Hi Dave, Sima,
here is this week's PR from drm-misc-fixes. There's one cross-subsys
commit to the dma-buf code. Commit 5ab62dd3687b ("drm: prevent integer
overflows in dumb buffer creation helpers") has not Link tag because
it went through the security list.
Best regards
Thomas
drm-misc-fixes-2026-05-29:
Short summary of fixes pull:
amdxdna:
- require IOMMU on AIE2
dumb-buffer:
- prevent overflows in dumb-buffer creation
dma-buf:
- fix UAF in dma_buf_fd() tracepoint
hyperv:
- improve protocol validation
ivpu:
- test write offset in debugfs
rocket:
- fix UAF in bo creation
The following changes since commit 9af1b6e175c82daf4b423da339a722d8e67a735a:
drm/virtio: use uninterruptible resv lock for plane updates (2026-05-20
18:12:11 +0300)
are available in the Git repository at:
https://gitlab.freedesktop.org/drm/misc/kernel.git
tags/drm-misc-fixes-2026-05-29
for you to fetch changes up to 5ab62dd3687bcc2cc542b99385aabac5c996db6f:
drm: prevent integer overflows in dumb buffer creation helpers (2026-05-29
08:30:47 +0200)
----------------------------------------------------------------
Short summary of fixes pull:
amdxdna:
- require IOMMU on AIE2
dumb-buffer:
- prevent overflows in dumb-buffer creation
dma-buf:
- fix UAF in dma_buf_fd() tracepoint
hyperv:
- improve protocol validation
ivpu:
- test write offset in debugfs
rocket:
- fix UAF in bo creation
----------------------------------------------------------------
Berkant Koc (2):
drm/hyperv: validate resolution_count and fix WIN8 fallback
drm/hyperv: validate VMBus packet size in receive callback
Dan Carpenter (1):
accel/ivpu: prevent uninitialized data bug in debugfs
David Carlier (1):
dma-buf: fix UAF in dma_buf_fd() tracepoint
Dhabaleshwar Das (1):
accel/rocket: fix UAF via dangling GEM handle in create_bo
Lizhi Hou (1):
accel/amdxdna: Block running when IOMMU is off
Rajat Gupta (1):
drm: prevent integer overflows in dumb buffer creation helpers
drivers/accel/amdxdna/aie2_pci.c | 5 ++
drivers/accel/ivpu/ivpu_debugfs.c | 2 +-
drivers/accel/rocket/rocket_gem.c | 17 +++--
drivers/dma-buf/dma-buf.c | 6 +-
drivers/gpu/drm/drm_dumb_buffers.c | 14 +++-
drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++++++++++++++++++++-----
6 files changed, 132 insertions(+), 25 deletions(-)
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
