Skip to content

Commit a0c8317

Browse files
torvaldstorvalds
committed
Merge tag 'drm-fixes-2026-03-21' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie: "Regular weekly pull request, from sunny San Diego. Usual suspects in xe/i915/amdgpu with small fixes all over, then some minor fixes across a few other drivers. It's probably a bit on the heavy side, but most of the fix seem well contained, core: - drm_dev_unplug UAF fix pagemap: - lock handling fix xe: - A number of teardown fixes - Skip over non-leaf PTE for PRL generation - Fix an uninitialized variable - Fix a missing runtime PM reference i915/display: - Fix #15771: Screen corruption and stuttering on P14s w/ 3K display - Fix for PSR entry setup frames count on rejected commit - Fix OOPS if firmware is not loaded and suspend is attempted - Fix unlikely NULL deref due to DC6 on probe amdgpu: - Fix gamma 2.2 colorop TFs - BO list fix - LTO fix - DC FP fix - DisplayID handling fix - DCN 2.01 fix - MMHUB boundary fixes - ISP fix - TLB fence fix - Hainan pm fix radeon: - Hainan pm fix vmwgfx: - memory leak fix - doc warning fix imagination: - deadlock fix - interrupt handling fixes dw-hdmi-qp: - multi channel audio fix" * tag 'drm-fixes-2026-03-21' of https://gitlab.freedesktop.org/drm/kernel: (40 commits) drm/xe: Fix missing runtime PM reference in ccs_mode_store drm/xe: Open-code GGTT MMIO access protection drm/xe/lrc: Fix uninitialized new_ts when capturing context timestamp drm/xe/oa: Allow reading after disabling OA stream drm/xe: Skip over non leaf pte for PRL generation drm/xe/guc: Ensure CT state transitions via STOP before DISABLED drm/xe: Trigger queue cleanup if not in wedged mode 2 drm/xe: Forcefully tear down exec queues in GuC submit fini drm/xe: Always kill exec queues in xe_guc_submit_pause_abort drm/xe/guc: Fail immediately on GuC load error drm/i915/gt: Check set_default_submission() before deferencing drm/radeon: apply state adjust rules to some additional HAINAN vairants drm/amdgpu: apply state adjust rules to some additional HAINAN vairants drm/amdgpu: rework how we handle TLB fences drm/bridge: dw-hdmi-qp: fix multi-channel audio output drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug drm/amdgpu: Fix ISP segfault issue in kernel v7.0 drm/amdgpu/gmc9.0: add bounds checking for cid drm/amdgpu/mmhub4.2.0: add bounds checking for cid drm/amdgpu/mmhub4.1.0: add bounds checking for cid ...
2 parents 42bddab + a6e7732 commit a0c8317

41 files changed

Lines changed: 325 additions & 167 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636

3737
#define AMDGPU_BO_LIST_MAX_PRIORITY 32u
3838
#define AMDGPU_BO_LIST_NUM_BUCKETS (AMDGPU_BO_LIST_MAX_PRIORITY + 1)
39+
#define AMDGPU_BO_LIST_MAX_ENTRIES (128 * 1024)
3940

4041
static void amdgpu_bo_list_free_rcu(struct rcu_head *rcu)
4142
{
@@ -188,6 +189,9 @@ int amdgpu_bo_create_list_entry_array(struct drm_amdgpu_bo_list_in *in,
188189
const uint32_t bo_number = in->bo_number;
189190
struct drm_amdgpu_bo_list_entry *info;
190191

192+
if (bo_number > AMDGPU_BO_LIST_MAX_ENTRIES)
193+
return -EINVAL;
194+
191195
/* copy the handle array from userspace to a kernel buffer */
192196
if (likely(info_size == bo_info_size)) {
193197
info = vmemdup_array_user(uptr, bo_number, info_size);

‎drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1069,7 +1069,10 @@ amdgpu_vm_tlb_flush(struct amdgpu_vm_update_params *params,
10691069
}
10701070

10711071
/* Prepare a TLB flush fence to be attached to PTs */
1072-
if (!params->unlocked) {
1072+
/* The check for need_tlb_fence should be dropped once we
1073+
* sort out the issues with KIQ/MES TLB invalidation timeouts.
1074+
*/
1075+
if (!params->unlocked && vm->need_tlb_fence) {
10731076
amdgpu_vm_tlb_fence_create(params->adev, vm, fence);
10741077

10751078
/* Makes sure no PD/PT is freed before the flush */
@@ -2602,6 +2605,7 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm,
26022605
ttm_lru_bulk_move_init(&vm->lru_bulk_move);
26032606

26042607
vm->is_compute_context = false;
2608+
vm->need_tlb_fence = amdgpu_userq_enabled(&adev->ddev);
26052609

26062610
vm->use_cpu_for_update = !!(adev->vm_manager.vm_update_mode &
26072611
AMDGPU_VM_USE_CPU_FOR_GFX);
@@ -2739,6 +2743,7 @@ int amdgpu_vm_make_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm)
27392743
dma_fence_put(vm->last_update);
27402744
vm->last_update = dma_fence_get_stub();
27412745
vm->is_compute_context = true;
2746+
vm->need_tlb_fence = true;
27422747

27432748
unreserve_bo:
27442749
amdgpu_bo_unreserve(vm->root.bo);

‎drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -441,6 +441,8 @@ struct amdgpu_vm {
441441
struct ttm_lru_bulk_move lru_bulk_move;
442442
/* Flag to indicate if VM is used for compute */
443443
bool is_compute_context;
444+
/* Flag to indicate if VM needs a TLB fence (KFD or KGD) */
445+
bool need_tlb_fence;
444446

445447
/* Memory partition number, -1 means any partition */
446448
int8_t mem_id;

‎drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -662,28 +662,35 @@ static int gmc_v9_0_process_interrupt(struct amdgpu_device *adev,
662662
} else {
663663
switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
664664
case IP_VERSION(9, 0, 0):
665-
mmhub_cid = mmhub_client_ids_vega10[cid][rw];
665+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega10) ?
666+
mmhub_client_ids_vega10[cid][rw] : NULL;
666667
break;
667668
case IP_VERSION(9, 3, 0):
668-
mmhub_cid = mmhub_client_ids_vega12[cid][rw];
669+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega12) ?
670+
mmhub_client_ids_vega12[cid][rw] : NULL;
669671
break;
670672
case IP_VERSION(9, 4, 0):
671-
mmhub_cid = mmhub_client_ids_vega20[cid][rw];
673+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega20) ?
674+
mmhub_client_ids_vega20[cid][rw] : NULL;
672675
break;
673676
case IP_VERSION(9, 4, 1):
674-
mmhub_cid = mmhub_client_ids_arcturus[cid][rw];
677+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_arcturus) ?
678+
mmhub_client_ids_arcturus[cid][rw] : NULL;
675679
break;
676680
case IP_VERSION(9, 1, 0):
677681
case IP_VERSION(9, 2, 0):
678-
mmhub_cid = mmhub_client_ids_raven[cid][rw];
682+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_raven) ?
683+
mmhub_client_ids_raven[cid][rw] : NULL;
679684
break;
680685
case IP_VERSION(1, 5, 0):
681686
case IP_VERSION(2, 4, 0):
682-
mmhub_cid = mmhub_client_ids_renoir[cid][rw];
687+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_renoir) ?
688+
mmhub_client_ids_renoir[cid][rw] : NULL;
683689
break;
684690
case IP_VERSION(1, 8, 0):
685691
case IP_VERSION(9, 4, 2):
686-
mmhub_cid = mmhub_client_ids_aldebaran[cid][rw];
692+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_aldebaran) ?
693+
mmhub_client_ids_aldebaran[cid][rw] : NULL;
687694
break;
688695
default:
689696
mmhub_cid = NULL;

‎drivers/gpu/drm/amd/amdgpu/isp_v4_1_1.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ static int isp_genpd_add_device(struct device *dev, void *data)
129129
if (!pdev)
130130
return -EINVAL;
131131

132-
if (!dev->type->name) {
132+
if (!dev->type || !dev->type->name) {
133133
drm_dbg(&adev->ddev, "Invalid device type to add\n");
134134
goto exit;
135135
}
@@ -165,7 +165,7 @@ static int isp_genpd_remove_device(struct device *dev, void *data)
165165
if (!pdev)
166166
return -EINVAL;
167167

168-
if (!dev->type->name) {
168+
if (!dev->type || !dev->type->name) {
169169
drm_dbg(&adev->ddev, "Invalid device type to remove\n");
170170
goto exit;
171171
}

‎drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -154,14 +154,17 @@ mmhub_v2_0_print_l2_protection_fault_status(struct amdgpu_device *adev,
154154
switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
155155
case IP_VERSION(2, 0, 0):
156156
case IP_VERSION(2, 0, 2):
157-
mmhub_cid = mmhub_client_ids_navi1x[cid][rw];
157+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_navi1x) ?
158+
mmhub_client_ids_navi1x[cid][rw] : NULL;
158159
break;
159160
case IP_VERSION(2, 1, 0):
160161
case IP_VERSION(2, 1, 1):
161-
mmhub_cid = mmhub_client_ids_sienna_cichlid[cid][rw];
162+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_sienna_cichlid) ?
163+
mmhub_client_ids_sienna_cichlid[cid][rw] : NULL;
162164
break;
163165
case IP_VERSION(2, 1, 2):
164-
mmhub_cid = mmhub_client_ids_beige_goby[cid][rw];
166+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_beige_goby) ?
167+
mmhub_client_ids_beige_goby[cid][rw] : NULL;
165168
break;
166169
default:
167170
mmhub_cid = NULL;

‎drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,8 @@ mmhub_v2_3_print_l2_protection_fault_status(struct amdgpu_device *adev,
9494
case IP_VERSION(2, 3, 0):
9595
case IP_VERSION(2, 4, 0):
9696
case IP_VERSION(2, 4, 1):
97-
mmhub_cid = mmhub_client_ids_vangogh[cid][rw];
97+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vangogh) ?
98+
mmhub_client_ids_vangogh[cid][rw] : NULL;
9899
break;
99100
default:
100101
mmhub_cid = NULL;

‎drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,8 @@ mmhub_v3_0_print_l2_protection_fault_status(struct amdgpu_device *adev,
110110
switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
111111
case IP_VERSION(3, 0, 0):
112112
case IP_VERSION(3, 0, 1):
113-
mmhub_cid = mmhub_client_ids_v3_0_0[cid][rw];
113+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_0_0) ?
114+
mmhub_client_ids_v3_0_0[cid][rw] : NULL;
114115
break;
115116
default:
116117
mmhub_cid = NULL;

‎drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,8 @@ mmhub_v3_0_1_print_l2_protection_fault_status(struct amdgpu_device *adev,
117117

118118
switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
119119
case IP_VERSION(3, 0, 1):
120-
mmhub_cid = mmhub_client_ids_v3_0_1[cid][rw];
120+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_0_1) ?
121+
mmhub_client_ids_v3_0_1[cid][rw] : NULL;
121122
break;
122123
default:
123124
mmhub_cid = NULL;

‎drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_2.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,8 @@ mmhub_v3_0_2_print_l2_protection_fault_status(struct amdgpu_device *adev,
108108
"MMVM_L2_PROTECTION_FAULT_STATUS:0x%08X\n",
109109
status);
110110

111-
mmhub_cid = mmhub_client_ids_v3_0_2[cid][rw];
111+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_0_2) ?
112+
mmhub_client_ids_v3_0_2[cid][rw] : NULL;
112113
dev_err(adev->dev, "\t Faulty UTCL2 client ID: %s (0x%x)\n",
113114
mmhub_cid ? mmhub_cid : "unknown", cid);
114115
dev_err(adev->dev, "\t MORE_FAULTS: 0x%lx\n",

0 commit comments

Comments
 (0)