tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'drm-fixes-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel

Pull more drm fixes from Dave Airlie:
"These are the regular fixes that have built up over last couple of
weeks, all pretty minor and spread all over.

atomic:
- raise the vblank timeout to avoid it on virtual drivers
- fix colorop duplication

bridge:
- stm_lvds: state check fix
- dw-mipi-dsi: bridge reference leak fix

panel:
- visionx-rm69299: init fix

dma-fence:
- fix sparse warning

dma-buf:
- UAF fix

panthor:
- mapping fix

arcgpu:
- device_node reference leak fix

nouveau:
- memory leak in error path fix
- overflow in reloc path for old hw fix

hv:
- Kconfig fix

v3d:
- infinite loop fix"

* tag 'drm-fixes-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel:
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
MAINTAINERS: split hisilicon maintenance and add Yongbang Shi for hibmc-drm matainers
drm/v3d: Reject empty multisync extension to prevent infinite loop
drm/panel: visionox-rm69299: Make use of prepare_prev_first
drm/drm_atomic: duplicate colorop states if plane color pipeline in use
drm/nouveau: fix nvkm_device leak on aperture removal failure
hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS
dma-fence: Silence sparse warning in dma_fence_describe
drm/bridge: dw-mipi-dsi: Fix bridge leak when host attach fails
drm/arcpgu: fix device node leak
drm/panthor: Fix outdated function documentation
drm/panthor: Extend VM locked region for remap case to be a superset
dma-buf: fix UAF in dma_buf_put() tracepoint
drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector
drm/atomic: Increase timeout in drm_atomic_helper_wait_for_vblanks()

Linus Torvalds cf950766 92c4c9fd

+73 -19
+10 -3
MAINTAINERS
··· 8602 8602 T: git https://gitlab.freedesktop.org/drm/misc/kernel.git 8603 8603 F: drivers/gpu/drm/gma500/ 8604 8604 8605 - DRM DRIVERS FOR HISILICON 8606 - M: Xinliang Liu <xinliang.liu@linaro.org> 8605 + DRM DRIVERS FOR HISILICON HIBMC 8606 + M: Yongbang Shi <shiyongbang@huawei.com> 8607 8607 M: Tian Tao <tiantao6@hisilicon.com> 8608 8608 R: Xinwei Kong <kong.kongxinwei@hisilicon.com> 8609 + L: dri-devel@lists.freedesktop.org 8610 + S: Maintained 8611 + T: git https://gitlab.freedesktop.org/drm/misc/kernel.git 8612 + F: drivers/gpu/drm/hisilicon/hibmc 8613 + 8614 + DRM DRIVERS FOR HISILICON KIRIN 8615 + M: Xinliang Liu <xinliang.liu@linaro.org> 8609 8616 R: Sumit Semwal <sumit.semwal@linaro.org> 8610 8617 R: Yongqin Liu <yongqin.liu@linaro.org> 8611 8618 R: John Stultz <jstultz@google.com> ··· 8620 8613 S: Maintained 8621 8614 T: git https://gitlab.freedesktop.org/drm/misc/kernel.git 8622 8615 F: Documentation/devicetree/bindings/display/hisilicon/ 8623 - F: drivers/gpu/drm/hisilicon/ 8616 + F: drivers/gpu/drm/hisilicon/kirin 8624 8617 8625 8618 DRM DRIVERS FOR LIMA 8626 8619 M: Qiang Yu <yuq825@gmail.com>
+1 -2
drivers/dma-buf/dma-buf.c
··· 845 845 if (WARN_ON(!dmabuf || !dmabuf->file)) 846 846 return; 847 847 848 - fput(dmabuf->file); 849 - 850 848 DMA_BUF_TRACE(trace_dma_buf_put, dmabuf); 849 + fput(dmabuf->file); 851 850 } 852 851 EXPORT_SYMBOL_NS_GPL(dma_buf_put, "DMA_BUF"); 853 852
+2 -2
drivers/dma-buf/dma-fence.c
··· 1037 1037 */ 1038 1038 void dma_fence_describe(struct dma_fence *fence, struct seq_file *seq) 1039 1039 { 1040 - const char __rcu *timeline = ""; 1041 - const char __rcu *driver = ""; 1040 + const char __rcu *timeline = (const char __rcu *)""; 1041 + const char __rcu *driver = (const char __rcu *)""; 1042 1042 const char *signaled = ""; 1043 1043 1044 1044 rcu_read_lock();
+5 -1
drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
··· 345 345 if (pdata->host_ops && pdata->host_ops->attach) { 346 346 ret = pdata->host_ops->attach(pdata->priv_data, device); 347 347 if (ret < 0) 348 - return ret; 348 + goto err_remove_bridge; 349 349 } 350 350 351 351 return 0; 352 + 353 + err_remove_bridge: 354 + drm_bridge_remove(&dsi->bridge); 355 + return ret; 352 356 } 353 357 354 358 static int dw_mipi_dsi_host_detach(struct mipi_dsi_host *host,
+5 -1
drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi2.c
··· 540 540 if (pdata->host_ops && pdata->host_ops->attach) { 541 541 ret = pdata->host_ops->attach(pdata->priv_data, device); 542 542 if (ret < 0) 543 - return ret; 543 + goto err_remove_bridge; 544 544 } 545 545 546 546 return 0; 547 + 548 + err_remove_bridge: 549 + drm_bridge_remove(&dsi2->bridge); 550 + return ret; 547 551 } 548 552 549 553 static int dw_mipi_dsi2_host_detach(struct mipi_dsi_host *host,
+13 -1
drivers/gpu/drm/drm_atomic_helper.c
··· 1916 1916 ret = wait_event_timeout(*queue, 1917 1917 state->crtcs[i].last_vblank_count != 1918 1918 drm_crtc_vblank_count(crtc), 1919 - msecs_to_jiffies(100)); 1919 + msecs_to_jiffies(1000)); 1920 1920 1921 1921 WARN(!ret, "[CRTC:%d:%s] vblank wait timed out\n", 1922 1922 crtc->base.id, crtc->name); ··· 3751 3751 err = PTR_ERR(plane_state); 3752 3752 goto free; 3753 3753 } 3754 + 3755 + if (plane_state->color_pipeline) { 3756 + err = drm_atomic_add_affected_colorops(state, plane); 3757 + if (err) 3758 + goto free; 3759 + } 3760 + 3754 3761 } 3755 3762 3756 3763 drm_connector_list_iter_begin(dev, &conn_iter); ··· 3863 3856 int i, ret; 3864 3857 struct drm_plane *plane; 3865 3858 struct drm_plane_state *new_plane_state; 3859 + struct drm_colorop *colorop; 3860 + struct drm_colorop_state *new_colorop_state; 3866 3861 struct drm_connector *connector; 3867 3862 struct drm_connector_state *new_conn_state; 3868 3863 struct drm_crtc *crtc; 3869 3864 struct drm_crtc_state *new_crtc_state; 3870 3865 3871 3866 state->acquire_ctx = ctx; 3867 + 3868 + for_each_new_colorop_in_state(state, colorop, new_colorop_state, i) 3869 + state->colorops[i].old_state = colorop->state; 3872 3870 3873 3871 for_each_new_plane_in_state(state, plane, new_plane_state, i) 3874 3872 state->planes[i].old_state = plane->state;
+1 -1
drivers/gpu/drm/nouveau/nouveau_drm.c
··· 875 875 /* Remove conflicting drivers (vesafb, efifb etc). */ 876 876 ret = aperture_remove_conflicting_pci_devices(pdev, driver_pci.name); 877 877 if (ret) 878 - return ret; 878 + goto fail_nvkm; 879 879 880 880 pci_set_master(pdev); 881 881
+1 -1
drivers/gpu/drm/nouveau/nouveau_gem.c
··· 686 686 } 687 687 nvbo = (void *)(unsigned long)bo[r->reloc_bo_index].user_priv; 688 688 689 - if (unlikely(r->reloc_bo_offset + 4 > 689 + if (unlikely((u64)r->reloc_bo_offset + 4 > 690 690 nvbo->bo.base.size)) { 691 691 NV_PRINTK(err, cli, "reloc outside of bo\n"); 692 692 ret = -EINVAL;
+2
drivers/gpu/drm/panel/panel-visionox-rm69299.c
··· 376 376 return PTR_ERR(ctx->reset_gpio); 377 377 } 378 378 379 + ctx->panel.prepare_prev_first = true; 380 + 379 381 ctx->panel.backlight = visionox_rm69299_create_backlight(ctx); 380 382 if (IS_ERR(ctx->panel.backlight)) 381 383 return dev_err_probe(dev, PTR_ERR(ctx->panel.backlight),
+1 -1
drivers/gpu/drm/panthor/panthor_gem.c
··· 157 157 /** 158 158 * panthor_kernel_bo_create() - Create and map a GEM object to a VM 159 159 * @ptdev: Device. 160 - * @vm: VM to map the GEM to. If NULL, the kernel object is not GPU mapped. 160 + * @vm: VM to map the GEM to. 161 161 * @size: Size of the buffer object. 162 162 * @bo_flags: Combination of drm_panthor_bo_flags flags. 163 163 * @vm_map_flags: Combination of drm_panthor_vm_bind_op_flags (only those
+19
drivers/gpu/drm/panthor/panthor_mmu.c
··· 1648 1648 start + size <= vm->locked_region.start + vm->locked_region.size) 1649 1649 return 0; 1650 1650 1651 + /* sm_step_remap() may need a locked region that isn't a strict superset 1652 + * of the original one because of having to extend unmap boundaries beyond 1653 + * it to deal with partial unmaps of transparent huge pages. What we want 1654 + * in those cases is to lock the union of both regions. The new region must 1655 + * always overlap with the original one, because the upper and lower unmap 1656 + * boundaries in a remap operation can only shift up or down respectively, 1657 + * but never otherwise. 1658 + */ 1659 + if (vm->locked_region.size) { 1660 + u64 end = max(vm->locked_region.start + vm->locked_region.size, 1661 + start + size); 1662 + 1663 + drm_WARN_ON_ONCE(&vm->ptdev->base, (start + size <= vm->locked_region.start) || 1664 + (start >= vm->locked_region.start + vm->locked_region.size)); 1665 + 1666 + start = min(start, vm->locked_region.start); 1667 + size = end - start; 1668 + } 1669 + 1651 1670 mutex_lock(&ptdev->mmu->as.slots_lock); 1652 1671 if (vm->as.id >= 0 && size) { 1653 1672 /* Lock the region that needs to be updated */
+3 -3
drivers/gpu/drm/stm/lvds.c
··· 897 897 if (!conn_state) 898 898 return -EINVAL; 899 899 900 + if (!conn_state->crtc) 901 + return 0; 902 + 900 903 if (list_empty(&connector->modes)) { 901 904 drm_dbg(connector->dev, "connector: empty modes list\n"); 902 905 return -EINVAL; 903 906 } 904 - 905 - if (!conn_state->crtc) 906 - return -EINVAL; 907 907 908 908 panel_mode = list_first_entry(&connector->modes, 909 909 struct drm_display_mode, head);
+2 -1
drivers/gpu/drm/tiny/arcpgu.c
··· 250 250 static int arcpgu_load(struct arcpgu_drm_private *arcpgu) 251 251 { 252 252 struct platform_device *pdev = to_platform_device(arcpgu->drm.dev); 253 - struct device_node *encoder_node = NULL, *endpoint_node = NULL; 253 + struct device_node *encoder_node __free(device_node) = NULL; 254 + struct device_node *endpoint_node = NULL; 254 255 struct drm_connector *connector = NULL; 255 256 struct drm_device *drm = &arcpgu->drm; 256 257 int ret;
+5
drivers/gpu/drm/v3d/v3d_submit.c
··· 399 399 if (multisync.pad) 400 400 return -EINVAL; 401 401 402 + if (!multisync.in_sync_count && !multisync.out_sync_count) { 403 + drm_dbg(&v3d->drm, "Empty multisync extension\n"); 404 + return -EINVAL; 405 + } 406 + 402 407 ret = v3d_get_multisync_post_deps(file_priv, se, multisync.out_sync_count, 403 408 multisync.out_syncs); 404 409 if (ret)
+1 -1
drivers/hv/Kconfig
··· 9 9 select PARAVIRT 10 10 select X86_HV_CALLBACK_VECTOR if X86 11 11 select OF_EARLY_FLATTREE if OF 12 - select SYSFB if EFI && !HYPERV_VTL_MODE 13 12 select IRQ_MSI_LIB if X86 14 13 help 15 14 Select this option to run Linux as a Hyper-V client operating ··· 61 62 tristate "Microsoft Hyper-V VMBus driver" 62 63 depends on HYPERV 63 64 default HYPERV 65 + select SYSFB if EFI && !HYPERV_VTL_MODE 64 66 help 65 67 Select this option to enable Hyper-V Vmbus driver. 66 68
+2 -1
include/drm/drm_atomic.h
··· 1101 1101 for_each_if ((__state)->colorops[__i].ptr && \ 1102 1102 ((colorop) = (__state)->colorops[__i].ptr, \ 1103 1103 (void)(colorop) /* Only to avoid unused-but-set-variable warning */, \ 1104 - (new_colorop_state) = (__state)->colorops[__i].new_state, 1)) 1104 + (new_colorop_state) = (__state)->colorops[__i].new_state,\ 1105 + (void)(new_colorop_state) /* Only to avoid unused-but-set-variable warning */, 1)) 1105 1106 1106 1107 /** 1107 1108 * for_each_oldnew_plane_in_state - iterate over all planes in an atomic update