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid() +through removing the amdgpu_vm_get_vm_from_pasid() function from +amdgpu_vm.c and making the relevant code inline to hold the lock while +it is still in use. + +Signed-off-by: Shahyan Soltani +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 25 ++++++++++--------------- + 1 file changed, 10 insertions(+), 15 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -2453,19 +2453,6 @@ static void amdgpu_vm_destroy_task_info( + kfree(ti); + } + +-static inline struct amdgpu_vm * +-amdgpu_vm_get_vm_from_pasid(struct amdgpu_device *adev, u32 pasid) +-{ +- struct amdgpu_vm *vm; +- unsigned long flags; +- +- xa_lock_irqsave(&adev->vm_manager.pasids, flags); +- vm = xa_load(&adev->vm_manager.pasids, pasid); +- xa_unlock_irqrestore(&adev->vm_manager.pasids, flags); +- +- return vm; +-} +- + /** + * amdgpu_vm_put_task_info - reference down the vm task_info ptr + * +@@ -2512,8 +2499,16 @@ amdgpu_vm_get_task_info_vm(struct amdgpu + struct amdgpu_task_info * + amdgpu_vm_get_task_info_pasid(struct amdgpu_device *adev, u32 pasid) + { +- return amdgpu_vm_get_task_info_vm( +- amdgpu_vm_get_vm_from_pasid(adev, pasid)); ++ struct amdgpu_task_info *ti; ++ struct amdgpu_vm *vm; ++ unsigned long flags; ++ ++ xa_lock_irqsave(&adev->vm_manager.pasids, flags); ++ vm = xa_load(&adev->vm_manager.pasids, pasid); ++ ti = amdgpu_vm_get_task_info_vm(vm); ++ xa_unlock_irqrestore(&adev->vm_manager.pasids, flags); ++ ++ return ti; + } + + static int amdgpu_vm_create_task_info(struct amdgpu_vm *vm) diff --git a/queue-6.18/drm-gfx10-program-db_ring_control.patch b/queue-6.18/drm-gfx10-program-db_ring_control.patch new file mode 100644 index 0000000000..82cc8b3f7d --- /dev/null +++ b/queue-6.18/drm-gfx10-program-db_ring_control.patch @@ -0,0 +1,43 @@ +From f0262c3a3f14d60140f6b826d40d44edf62c36d6 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 26 Jun 2026 16:29:13 -0400 +Subject: drm/gfx10: Program DB_RING_CONTROL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit f0262c3a3f14d60140f6b826d40d44edf62c36d6 upstream. + +This is needed to allocate occlusion counters across +both gfx pipes. + +Fixes: b7a1a0ef12b8 ("drm/amd/amdgpu: add pipe1 hardware support") +Reviewed-by: Timur Kristóf +Signed-off-by: Alex Deucher +(cherry picked from commit 6807352cbabb74b61ba42888769283af72191f66) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -5349,6 +5349,15 @@ static void gfx_v10_0_constants_init(str + gfx_v10_0_get_tcc_info(adev); + adev->gfx.config.pa_sc_tile_steering_override = + gfx_v10_0_init_pa_sc_tile_steering_override(adev); ++ /* Program DB_RING_CONTROL for multiple GFX pipes ++ * Default power up value is 1. ++ * Possible values: ++ * 0 - split occlusion counters between gfx pipes ++ * 1 - all occlusion counters to pipe 0 ++ * 2 - all occlusion counters to pipe 1 ++ */ ++ WREG32_FIELD15(GC, 0, DB_RING_CONTROL, COUNTER_CONTROL, ++ (adev->gfx.me.num_pipe_per_me > 1) ? 0 : 1); + + /* XXX SH_MEM regs */ + /* where to put LDS, scratch, GPUVM in FSA64 space */ diff --git a/queue-6.18/drm-i915-bios-range-check-lfp-data-block-panel_type2.patch b/queue-6.18/drm-i915-bios-range-check-lfp-data-block-panel_type2.patch new file mode 100644 index 0000000000..380e518ae3 --- /dev/null +++ b/queue-6.18/drm-i915-bios-range-check-lfp-data-block-panel_type2.patch @@ -0,0 +1,107 @@ +From 2084503f2d087bf956198e7f6eb25b03a7049cb2 Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Fri, 26 Jun 2026 17:01:55 +0300 +Subject: drm/i915/bios: range check LFP Data Block panel_type2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +commit 2084503f2d087bf956198e7f6eb25b03a7049cb2 upstream. + +While the panel_type from LFP Data Block is range checked, panel_type2 +is not. Add a few helpers for range checking, and use them to not only +check panel_type2, but also improve clarity and correctness in the panel +type selection. + +Discovered using AI-assisted static analysis confirmed by Intel Product +Security. + +v2: +- Fix commit message typo (Michał) +- Add is_panel_type_pnp() (Ville) + +Reported-by: Martin Hodo +Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT") +Cc: stable@vger.kernel.org # v6.0+ +Cc: Animesh Manna +Cc: Ville Syrjälä +Reviewed-by: Michał Grzelak # v1 +Reviewed-by: Ville Syrjälä +Link: https://patch.msgid.link/20260626140155.1389655-1-jani.nikula@intel.com +Signed-off-by: Jani Nikula +(cherry picked from commit c9ebe5d2f25729d6cfbbb1235d640bf67f9275df) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_bios.c | 36 +++++++++++++++++++++++------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_bios.c ++++ b/drivers/gpu/drm/i915/display/intel_bios.c +@@ -624,6 +624,21 @@ get_lfp_data_tail(const struct bdb_lfp_d + return NULL; + } + ++static bool is_panel_type_valid(int panel_type) ++{ ++ return panel_type >= 0 && panel_type < 16; ++} ++ ++static bool is_panel_type_pnp(int panel_type) ++{ ++ return panel_type == 0xff; ++} ++ ++static bool is_panel_type_valid_or_pnp(int panel_type) ++{ ++ return is_panel_type_valid(panel_type) || is_panel_type_pnp(panel_type); ++} ++ + static int opregion_get_panel_type(struct intel_display *display, + const struct intel_bios_encoder_data *devdata, + const struct drm_edid *drm_edid, bool use_fallback) +@@ -641,15 +656,21 @@ static int vbt_get_panel_type(struct int + if (!lfp_options) + return -1; + +- if (lfp_options->panel_type > 0xf && +- lfp_options->panel_type != 0xff) { ++ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type)) { + drm_dbg_kms(display->drm, "Invalid VBT panel type 0x%x\n", + lfp_options->panel_type); + return -1; + } + +- if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2) ++ if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2) { ++ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type2)) { ++ drm_dbg_kms(display->drm, "Invalid VBT panel type 2 0x%x\n", ++ lfp_options->panel_type2); ++ return -1; ++ } ++ + return lfp_options->panel_type2; ++ } + + drm_WARN_ON(display->drm, + devdata && devdata->child.handle != DEVICE_HANDLE_LFP1); +@@ -763,13 +784,12 @@ static int get_panel_type(struct intel_d + panel_types[i].name, panel_types[i].panel_type); + } + +- if (panel_types[PANEL_TYPE_OPREGION].panel_type >= 0) ++ if (is_panel_type_valid(panel_types[PANEL_TYPE_OPREGION].panel_type)) + i = PANEL_TYPE_OPREGION; +- else if (panel_types[PANEL_TYPE_VBT].panel_type == 0xff && +- panel_types[PANEL_TYPE_PNPID].panel_type >= 0) ++ else if (is_panel_type_pnp(panel_types[PANEL_TYPE_VBT].panel_type) && ++ is_panel_type_valid(panel_types[PANEL_TYPE_PNPID].panel_type)) + i = PANEL_TYPE_PNPID; +- else if (panel_types[PANEL_TYPE_VBT].panel_type != 0xff && +- panel_types[PANEL_TYPE_VBT].panel_type >= 0) ++ else if (is_panel_type_valid(panel_types[PANEL_TYPE_VBT].panel_type)) + i = PANEL_TYPE_VBT; + else + i = PANEL_TYPE_FALLBACK; diff --git a/queue-6.18/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch b/queue-6.18/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch new file mode 100644 index 0000000000..72bfc714a0 --- /dev/null +++ b/queue-6.18/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch @@ -0,0 +1,84 @@ +From eed3de2acf6aa5154d49098b026710b646db67ee Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 1 Jul 2026 10:30:30 +0300 +Subject: drm/i915/gem: Do not leak siblings[] on proto context error + +From: Joonas Lahtinen + +commit eed3de2acf6aa5154d49098b026710b646db67ee upstream. + +After a successful BALANCE/PARALLEL_SUBMIT extension on context +creation, error during processing of next user extension leaks +the siblings[] array. Fix that. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") +Cc: Faith Ekstrand +Cc: Simona Vetter +Cc: Tvrtko Ursulin +Cc: Maarten Lankhorst +Cc: # v5.15+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Maarten Lankhorst +Signed-off-by: Tvrtko Ursulin +Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gem/i915_gem_context.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c +@@ -770,8 +770,8 @@ static int set_proto_ctx_engines(struct + struct intel_engine_cs *engine; + + if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) { +- kfree(set.engines); +- return -EFAULT; ++ err = -EFAULT; ++ goto err; + } + + memset(&set.engines[n], 0, sizeof(set.engines[n])); +@@ -787,8 +787,8 @@ static int set_proto_ctx_engines(struct + drm_dbg(&i915->drm, + "Invalid engine[%d]: { class:%d, instance:%d }\n", + n, ci.engine_class, ci.engine_instance); +- kfree(set.engines); +- return -ENOENT; ++ err = -ENOENT; ++ goto err; + } + + set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL; +@@ -801,15 +801,21 @@ static int set_proto_ctx_engines(struct + set_proto_ctx_engines_extensions, + ARRAY_SIZE(set_proto_ctx_engines_extensions), + &set); +- if (err) { +- kfree(set.engines); +- return err; +- } ++ if (err) ++ goto err_extensions; + + pc->num_user_engines = set.num_engines; + pc->user_engines = set.engines; + + return 0; ++ ++err_extensions: ++ for (n = 0; n < set.num_engines; n++) ++ kfree(set.engines[n].siblings); ++err: ++ kfree(set.engines); ++ ++ return err; + } + + static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv, diff --git a/queue-6.18/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch b/queue-6.18/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch new file mode 100644 index 0000000000..a0f59deb9d --- /dev/null +++ b/queue-6.18/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch @@ -0,0 +1,46 @@ +From 2b56757a9a7456825eb668fde92299e01c5e2721 Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 1 Jul 2026 10:55:55 +0300 +Subject: drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU + +From: Joonas Lahtinen + +commit 2b56757a9a7456825eb668fde92299e01c5e2721 upstream. + +Setting context engine slot N into I915_ENGINE_CLASS_INVALID / +I915_ENGINE_CLASS_INVALID_NONE and attempting to apply +I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL. +Fix that. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") +Cc: Faith Ekstrand +Cc: Simona Vetter +Cc: Tvrtko Ursulin +Cc: Maarten Lankhorst +Cc: # v5.15+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Maarten Lankhorst +Reviewed-by: Andi Shyti +Link: https://patch.msgid.link/20260701075555.52142-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gem/i915_gem_context.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c +@@ -857,7 +857,7 @@ static int set_proto_ctx_sseu(struct drm + pe = &pc->user_engines[idx]; + + /* Only render engine supports RPCS configuration. */ +- if (pe->engine->class != RENDER_CLASS) ++ if (!pe->engine || pe->engine->class != RENDER_CLASS) + return -EINVAL; + + sseu = &pe->sseu; diff --git a/queue-6.18/drm-i915-mst-limit-dp-mst-esi-service-loop.patch b/queue-6.18/drm-i915-mst-limit-dp-mst-esi-service-loop.patch new file mode 100644 index 0000000000..6d8ebb6fea --- /dev/null +++ b/queue-6.18/drm-i915-mst-limit-dp-mst-esi-service-loop.patch @@ -0,0 +1,65 @@ +From 005771c18c5b2c98cb4e7517661aea460990fd3f Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Thu, 25 Jun 2026 17:22:04 +0300 +Subject: drm/i915/mst: limit DP MST ESI service loop +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +commit 005771c18c5b2c98cb4e7517661aea460990fd3f upstream. + +The loop in intel_dp_check_mst_status() keeps servicing interrupts +originating from the sink without bound. Add an upper bound to the new +interrupts occurring during interrupt processing to not get stuck on +potentially stuck sink devices. Use arbitrary 32 tries to clear incoming +interrupts in one go. + +Discovered using AI-assisted static analysis confirmed by Intel Product +Security. + +Note: The condition likely pre-dates the commit in the Fixes: tag, but +this is about as far back as a backport has any chance of +succeeding. Before that, the retry had a goto. + +Reported-by: Martin Hodo +Fixes: 3c0ec2c2d594 ("drm/i915: Flatten intel_dp_check_mst_status() a bit") +Cc: stable@vger.kernel.org # v5.8+ +Cc: Ville Syrjälä +Cc: Imre Deak +Reviewed-by: Imre Deak +Link: https://patch.msgid.link/20260625142204.1078287-1-jani.nikula@intel.com +Signed-off-by: Jani Nikula +(cherry picked from commit b4ea5272133059acb493cc36599071a9e852ec2e) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_dp.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -5203,8 +5203,9 @@ intel_dp_check_mst_status(struct intel_d + struct intel_encoder *encoder = &dig_port->base; + bool link_ok = true; + bool reprobe_needed = false; ++ int tries = 33; + +- for (;;) { ++ while (--tries) { + u8 esi[4] = {}; + u8 ack[4] = {}; + +@@ -5247,6 +5248,11 @@ intel_dp_check_mst_status(struct intel_d + if (!link_ok || intel_dp->link.force_retrain) + intel_encoder_link_check_queue_work(encoder, 0); + ++ if (!tries) { ++ drm_dbg_kms(display->drm, "DPRX ESI not clearing, device may be stuck\n"); ++ reprobe_needed = true; ++ } ++ + return !reprobe_needed; + } + diff --git a/queue-6.18/drm-i915-return-null-on-error-in-active_instance.patch b/queue-6.18/drm-i915-return-null-on-error-in-active_instance.patch new file mode 100644 index 0000000000..12a6d07aa8 --- /dev/null +++ b/queue-6.18/drm-i915-return-null-on-error-in-active_instance.patch @@ -0,0 +1,58 @@ +From 1e33f0de5fdcd09e51fdec1e5822448970b6420f Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 24 Jun 2026 12:09:40 +0300 +Subject: drm/i915: Return NULL on error in active_instance +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Joonas Lahtinen + +commit 1e33f0de5fdcd09e51fdec1e5822448970b6420f upstream. + +Avoid returning &node->base when node is NULL due to OOM +during GFP_ATOMIC allocation. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: bfaae47db3c0 ("drm/i915: make lockdep slightly happier about execbuf.") +Cc: Maarten Lankhorst +Cc: Thomas Hellström +Cc: Simona Vetter +Cc: # v5.13+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Sebastian Brzezinka +Reviewed-by: Maarten Lankhorst +Link: https://patch.msgid.link/20260624090940.74840-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit 6029bc064f0b1bac184203a50fbaaf070fa18832) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/i915_active.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_active.c ++++ b/drivers/gpu/drm/i915/i915_active.c +@@ -318,7 +318,7 @@ active_instance(struct i915_active *ref, + */ + node = kmem_cache_alloc(slab_cache, GFP_ATOMIC); + if (!node) +- goto out; ++ goto err; + + __i915_active_fence_init(&node->base, NULL, node_retire); + node->ref = ref; +@@ -332,6 +332,11 @@ out: + spin_unlock_irq(&ref->tree_lock); + + return &node->base; ++ ++err: ++ spin_unlock_irq(&ref->tree_lock); ++ ++ return NULL; + } + + void __i915_active_init(struct i915_active *ref, diff --git a/queue-6.18/drm-virtio-don-t-detach-gem-from-a-non-created-context.patch b/queue-6.18/drm-virtio-don-t-detach-gem-from-a-non-created-context.patch new file mode 100644 index 0000000000..a7f2a969a2 --- /dev/null +++ b/queue-6.18/drm-virtio-don-t-detach-gem-from-a-non-created-context.patch @@ -0,0 +1,49 @@ +From d489a5305b9d5480d6fb97d5636f5f4b1e0b3827 Mon Sep 17 00:00:00 2001 +From: Jason Macnak +Date: Thu, 25 Jun 2026 10:08:28 -0700 +Subject: drm/virtio: Don't detach GEM from a non-created context + +From: Jason Macnak + +commit d489a5305b9d5480d6fb97d5636f5f4b1e0b3827 upstream. + +Applies the same treatment as commit 7cf6dd467e87 ("drm/virtio: +Don't attach GEM to a non-created context in gem_object_open()") +to virtio_gpu_gem_object_close() to avoid trying to detach +a resource that was never attached due to a context +never being created when context_init is supported. + +Fixes: 086b9f27f0ab ("drm/virtio: Don't create a context with default param if context_init is supported") +Cc: # v6.14+ +Signed-off-by: Jason Macnak +Signed-off-by: Dmitry Osipenko +Link: https://patch.msgid.link/20260625170828.3335431-1-natsu@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/virtio/virtgpu_gem.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/virtio/virtgpu_gem.c ++++ b/drivers/gpu/drm/virtio/virtgpu_gem.c +@@ -139,13 +139,15 @@ void virtio_gpu_gem_object_close(struct + if (!vgdev->has_virgl_3d) + return; + +- objs = virtio_gpu_array_alloc(1); +- if (!objs) +- return; +- virtio_gpu_array_add_obj(objs, obj); ++ if (vfpriv->context_created) { ++ objs = virtio_gpu_array_alloc(1); ++ if (!objs) ++ return; ++ virtio_gpu_array_add_obj(objs, obj); + +- virtio_gpu_cmd_context_detach_resource(vgdev, vfpriv->ctx_id, +- objs); ++ virtio_gpu_cmd_context_detach_resource(vgdev, vfpriv->ctx_id, ++ objs); ++ } + virtio_gpu_notify(vgdev); + } + diff --git a/queue-6.18/series b/queue-6.18/series index 433e049aa1..101a64ae40 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -371,3 +371,13 @@ drm-amdgpu-sdma7.0-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch +drm-i915-return-null-on-error-in-active_instance.patch +drm-i915-bios-range-check-lfp-data-block-panel_type2.patch +drm-amd-amdgpu-disable-aspm-on-vi-if-pcie-dpm-is-disabled.patch +drm-amdgpu-fix-lifetime-issue-of-amdgpu_vm_get_task_info_pasid.patch +drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch +drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch +drm-i915-mst-limit-dp-mst-esi-service-loop.patch +drm-amd-pm-fix-smu14-power-limit-range-calculation.patch +drm-gfx10-program-db_ring_control.patch +drm-virtio-don-t-detach-gem-from-a-non-created-context.patch