7.2-stable patches added patches: drm-bridge-dw-hdmi-fix-i2c-adapter-leak-on-probe-failure.patch drm-fix-race-between-partial-drm_dev_register-failure-and-ioctl.patch drm-i915-display-clear-sel_fetch_plane_ctl-on-plane-disable.patch drm-i915-guard-against-null-driver_data-in-i915_pci_probe.patch drm-panel-edp-fix-i2c-adapter-leak-on-probe-failure.patch drm-panthor-fix-firmware-control-interface-bounds-checks.patch drm-panthor-harden-firmware-build-info-bounds-checks.patch drm-ssd130x-fix-column-and-row-end-address-in-partial-updates-for-ssd132x.patch drm-xe-vram-report-flat_ccs-base-misalignment.patch
diff --git a/queue-7.2/drm-bridge-dw-hdmi-fix-i2c-adapter-leak-on-probe-failure.patch b/queue-7.2/drm-bridge-dw-hdmi-fix-i2c-adapter-leak-on-probe-failure.patch new file mode 100644 index 0000000..7b529a8 --- /dev/null +++ b/queue-7.2/drm-bridge-dw-hdmi-fix-i2c-adapter-leak-on-probe-failure.patch
@@ -0,0 +1,37 @@ +From 09b195a7bb23df56269cd2a95d01ba3a5533af13 Mon Sep 17 00:00:00 2001 +From: Johan Hovold <johan@kernel.org> +Date: Fri, 17 Jul 2026 11:08:19 +0200 +Subject: drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure + +From: Johan Hovold <johan@kernel.org> + +commit 09b195a7bb23df56269cd2a95d01ba3a5533af13 upstream. + +Make sure to drop the i2c adapter device and module references before +returning when detecting a malformed devicetree during probe. + +Fixes: 80e2f97968b5 ("drm: bridge: dw-hdmi: Switch to regmap for register access") +Cc: stable@vger.kernel.org # 4.12 +Cc: Neil Armstrong <neil.armstrong@linaro.org> +Signed-off-by: Johan Hovold <johan@kernel.org> +Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> +Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> +Link: https://patch.msgid.link/20260717090819.1630965-1-johan@kernel.org +Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +@@ -3389,7 +3389,8 @@ struct dw_hdmi *dw_hdmi_probe(struct pla + break; + default: + dev_err(dev, "reg-io-width must be 1 or 4\n"); +- return ERR_PTR(-EINVAL); ++ ret = -EINVAL; ++ goto err_res; + } + + iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
diff --git a/queue-7.2/drm-fix-race-between-partial-drm_dev_register-failure-and-ioctl.patch b/queue-7.2/drm-fix-race-between-partial-drm_dev_register-failure-and-ioctl.patch new file mode 100644 index 0000000..cc080ac --- /dev/null +++ b/queue-7.2/drm-fix-race-between-partial-drm_dev_register-failure-and-ioctl.patch
@@ -0,0 +1,98 @@ +From eb197f7d60f00d0f5b1b3505dfc86a7e36045a3e Mon Sep 17 00:00:00 2001 +From: Danilo Krummrich <dakr@kernel.org> +Date: Sun, 28 Jun 2026 16:53:36 +0200 +Subject: drm: fix race between partial drm_dev_register() failure and ioctl + +From: Danilo Krummrich <dakr@kernel.org> + +commit eb197f7d60f00d0f5b1b3505dfc86a7e36045a3e upstream. + +If drm_dev_register() fails after registering a minor (e.g. render minor +registered, primary minor fails), userspace could have opened the first +minor and entered a drm_dev_enter() critical section. Since the +unplugged flag was never set, the ioctl proceeds while the error path +tears down device resources. + +Fix this by introducing drm_dev_synchronize_unplug(), which sets the +unplugged flag and waits for the SRCU barrier, ensuring all in-flight +drm_dev_enter() critical sections complete before cleanup proceeds; call +it on the error path of drm_dev_register(). + +Fixes: bee330f3d672 ("drm: Use srcu to protect drm_device.unplugged") +Cc: stable@vger.kernel.org +Reported-by: sashiko-bot@kernel.org +Closes: https://lore.kernel.org/all/20260620190648.2E9F61F000E9@smtp.kernel.org/ +Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> +Reviewed-by: Lyude Paul <lyude@redhat.com> +Tested-by: Deborah Brouwer <deborah.brouwer@collabora.com> +Link: https://patch.msgid.link/20260628145406.2107056-17-dakr@kernel.org +Signed-off-by: Danilo Krummrich <dakr@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/gpu/drm/drm_drv.c | 34 +++++++++++++++++++++++++--------- + 1 file changed, 25 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/drm_drv.c ++++ b/drivers/gpu/drm/drm_drv.c +@@ -473,6 +473,22 @@ void drm_dev_exit(int idx) + } + EXPORT_SYMBOL(drm_dev_exit); + ++/* ++ * Mark the device as unplugged and wait for any in-flight drm_dev_enter() ++ * critical sections to complete. ++ */ ++static void drm_dev_synchronize_unplug(struct drm_device *dev) ++{ ++ /* ++ * After synchronizing any critical read section is guaranteed to see ++ * the new value of ->unplugged, and any critical section which might ++ * still have seen the old value of ->unplugged is guaranteed to have ++ * finished. ++ */ ++ dev->unplugged = true; ++ synchronize_srcu(&drm_unplug_srcu); ++} ++ + /** + * drm_dev_unplug - unplug a DRM device + * @dev: DRM device +@@ -485,15 +501,7 @@ EXPORT_SYMBOL(drm_dev_exit); + */ + void drm_dev_unplug(struct drm_device *dev) + { +- /* +- * After synchronizing any critical read section is guaranteed to see +- * the new value of ->unplugged, and any critical section which might +- * still have seen the old value of ->unplugged is guaranteed to have +- * finished. +- */ +- dev->unplugged = true; +- synchronize_srcu(&drm_unplug_srcu); +- ++ drm_dev_synchronize_unplug(dev); + drm_dev_unregister(dev); + + /* Clear all CPU mappings pointing to this device */ +@@ -1091,6 +1099,7 @@ int drm_dev_register(struct drm_device * + goto err_minors; + + dev->registered = true; ++ dev->unplugged = false; + + if (driver->load) { + ret = driver->load(dev, flags); +@@ -1118,6 +1127,13 @@ err_unload: + if (dev->driver->unload) + dev->driver->unload(dev); + err_minors: ++ /* ++ * If a minor was registered before the failure, userspace could have ++ * opened it and entered a drm_dev_enter() critical section. Ensure all ++ * such sections complete before we clean up. ++ */ ++ drm_dev_synchronize_unplug(dev); ++ + remove_compat_control_link(dev); + drm_minor_unregister(dev, DRM_MINOR_ACCEL); + drm_minor_unregister(dev, DRM_MINOR_PRIMARY);
diff --git a/queue-7.2/drm-i915-display-clear-sel_fetch_plane_ctl-on-plane-disable.patch b/queue-7.2/drm-i915-display-clear-sel_fetch_plane_ctl-on-plane-disable.patch new file mode 100644 index 0000000..2a213c8 --- /dev/null +++ b/queue-7.2/drm-i915-display-clear-sel_fetch_plane_ctl-on-plane-disable.patch
@@ -0,0 +1,126 @@ +From 7f1172a2ac0d7e50850785e2e65789c8aac8411a Mon Sep 17 00:00:00 2001 +From: Nemesa Garg <nemesa.garg@intel.com> +Date: Tue, 18 Aug 2026 15:21:49 +0530 +Subject: drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nemesa Garg <nemesa.garg@intel.com> + +commit 7f1172a2ac0d7e50850785e2e65789c8aac8411a upstream. + +icl_plane_disable_sel_fetch_arm() wrote SEL_FETCH_PLANE_CTL = 0 only when +crtc_state->enable_psr2_sel_fetch was set. If a plane was disabled after +selective fetch had been turned off, the guard fired early and left the +register's enable bit set in hardware. + +The bit is harmless until selective fetch is re-enabled. When it is, the +hardware resumes fetching for the now-disabled plane and keeps its old DDB +range reserved. + +i9xx_cursor_disable_sel_fetch_arm() has the same guard on SEL_FETCH_CUR_CTL +and is fixed the same way. + +v2: Add same check for cursor also. [sashiko] + +Cc: stable@vger.kernel.org +Fixes: b1f5279b5981 ("drm/i915/psr: Move plane sel fetch configuration into plane source files") +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8739 +Assisted-by: GitHub-Copilot:claude-opus-4.6 +Signed-off-by: Nemesa Garg <nemesa.garg@intel.com> +Reviewed-by: Jouni Högander <jouni.hogander@intel.com> +Signed-off-by: Animesh Manna <animesh.manna@intel.com> +Link: https://patch.msgid.link/20260818095149.2172935-1-nemesa.garg@intel.com +(cherry picked from commit 600a7c9d40e5e0c5544f42d1c9592c8d15224dc0) +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/gpu/drm/i915/display/intel_cursor.c | 15 ++++++++++----- + drivers/gpu/drm/i915/display/skl_universal_plane.c | 15 ++++++++++----- + 2 files changed, 20 insertions(+), 10 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_cursor.c ++++ b/drivers/gpu/drm/i915/display/intel_cursor.c +@@ -530,13 +530,18 @@ static int i9xx_check_cursor(struct inte + } + + static void i9xx_cursor_disable_sel_fetch_arm(struct intel_dsb *dsb, +- struct intel_plane *plane, +- const struct intel_crtc_state *crtc_state) ++ struct intel_plane *plane) + { + struct intel_display *display = to_intel_display(plane); + enum pipe pipe = plane->pipe; + +- if (!crtc_state->enable_psr2_sel_fetch) ++ /* ++ * Clear this whenever the hardware has selective fetch, not just when ++ * the current state uses it. The cursor may have been enabled with ++ * selective fetch earlier and had its enable bit orphaned when the ++ * feature was switched off. ++ */ ++ if (!HAS_PSR2_SEL_FETCH(display)) + return; + + intel_de_write_dsb(display, dsb, SEL_FETCH_CUR_CTL(pipe), 0); +@@ -586,7 +591,7 @@ static void i9xx_cursor_update_sel_fetch + if (crtc_state->enable_psr2_su_region_et) + wa_16021440873(dsb, plane, crtc_state, plane_state); + else +- i9xx_cursor_disable_sel_fetch_arm(dsb, plane, crtc_state); ++ i9xx_cursor_disable_sel_fetch_arm(dsb, plane); + } + } + +@@ -695,7 +700,7 @@ static void i9xx_cursor_update_arm(struc + if (plane_state) + i9xx_cursor_update_sel_fetch_arm(dsb, plane, crtc_state, plane_state); + else +- i9xx_cursor_disable_sel_fetch_arm(dsb, plane, crtc_state); ++ i9xx_cursor_disable_sel_fetch_arm(dsb, plane); + + if (plane->cursor.base != base || + plane->cursor.size != fbc_ctl || +--- a/drivers/gpu/drm/i915/display/skl_universal_plane.c ++++ b/drivers/gpu/drm/i915/display/skl_universal_plane.c +@@ -879,13 +879,18 @@ skl_plane_disable_arm(struct intel_dsb * + } + + static void icl_plane_disable_sel_fetch_arm(struct intel_dsb *dsb, +- struct intel_plane *plane, +- const struct intel_crtc_state *crtc_state) ++ struct intel_plane *plane) + { + struct intel_display *display = to_intel_display(plane); + enum pipe pipe = plane->pipe; + +- if (!crtc_state->enable_psr2_sel_fetch) ++ /* ++ * Clear this whenever the hardware has selective fetch, not just when ++ * the current state uses it. The plane may have been enabled with ++ * selective fetch earlier and had its enable bit orphaned when the ++ * feature was switched off. ++ */ ++ if (!HAS_PSR2_SEL_FETCH(display)) + return; + + intel_de_write_dsb(display, dsb, SEL_FETCH_PLANE_CTL(pipe, plane->id), 0); +@@ -921,7 +926,7 @@ icl_plane_disable_arm(struct intel_dsb * + + skl_write_plane_wm(dsb, plane, crtc_state); + +- icl_plane_disable_sel_fetch_arm(dsb, plane, crtc_state); ++ icl_plane_disable_sel_fetch_arm(dsb, plane); + + if (plane_has_normalizer(plane)) + intel_de_write_dsb(display, dsb, +@@ -1641,7 +1646,7 @@ static void icl_plane_update_sel_fetch_a + intel_de_write_dsb(display, dsb, SEL_FETCH_PLANE_CTL(pipe, plane->id), + SEL_FETCH_PLANE_CTL_ENABLE); + else +- icl_plane_disable_sel_fetch_arm(dsb, plane, crtc_state); ++ icl_plane_disable_sel_fetch_arm(dsb, plane); + } + + static void
diff --git a/queue-7.2/drm-i915-guard-against-null-driver_data-in-i915_pci_probe.patch b/queue-7.2/drm-i915-guard-against-null-driver_data-in-i915_pci_probe.patch new file mode 100644 index 0000000..2508bb6 --- /dev/null +++ b/queue-7.2/drm-i915-guard-against-null-driver_data-in-i915_pci_probe.patch
@@ -0,0 +1,41 @@ +From 3785d40831ba5601296283e0197e10e089392757 Mon Sep 17 00:00:00 2001 +From: Deepanshu Kartikey <kartikey406@gmail.com> +Date: Thu, 13 Aug 2026 12:19:02 +0530 +Subject: drm/i915: Guard against NULL driver_data in i915_pci_probe() + +From: Deepanshu Kartikey <kartikey406@gmail.com> + +commit 3785d40831ba5601296283e0197e10e089392757 upstream. + +pci_match_device() can return the dummy pci_device_id_any entry +when a device is force-bound via sysfs driver_override, in which +case ->driver_data is unset (NULL). i915_pci_probe() casts it to +struct intel_device_info * unconditionally and dereferences +intel_info->require_force_probe, causing a NULL-ptr-deref. + +Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc +Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> +Link: https://patch.msgid.link/20260813064902.367504-1-kartikey406@gmail.com +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +(cherry picked from commit 2727922084672cc274ecea726ea00363c2893731) +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/gpu/drm/i915/i915_pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_pci.c ++++ b/drivers/gpu/drm/i915/i915_pci.c +@@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev + (struct intel_device_info *) ent->driver_data; + int err; + ++ if (!intel_info) ++ return -ENODEV; ++ + if (intel_info->require_force_probe && !id_forced(pdev->device)) { + dev_info(&pdev->dev, + "Your graphics device %04x is not properly supported by i915 in this\n"
diff --git a/queue-7.2/drm-panel-edp-fix-i2c-adapter-leak-on-probe-failure.patch b/queue-7.2/drm-panel-edp-fix-i2c-adapter-leak-on-probe-failure.patch new file mode 100644 index 0000000..d359c30 --- /dev/null +++ b/queue-7.2/drm-panel-edp-fix-i2c-adapter-leak-on-probe-failure.patch
@@ -0,0 +1,82 @@ +From e2a9e291275a74e309a21cbb1def6296a72d6aed Mon Sep 17 00:00:00 2001 +From: Johan Hovold <johan@kernel.org> +Date: Fri, 17 Jul 2026 16:31:18 +0200 +Subject: drm/panel-edp: fix i2c adapter leak on probe failure + +From: Johan Hovold <johan@kernel.org> + +commit e2a9e291275a74e309a21cbb1def6296a72d6aed upstream. + +Make sure to drop the i2c adapter reference on probe failure (e.g. +probe deferral) and on driver unbind also if a devicetree redundantly +uses the 'ddc-i2c-bus' property to point to the aux ddc bus. + +Fixes: cc5a3fc041f0 ("drm/panel: panel-simple: Stash DP AUX bus; allow using it for DDC") +Cc: stable@vger.kernel.org # 5.15 +Reported-by: Douglas Anderson <dianders@chromium.org> +Link: https://lore.kernel.org/r/CAD=FV=VZPhzHU+Pet2m3L+Pqc7mOPfZC-f5p0OuNL79wNZPxRg@mail.gmail.com +Signed-off-by: Johan Hovold <johan@kernel.org> +Reviewed-by: Douglas Anderson <dianders@chromium.org> +Signed-off-by: Douglas Anderson <dianders@chromium.org> +Link: https://patch.msgid.link/20260717143119.1815106-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/gpu/drm/panel/panel-edp.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -831,6 +831,13 @@ exit: + return 0; + } + ++static void panel_edp_put_adapter(void *_adap) ++{ ++ struct i2c_adapter *adap = _adap; ++ ++ put_device(&adap->dev); ++} ++ + static int panel_edp_probe(struct device *dev, const struct panel_desc *desc, + struct drm_dp_aux *aux) + { +@@ -878,6 +885,11 @@ static int panel_edp_probe(struct device + + if (!panel->ddc) + return -EPROBE_DEFER; ++ ++ err = devm_add_action_or_reset(dev, panel_edp_put_adapter, ++ panel->ddc); ++ if (err) ++ return err; + } else if (aux) { + panel->ddc = &aux->ddc; + } +@@ -889,7 +901,7 @@ static int panel_edp_probe(struct device + + err = drm_panel_of_backlight(&panel->base); + if (err) +- goto err_finished_ddc_init; ++ return err; + + /* + * We use runtime PM for prepare / unprepare since those power the panel +@@ -936,9 +948,6 @@ static int panel_edp_probe(struct device + err_finished_pm_runtime: + pm_runtime_dont_use_autosuspend(dev); + pm_runtime_disable(dev); +-err_finished_ddc_init: +- if (panel->ddc && (!panel->aux || panel->ddc != &panel->aux->ddc)) +- put_device(&panel->ddc->dev); + + return err; + } +@@ -982,8 +991,6 @@ static void panel_edp_remove(struct devi + + pm_runtime_dont_use_autosuspend(dev); + pm_runtime_disable(dev); +- if (panel->ddc && (!panel->aux || panel->ddc != &panel->aux->ddc)) +- put_device(&panel->ddc->dev); + + drm_edid_free(panel->drm_edid); + panel->drm_edid = NULL;
diff --git a/queue-7.2/drm-panthor-fix-firmware-control-interface-bounds-checks.patch b/queue-7.2/drm-panthor-fix-firmware-control-interface-bounds-checks.patch new file mode 100644 index 0000000..adde919 --- /dev/null +++ b/queue-7.2/drm-panthor-fix-firmware-control-interface-bounds-checks.patch
@@ -0,0 +1,85 @@ +From 6a47f9fd2d970674ed9dedc52fc7ab76fd015785 Mon Sep 17 00:00:00 2001 +From: Osama Abdelkader <osama.abdelkader@gmail.com> +Date: Mon, 20 Jul 2026 15:44:35 +0200 +Subject: drm/panthor: fix firmware control interface bounds checks + +From: Osama Abdelkader <osama.abdelkader@gmail.com> + +commit 6a47f9fd2d970674ed9dedc52fc7ab76fd015785 upstream. + +panthor_init_cs_iface() and panthor_init_csg_iface() validate firmware +control interface offsets with 32-bit arithmetic and the size of the host +wrapper structures. The offsets are derived from firmware-provided strides, +so the arithmetic can wrap before the bounds check, and the host wrapper +size is not the size of the firmware control interface being mapped. + +Use 64-bit arithmetic for the computed offsets and validate against the +actual firmware control interface structure sizes with subtraction-based +bounds checks. Also validate that the shared section is large enough for +the global control interface before using it. + +Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") +Cc: stable@vger.kernel.org +Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> +Reviewed-by: Steven Price <steven.price@arm.com> +Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> +Link: https://patch.msgid.link/20260720134435.13377-1-osama.abdelkader@gmail.com +Signed-off-by: Steven Price <steven.price@arm.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/gpu/drm/panthor/panthor_fw.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/panthor/panthor_fw.c ++++ b/drivers/gpu/drm/panthor/panthor_fw.c +@@ -895,14 +895,15 @@ static int panthor_init_cs_iface(struct + struct panthor_fw_csg_iface *csg_iface = panthor_fw_get_csg_iface(ptdev, csg_idx); + struct panthor_fw_cs_iface *cs_iface = &ptdev->fw->iface.streams[csg_idx][cs_idx]; + u64 shared_section_sz = panthor_kernel_bo_size(ptdev->fw->shared_section->mem); +- u32 iface_offset = CSF_GROUP_CONTROL_OFFSET + +- (csg_idx * glb_iface->control->group_stride) + ++ u64 iface_offset = CSF_GROUP_CONTROL_OFFSET + ++ ((u64)csg_idx * glb_iface->control->group_stride) + + CSF_STREAM_CONTROL_OFFSET + +- (cs_idx * csg_iface->control->stream_stride); ++ ((u64)cs_idx * csg_iface->control->stream_stride); + struct panthor_fw_cs_iface *first_cs_iface = + panthor_fw_get_cs_iface(ptdev, 0, 0); + +- if (iface_offset + sizeof(*cs_iface) >= shared_section_sz) ++ if (iface_offset > shared_section_sz || ++ sizeof(*cs_iface->control) > shared_section_sz - iface_offset) + return -EINVAL; + + spin_lock_init(&cs_iface->lock); +@@ -952,10 +953,12 @@ static int panthor_init_csg_iface(struct + struct panthor_fw_global_iface *glb_iface = panthor_fw_get_glb_iface(ptdev); + struct panthor_fw_csg_iface *csg_iface = &ptdev->fw->iface.groups[csg_idx]; + u64 shared_section_sz = panthor_kernel_bo_size(ptdev->fw->shared_section->mem); +- u32 iface_offset = CSF_GROUP_CONTROL_OFFSET + (csg_idx * glb_iface->control->group_stride); ++ u64 iface_offset = CSF_GROUP_CONTROL_OFFSET + ++ ((u64)csg_idx * glb_iface->control->group_stride); + unsigned int i; + +- if (iface_offset + sizeof(*csg_iface) >= shared_section_sz) ++ if (iface_offset > shared_section_sz || ++ sizeof(*csg_iface->control) > shared_section_sz - iface_offset) + return -EINVAL; + + spin_lock_init(&csg_iface->lock); +@@ -1007,11 +1010,15 @@ static u32 panthor_get_instr_features(st + static int panthor_fw_init_ifaces(struct panthor_device *ptdev) + { + struct panthor_fw_global_iface *glb_iface = &ptdev->fw->iface.global; ++ u64 shared_section_sz = panthor_kernel_bo_size(ptdev->fw->shared_section->mem); + unsigned int i; + + if (!ptdev->fw->shared_section->mem->kmap) + return -EINVAL; + ++ if (sizeof(*glb_iface->control) > shared_section_sz) ++ return -EINVAL; ++ + spin_lock_init(&glb_iface->lock); + glb_iface->control = ptdev->fw->shared_section->mem->kmap; +
diff --git a/queue-7.2/drm-panthor-harden-firmware-build-info-bounds-checks.patch b/queue-7.2/drm-panthor-harden-firmware-build-info-bounds-checks.patch new file mode 100644 index 0000000..c1d003a --- /dev/null +++ b/queue-7.2/drm-panthor-harden-firmware-build-info-bounds-checks.patch
@@ -0,0 +1,43 @@ +From 8321b093fa6c297b80586460ce6914d9655df170 Mon Sep 17 00:00:00 2001 +From: Osama Abdelkader <osama.abdelkader@gmail.com> +Date: Mon, 20 Jul 2026 13:32:11 +0200 +Subject: drm/panthor: harden firmware build-info bounds checks + +From: Osama Abdelkader <osama.abdelkader@gmail.com> + +commit 8321b093fa6c297b80586460ce6914d9655df170 upstream. + +panthor_fw_read_build_info() checks whether the metadata range fits in the +firmware image with hdr.meta_start + hdr.meta_size. Both fields are u32, so +the addition can wrap and let an out-of-bounds range pass validation. + +The function also reads the "git_sha: " prefix without first checking that +the metadata is long enough, and meta_size == 0 can underflow the NULL +terminator index. + +Use subtraction-based bounds checking and reject metadata that is too short +to contain the expected prefix and trailing NULL byte. + +Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") +Cc: stable@vger.kernel.org +Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> +Reviewed-by: Steven Price <steven.price@arm.com> +Signed-off-by: Steven Price <steven.price@arm.com> +Link: https://patch.msgid.link/20260720113212.11981-1-osama.abdelkader@gmail.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/gpu/drm/panthor/panthor_fw.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/panthor/panthor_fw.c ++++ b/drivers/gpu/drm/panthor/panthor_fw.c +@@ -707,7 +707,8 @@ static int panthor_fw_read_build_info(st + return ret; + + if (hdr.meta_start > fw->size || +- hdr.meta_start + hdr.meta_size > fw->size) { ++ hdr.meta_size > fw->size - hdr.meta_start || ++ hdr.meta_size <= header_len) { + drm_err(&ptdev->base, "Firmware build info corrupt\n"); + /* We don't need the build info, so continue */ + return 0;
diff --git a/queue-7.2/drm-ssd130x-fix-column-and-row-end-address-in-partial-updates-for-ssd132x.patch b/queue-7.2/drm-ssd130x-fix-column-and-row-end-address-in-partial-updates-for-ssd132x.patch new file mode 100644 index 0000000..a24b513 --- /dev/null +++ b/queue-7.2/drm-ssd130x-fix-column-and-row-end-address-in-partial-updates-for-ssd132x.patch
@@ -0,0 +1,49 @@ +From 99e9c09358195454ecd200b9c6aba6b7d209fad4 Mon Sep 17 00:00:00 2001 +From: Amit Barzilai <amit.barzilai22@gmail.com> +Date: Mon, 22 Jun 2026 15:26:02 +0300 +Subject: drm/ssd130x: fix column and row end address in partial updates for ssd132x + +From: Amit Barzilai <amit.barzilai22@gmail.com> + +commit 99e9c09358195454ecd200b9c6aba6b7d209fad4 upstream. + +On partial screen updates, SSD132X controllers expect to get the +rectangle addresses as arguments of the "Set Column Address" and "Set +Row Address" commands. Each command expects the start address and end +address of the row/column in absolute format, however the end +addresses were being sent in a relative format (relative to the start +address). + +The relative end addresses work only when the start address is 0. In +those situations, there is no value difference between relative and +absolute addresses. + +Fixes: fdd591e00a9c9 ("drm/ssd130x: Add support for the SSD132x OLED controller family") +Cc: stable@vger.kernel.org +Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com> +Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> +Link: https://patch.msgid.link/20260622122604.32500-2-amit.barzilai22@gmail.com +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/gpu/drm/solomon/ssd130x.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/solomon/ssd130x.c ++++ b/drivers/gpu/drm/solomon/ssd130x.c +@@ -864,12 +864,13 @@ static int ssd132x_update_rect(struct ss + */ + + /* Set column start and end */ +- ret = ssd130x_write_cmd(ssd130x, 3, SSD132X_SET_COL_RANGE, x / segment_width, columns - 1); ++ ret = ssd130x_write_cmd(ssd130x, 3, SSD132X_SET_COL_RANGE, x / segment_width, ++ x / segment_width + columns - 1); + if (ret < 0) + return ret; + + /* Set row start and end */ +- ret = ssd130x_write_cmd(ssd130x, 3, SSD132X_SET_ROW_RANGE, y, rows - 1); ++ ret = ssd130x_write_cmd(ssd130x, 3, SSD132X_SET_ROW_RANGE, y, y + rows - 1); + if (ret < 0) + return ret; +
diff --git a/queue-7.2/drm-xe-vram-report-flat_ccs-base-misalignment.patch b/queue-7.2/drm-xe-vram-report-flat_ccs-base-misalignment.patch new file mode 100644 index 0000000..d7e8634 --- /dev/null +++ b/queue-7.2/drm-xe-vram-report-flat_ccs-base-misalignment.patch
@@ -0,0 +1,49 @@ +From 0e68c74e44da81a4599c52437ee1f63a2c234470 Mon Sep 17 00:00:00 2001 +From: Matthew Auld <matthew.auld@intel.com> +Date: Wed, 2 Sep 2026 13:41:20 +0100 +Subject: drm/xe/vram: report FLAT_CCS base misalignment +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Auld <matthew.auld@intel.com> + +commit 0e68c74e44da81a4599c52437ee1f63a2c234470 upstream. + +So we can easily check if a machine had the CCS bug, when looking back +over bug reports where we have the same machine with newer kernel. + +Example print for a machine with the CCS bug: + + FLAT_CCS base:27bbff800, aligned:no + +v2 (Matt B): + - Unconditionally print the base + alignment + +Fixes: 37173392741c ("drm/xe/vram: fix ccs offset calculation") +Signed-off-by: Matthew Auld <matthew.auld@intel.com> +Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> +Cc: Matthew Brost <matthew.brost@intel.com> +Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> +Cc: stable@kernel.org +Reviewed-by: Matthew Brost <matthew.brost@intel.com> +Link: https://patch.msgid.link/20260902124117.918018-9-matthew.auld@intel.com +(cherry picked from commit d00b7f4f03bbeb2efad872f1686130e18c2b4141) +Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/gpu/drm/xe/xe_vram.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/xe/xe_vram.c ++++ b/drivers/gpu/drm/xe/xe_vram.c +@@ -90,6 +90,9 @@ static int get_flat_ccs_offset(struct xe + offset |= offset_lo << 6; /* HW view bits 31:6 */ + offset *= num_enabled; /* convert to SW view */ + ++ drm_info(&xe->drm, "FLAT_CCS base:%llx, aligned:%s\n", offset, ++ str_yes_no(IS_ALIGNED(offset, SZ_128K))); ++ + /* + * Everything below this offset is handed to the VRAM + * allocator, so it has to be the *first* address the
diff --git a/queue-7.2/series b/queue-7.2/series index fab276c..4bc5d90 100644 --- a/queue-7.2/series +++ b/queue-7.2/series
@@ -471,3 +471,12 @@ f2fs-fix-to-zero-post-eof-data-when-extending-file-size.patch drm-amdgpu-fix-init-ordering-in-amdgpu_vram_mgr_init.patch drm-amdgpu-avoid-force-completing-uninitialized-uvd-rings.patch +drm-xe-vram-report-flat_ccs-base-misalignment.patch +drm-panthor-harden-firmware-build-info-bounds-checks.patch +drm-panthor-fix-firmware-control-interface-bounds-checks.patch +drm-bridge-dw-hdmi-fix-i2c-adapter-leak-on-probe-failure.patch +drm-panel-edp-fix-i2c-adapter-leak-on-probe-failure.patch +drm-fix-race-between-partial-drm_dev_register-failure-and-ioctl.patch +drm-i915-display-clear-sel_fetch_plane_ctl-on-plane-disable.patch +drm-i915-guard-against-null-driver_data-in-i915_pci_probe.patch +drm-ssd130x-fix-column-and-row-end-address-in-partial-updates-for-ssd132x.patch