[git pull] drm fixes for 7.1-rc6
From: Dave Airlie
Date: Fri May 29 2026 - 19:12:54 EST
Hi Linus,
Regular pull, doesn't seem too insane or AI owned, couple of UAF fixes
and another repair for an earlier fix, mostly amdgpu and i915 display
with xe/i915 accel, and misc core/driver fixes.
It might be a bit bigger than usual at this stage, but I'm not seeing
anything too scary here.
Regards,
Dave.
drm-fixes-2026-05-30:
drm fixes for 7.1-rc6
dumb-buffer:
- prevent overflows in dumb-buffer creation
dma-buf:
- fix UAF in dma_buf_fd() tracepoint
gem:
- fix for the fix for the fix for the change handle ioctl
i915:
- Fix potential UAF in TTM object purge
- Use polling when irqs are unavailable
- Fix HDR pre-CSC LUT programming loop
- Block DC states on vblank enable when Panel Replay supported
- Use DC_OFF wake reference to block DC6 on vblank enable
xe:
- Restore IDLEDLY regiter on engine reset
amdgpu:
- GEM_OP warning fix
- GEM_OP locking fix
- Userq fixes
- DCN 2.1 refclk fix
- SI fix
- HMM fixes
amdkfd:
- svm_range_set_attr locking fix
- CRIU restore fix
- KFD debugger fix
amdxdna:
- require IOMMU on AIE2
hyperv:
- improve protocol validation
ivpu:
- test write offset in debugfs
rocket:
- fix UAF in bo creation
The following changes since commit e7ae89a0c97ce2b68b0983cd01eda67cf373517d:
Linux 7.1-rc5 (2026-05-24 13:48:06 -0700)
are available in the Git repository at:
https://gitlab.freedesktop.org/drm/kernel.git tags/drm-fixes-2026-05-30
for you to fetch changes up to 7164d78559b0ff29931a366a840a9e5dd53d4b7c:
drm/gem: fix race between change_handle and handle_delete
(2026-05-30 07:01:39 +1000)
----------------------------------------------------------------
drm fixes for 7.1-rc6
dumb-buffer:
- prevent overflows in dumb-buffer creation
dma-buf:
- fix UAF in dma_buf_fd() tracepoint
gem:
- fix for the fix for the fix for the change handle ioctl
i915:
- Fix potential UAF in TTM object purge
- Use polling when irqs are unavailable
- Fix HDR pre-CSC LUT programming loop
- Block DC states on vblank enable when Panel Replay supported
- Use DC_OFF wake reference to block DC6 on vblank enable
xe:
- Restore IDLEDLY regiter on engine reset
amdgpu:
- GEM_OP warning fix
- GEM_OP locking fix
- Userq fixes
- DCN 2.1 refclk fix
- SI fix
- HMM fixes
amdkfd:
- svm_range_set_attr locking fix
- CRIU restore fix
- KFD debugger fix
amdxdna:
- require IOMMU on AIE2
hyperv:
- improve protocol validation
ivpu:
- test write offset in debugfs
rocket:
- fix UAF in bo creation
----------------------------------------------------------------
Balasubramani Vivekanandan (1):
drm/xe: Restore IDLEDLY regiter on engine reset
Berkant Koc (2):
drm/hyperv: validate resolution_count and fix WIN8 fallback
drm/hyperv: validate VMBus packet size in receive callback
Christian König (2):
drm/amdgpu: fix amdgpu_hmm_range_get_pages
drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
Dan Carpenter (1):
accel/ivpu: prevent uninitialized data bug in debugfs
Dave Airlie (4):
Merge tag 'drm-intel-fixes-2026-05-27' of
https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes
Merge tag 'drm-xe-fixes-2026-05-28' of
https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes
Merge tag 'amd-drm-fixes-7.1-2026-05-28' of
https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
Merge tag 'drm-misc-fixes-2026-05-29' of
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes
David Carlier (1):
dma-buf: fix UAF in dma_buf_fd() tracepoint
David Francis (1):
drm/amdkfd: Check for pdd drm file first in CRIU restore path
Dhabaleshwar Das (1):
accel/rocket: fix UAF via dangling GEM handle in create_bo
Eric Huang (2):
drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
Ivan Lipski (1):
drm/amd/display: Write REFCLK to 48MHz on DCN21
Janusz Krzysztofik (1):
drm/i915: Fix potential UAF in TTM object purge
Jouni Högander (2):
drm/i915/psr: Block DC states on vblank enable when Panel Replay supported
drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable
Lizhi Hou (1):
accel/amdxdna: Block running when IOMMU is off
Michael Bommarito (1):
drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
Michał Grzelak (1):
drm/i915/aux: use polling when irqs are unavailable
Pranay Samala (1):
drm/i915/color: Fix HDR pre-CSC LUT programming loop
Rajat Gupta (1):
drm: prevent integer overflows in dumb buffer creation helpers
Stanley.Yang (1):
drm/amdgpu: fix potential overflow in fs_info.debugfs_name
Sunil Khatri (9):
drm/amdgpu/userq: Fix doorbell object cleanup of queue
drm/amdgpu/userq: Fix the mutex_init cleanup for fence_drv_lock
drm/amdgpu: simplify return value in amdgpu_userq_get_doorbell_index
drm/amdgpu/userq: add amdgpu_bo_unpin when amdgpu_ttm_alloc_gart fails
drm/amdgpu/userq: reserve root bo without interruption
drm/amdgpu/userq: make sure queue is valid in the hang_detect_work
drm/amdgpu/userq: remove amdgpu_userq_create/destroy_object wrapper
drm/amdgpu/userq: move mqd_destroy to later stage to keep core obj valid
drm/amdgpu/userq: use array instead of list for userq_vas
Timur Kristóf (1):
drm/amd/pm/si: Disregard vblank time when no displays are connected
Zhenghang Xiao (1):
drm/gem: fix race between change_handle and handle_delete
Ziyi Guo (1):
drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
drivers/accel/amdxdna/aie2_pci.c | 5 +
drivers/accel/ivpu/ivpu_debugfs.c | 2 +-
drivers/accel/rocket/rocket_gem.c | 17 +-
drivers/dma-buf/dma-buf.c | 6 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 11 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 17 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 207 +++++----------------
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 31 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +-
drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 47 +++--
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +-
.../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +-
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 +
.../gpu/drm/amd/display/dc/dccg/dcn21/dcn21_dccg.c | 15 +-
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 +
drivers/gpu/drm/drm_dumb_buffers.c | 14 +-
drivers/gpu/drm/drm_gem.c | 2 +
drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++++--
drivers/gpu/drm/i915/display/intel_color.c | 2 +-
drivers/gpu/drm/i915/display/intel_display_core.h | 1 +
drivers/gpu/drm/i915/display/intel_display_irq.c | 8 +-
drivers/gpu/drm/i915/display/intel_display_types.h | 2 +
drivers/gpu/drm/i915/display/intel_dp_aux.c | 20 +-
drivers/gpu/drm/i915/display/intel_psr.c | 25 +--
drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +--
drivers/gpu/drm/xe/xe_guc_ads.c | 5 +
27 files changed, 341 insertions(+), 272 deletions(-)