Hi Linus, Weekly fixes pull, small and all over fixes, mostly xe and amdgpu, with some ttm and a core fix for the handle change pain.
Let me know if any issues, Dave. drm-fixes-2026-05-16: drm fixes for 7.1-rc4 core: - fix for the fix for the handle change race. ttm: - avoid infinite loop in swap out - avoid infinite loop in BO shrinking - convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC bridge: - imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup i915: - Skip __i915_request_skip() for already signaled requests - Fix VSC dynamic range signaling for RGB formats [dp] xe: - Madvise fix around purgeability tracking - Restore engine mask for specific blitter style - Couple UAF fixes - Drop unused ggtt_balloon field amdgpu: - Userq fixes - DCN 3.2 fix - RAS fix - GC 12 fix gma500: - oaktrail_lvds: fix i2c handling loongson: - use managed cleanup for connector polling panfrost: - handle results from reservation locking correctly qaic: - check for integer overflows in mmap logic rocket: - handle results from reservation locking correctly The following changes since commit 5d6919055dec134de3c40167a490f33c74c12581: Linux 7.1-rc3 (2026-05-10 14:08:09 -0700) are available in the Git repository at: https://gitlab.freedesktop.org/drm/kernel.git tags/drm-fixes-2026-05-16 for you to fetch changes up to dc366607c41c45fd0ae6f3db090f31dd611b644a: drm: Replace old pointer to new idr (2026-05-16 09:32:43 +1000) ---------------------------------------------------------------- drm fixes for 7.1-rc4 core: - fix for the fix for the handle change race. ttm: - avoid infinite loop in swap out - avoid infinite loop in BO shrinking - convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC bridge: - imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup i915: - Skip __i915_request_skip() for already signaled requests - Fix VSC dynamic range signaling for RGB formats [dp] xe: - Madvise fix around purgeability tracking - Restore engine mask for specific blitter style - Couple UAF fixes - Drop unused ggtt_balloon field amdgpu: - Userq fixes - DCN 3.2 fix - RAS fix - GC 12 fix gma500: - oaktrail_lvds: fix i2c handling loongson: - use managed cleanup for connector polling panfrost: - handle results from reservation locking correctly qaic: - check for integer overflows in mmap logic rocket: - handle results from reservation locking correctly ---------------------------------------------------------------- Arvind Yadav (1): drm/xe/madvise: Track purgeability with BO-local counters Chaitanya Kumar Borah (1): drm/i915/dp: Fix VSC dynamic range signaling for RGB formats Christian König (4): drm/amdgpu: remove deadlocks from amdgpu_userq_pre_reset drm/amdgpu: rework amdgpu_userq_signal_ioctl v3 drm/amdgpu: remove almost all calls to amdgpu_userq_detect_and_reset_queues drm/amdgpu: fix userq hang detection and reset Dave Airlie (4): Merge tag 'drm-intel-fixes-2026-05-13' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes Merge tag 'amd-drm-fixes-7.1-2026-05-13' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes Merge tag 'drm-xe-fixes-2026-05-14' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Merge tag 'drm-misc-fixes-2026-05-15' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Edward Adam Davis (1): drm: Replace old pointer to new idr Guangshuo Li (1): drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup Gyeyoung Baek (2): accel/rocket: Fix prep_bo ioctl leaking positive return from dma_resv_wait_timeout() drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() Jesse Zhang (1): drm/amdgpu/gfx_v12_0: set gfx.rs64_enable from PFP header on GFX12 Johan Hovold (3): drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup drm/gma500/oaktrail_lvds: fix hang on init failure drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init Matt Roper (1): drm/xe: Make decision to use Xe2-style blitter instructions a feature flag Matthew Auld (2): drm/xe/dma-buf: handle empty bo and UAF races drm/xe/dma-buf: fix UAF with retry loop Michal Wajdeczko (1): drm/xe: Drop unused ggtt_balloon field Mikhail Gavrilov (1): drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED Myeonghun Pak (1): drm/loongson: Use managed KMS polling Sebastian Brzezinka (1): drm/i915: skip __i915_request_skip() for already signaled requests Thomas Hellström (3): drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure Xiang Liu (1): drm/amd/ras: Fix CPER ring debugfs read overflow Zack McKevitt (1): accel/qaic: Add overflow check to remap_pfn_range during mmap drivers/accel/qaic/qaic_data.c | 23 +- drivers/accel/rocket/rocket_gem.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 29 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 131 +++++------ drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 245 ++++++++++----------- drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.h | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 7 + .../amd/display/dc/resource/dcn32/dcn32_resource.c | 8 +- drivers/gpu/drm/bridge/imx/imx8qxp-pxl2dpi.c | 40 ++-- drivers/gpu/drm/drm_gem.c | 7 +- drivers/gpu/drm/gma500/oaktrail_hdmi.c | 1 + drivers/gpu/drm/gma500/oaktrail_lvds.c | 9 +- drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/gt/intel_reset.c | 3 +- drivers/gpu/drm/loongson/lsdc_drv.c | 2 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 2 + drivers/gpu/drm/ttm/ttm_bo.c | 18 +- drivers/gpu/drm/ttm/ttm_bo_util.c | 11 +- drivers/gpu/drm/ttm/ttm_resource.c | 18 +- drivers/gpu/drm/xe/xe_bo.c | 6 +- drivers/gpu/drm/xe/xe_bo.h | 88 +++++++- drivers/gpu/drm/xe/xe_bo_types.h | 28 ++- drivers/gpu/drm/xe/xe_dma_buf.c | 80 ++++--- drivers/gpu/drm/xe/xe_gt_types.h | 7 + drivers/gpu/drm/xe/xe_migrate.c | 18 +- drivers/gpu/drm/xe/xe_pci.c | 9 + drivers/gpu/drm/xe/xe_tile_types.h | 2 - drivers/gpu/drm/xe/xe_vm.c | 51 ++++- drivers/gpu/drm/xe/xe_vm_madvise.c | 162 +------------- drivers/gpu/drm/xe/xe_vm_madvise.h | 2 - include/drm/ttm/ttm_resource.h | 2 + 32 files changed, 540 insertions(+), 495 deletions(-)
